Information Assurance and Security

The Platform for Privacy Preferences (P3P), developed by the W3C, provides an XML-based language for websites to en-code their data-collection and data-use practices in a machine-readable form. To fully deploy P3P in enterprise informa-tion systems and over the Web, a well-defined semantics for P3P policies is a must, which is lacking in the current P3P framework. Without a formal semantics, a P3P policy may be semantically inconsistent and may be interpreted and rep-resented differently by different user agents; it is difficult to determine whether a P3P policy is indeed enforced by an en-terprise; and privacy policies from different corporations can-not be formally compared before information exchange. In this paper, we propose a relational formal semantics for P3P policies, which precisely and intuitively models the relation-ships between different components of P3P statements (i.e., collected data items, purposes, recipients and retentions) dur-ing online information collection. The proposed formal semantics is an important step towards improving P3P, making it more appropriate to be integrated with business practice and ultimately accelerating the large-scale adoption of P3P across the Internet. 1