An Ontological Study of Data Purpose for Privacy Policy Enforcement

Data purpose is a central concept in modeling privacy requirements. Existing purpose-based approaches for privacy protection have mainly focused on access control. The problem of ensuring the consistency between data purpose and data usage has been under-addressed. In an attempt to bridge this research gap, we develop a grounded understanding of data purpose and relevant key concepts that is fundamental to address the problem. We propose a Minimum Action Permission Principle as a basic guideline to establish a path to solutions to the consistency problem for privacy management.