From the EPAL homepage -
EPAL is a formal language for writing enterprise privacy policies to govern data handling practices in IT systems according to fine-grained positive and negative authorization rights. It concentrates on the core privacy authorization while abstracting data models and user-authentication from all deployment details such as data model or user-authentication.
An EPAL policy defines lists of hierarchies of data-categories, user-categories, and purposes, and sets of (privacy) actions, obligations, and conditions. user-categories are the entities (users/groups) that use collected data (e.g., travel expense department or tax auditor). Data-categories define different categories of collected data that are handled differently from a privacy perspective (e.g., medical-record vs. contact-data). Purposes model the intended service for which data is used (e.g., processing a travel expense reimbursement or auditing purposes).
Actions model how the data is used (e.g., disclose vs. read). Obligations define actions that must be taken by the environment of EPAL (e.g., delete after 30 days or get consent). Conditions are Boolean expressions that evaluate the context (e.g., "the user-category must be an adult" or "the user-category must be the primary care physician of the data-subject").
These elements are then used to formulate privacy authorization rules that allow or deny actions on data-categories by user-categories for certain purposes under certain conditions while mandating certain obligations. In order to allow for general rules and exceptions, EPAL rules are sorted by descending precedence. e.g., a rule about a particular employee can be inserted before the rule about the department in order to implement an exception.
|EPAL EDITOR v1.1||
Isabel Arnold - IBM
Anita Krueger - IBM
|EPAL EDITOR v1.0||
Pranav Dharma - NCSU Computer Science
Homayoon Kazemzadeh - NCSU Computer Science
Rich Larsen - NCSU Computer Science
Sri Vani - NCSU Computer Science
Tintin Sukawati - NCSU Computer Science
EPAL Editor v1.1 - EPALEditor.jar
EPAL Editor v1.0 - EPALEditor.jar
EPAL Homepage - http://www.zurich.ibm.com/security/enterprise-privacy/epal/Specification/index.html
NCSU Computer Science Homepage - http://www.csc.ncsu.edu
NCSU eCommerce Lab Homepage - http://ecommerce.ncsu.edu/studio