Privacy policies often place requirements on the purposes for which a governed entity may use personal information. For example, regulations, such as HIPAA, require that hospital employees use medical information for only certain purposes, such as treatment. Thus, using formal or automated methods for enforcing privacy policies requires a semantics of purpose requirements to determine whether an action is for a purpose or not. We provide such a semantics using a formalism based on planning. We model planning using a modified version of Markov Decision Processes, which exclude redundant actions for a formal definition of redundant. We use the model to formalize when a sequence of actions is only for or not for a purpose. This semantics enables us to provide an algorithm for automating auditing, and to describe formally and compare rigorously previous enforcement methods.
We borrow the notion of from Mackie's work on formalizing using counterfactual reasoning @cite_38 . In particular, Mackie defines a to be a non-redundant part of a sufficient explanation of an effect. Roughly speaking, we replace the causes with actions and the effect with a purpose. The extension to our semantics proposed in , may be seen as another instance of non-redundancy. This time, we replace the causes with purposes and the effect with an action. This suggests that for an action to be for a purpose, we expect both that the action was non-redundant for improving that purpose and that the purpose was non-redundant in motivating the action. That is, we expect planning to be parsimonious.
@cite_38
1632653496
Studies causation both as a concept and as it is 'in the objects.' Offers new accounts of the logic of singular causal statements, the form of causal regularities, the detection of causal relationships, the asymmetry of cause and effect, and necessary connection, and it relates causation to functional and statistical laws and to teleology.