IBM Enterprise Privacy Architecture (EPA)

Enterprises use privacy statements to promise privacy to customers and to set up their internal policies for dealing with employee and other personal data. The focus of this work is a comprehensive methodology for managing and enforcing these promises throughout an enterprise.

This includes three main elements:

We will now describe these building blocks in more detail.

The IBM Enterprise Privacy Architecture is a methodology for enterprises to provide an enhanced and well-defined level of privacy to their customers. This includes privacy-friendly business processes, privacy-enabling security technology, and enterprise privacy management.

Privacy-friendly business processes are derived from ordinary business processes by minimizing the data needed to provide the desired services. This may include switching to equivalent service alternatives that require less personal data. It may also utilize privacy-enabled security technology.

Even with privacy-friendly business processes and security technology, enterprises still collect a certain amount of personal data. In order to protect the privacy of the consumers, a privacy-enabled enterprise will promise fair information practices to its customers. These are stated in a privacy policy and can be formalized using P3P. Enterprise privacy management is a privacy-enabled way to manage the collected data of an enterprise while enforcing the privacy promises that have already been made.

IBM Enterprise Privacy Authorization Language (EPAL)

EPAL and Submission to W3C, 2003.

One part of our research is to develop a formal language for defining enterprise privacy practices. Enterprises promise a certain level of privacy to their customers using privacy statements or the Platform for Privacy Preferences (P3P). The formal language can then be used to formalize these promises. By automated enforcement of these enterprise-specific privacy practices, enterprises are able to uphold the promises they have made.

A privacy policy describes the privacy practices as well as the opt-in and opt-out choices of an individual. Policies are then associated with all data collected by an enterprise. This "sticky policy paradigm" mandates that the policy sticks to the data, travels with it, and can be used to decide how the data can be used. By separating application- and enterprise-dependent deployment information from the actual policies, E-P3P policies can be used to control the flow and usage of data within and among enterprises.

The sticky policy paradigm necessitates certain operations on the policies of an enterprise, such as comparing whether data can be forwarded to another enterprise that has its own policy. We develop a toolbox of such operations.

Component architecture for enforcing privacy policies

Another part of our research is to define an architecture that enforces policies throughout an enterprise. This includes a policy evaluation engine as well as privacy-enabled resource monitors that enforce the policy for a variety of resources.