# A Comparative Audit of Privacy Policies from
Healthcare Organizations in USA, UK and India

Gunjan Balde
IIT Kharagpur  Aryendra Singh
IIT Kharagpur  Niloy Ganguly
IIT Kharagpur  Mainack Mondal
IIT Kharagpur

###### Abstract

Data privacy in healthcare is of paramount importance (and thus regulated
using laws like HIPAA) due to the highly sensitive nature of patient data. To
that end, healthcare organizations mention how they
collect/process/store/share this data (i.e., data practices) via their privacy
policies. Thus there is a need to audit these policies and check compliance
with respective laws. This paper addresses this need and presents a large-
scale data-driven study to audit privacy policies from healthcare
organizations in three countries—USA, UK, and India.

We developed a three-stage novel workflow for our audit. First, we collected
the privacy policies of thousands of healthcare organizations in these
countries and cleaned this privacy policy data using a clustering-based mixed-
method technique. We identified data practices regarding users’ private
medical data (medical history) and site privacy (cookie, logs) in these
policies. Second, we adopted a summarization-based technique to uncover exact
broad data practices across countries and notice important differences.
Finally, we evaluated the cross-country data practices using the lens of legal
compliance (with legal expert feedback) and grounded in the theory of
Contextual Integrity (CI). Alarmingly, we identified six themes of non-
alignment (observed in 21.8% of data practices studied in India) pointed out
by our legal experts. Furthermore, there are four potential violations
according to case verdicts from Indian Courts as pointed out by our legal
experts. We conclude this paper by discussing the utility of our auditing
workflow and the implication of our findings for different stakeholders.

##  1 Introduction

Today, healthcare organizations like hospitals around the world collect highly
sensitive patient data. This data is used for multiple purposes—keeping track
of patients, their treatment, and even health informatics via health-data
mining [50, 16, 56]. Due to the sensitive and personal nature of this data,
regulating bodies (e.g. governments) have drafted and enforced laws on how to
store and utilize the patient data (e.g., their medical records, financial
information, and even passwords) while maintaining the privacy and security of
this data. These laws include GDPR 111General Data Protection Regulation
article 35 in EU, Data Protection Act 2018 in the UK, HIPAA, 1996 222Health
Insurance Portability and Accountability Act of 1996 in the USA, and
Information Technology Rules, 2011 and more recent proposal of DISHA
333Digital Information Security in Healthcare Act in India [42, 24, 13, 35,
37]. Naturally, healthcare organizations should comply with applicable laws
for handling sensitive patient data and mention their data practices (how they
collect/process/store/share this data) in official privacy policies. Thus,
auditing privacy policies should uncover data practices of healthcare
organizations.

Figure 1: Workflow for auditing privacy policies of healthcare organizations
in a country with outputs for each step.

In general, mining privacy policies is an active research domain where
researchers use machine learning as well as natural language processing
techniques for finding privacy violations / non-compliance with these laws for
different industries. However, we noted that, although a large body of work on
privacy policy primarily focused on services like shopping sites or technology
companies [59, 60, 40, 27], mining healthcare organizations’ privacy policies
have attracted relatively scant attention. One reason might be that in many
western countries these privacy policies are strictly required to follow
specific templates which already ensure legal compliance, making them less
interesting to analyze. However, beyond the privacy policy of a single
organization, there may be differences in broad practices across countries or
regions that may be interesting to analyze. Side by side, a country like India
which has a still-nascent approach to enforce privacy laws necessitates
auditing the privacy policies put forward by the Indian hospitals at scale and
checking legal compliance. Hence there is a need for systematically auditing
privacy policies of healthcare organizations in a country to help various
stakeholders to take further action.

To that end, in this paper, we investigate the following questions: How can we
systematically audit healthcare privacy policies at scale across different
countries to uncover data practices? Are these practices appropriate and
compliant with applicable laws? We answered these questions by (i) developing
a novel auditing workflow and (ii) using this workflow on the privacy policies
from USA, UK and India.

Our novel mixed-method auditing workflow: Our workflow (Figure 1) is a three-
stage methodology to collect privacy policies of healthcare organizations of a
country, extract the data practices from the policies and analyze the
policies. In the first stage of our workflow, we use a semi-automated process
to collect the privacy policies declared by hospitals on their websites (a
large majority of the countries across the globe mandates such declaration).
This is then followed by a clustering-based data cleaning stage, which yields
hospital-specific privacy policies.

In second stage of workflow, we used a segmentation-summarization approach to
select the most important sentences belonging to a particular data practice
category and create a ‘template’ that readily lends itself to auditing via
comparative thematic analysis. In the final stage we analyze the data
practices from policies of healthcare organizations using the theory of
Contextual Integrity (CI) and through the lens of legal compliance (using
expert feedback). Our workflow provides both high-level and in-depth
exploration of data practices revealed by privacy practices of healthcare
organizations in different countries.

Auditing outcome from applying our novel workflow on USA, UK and India: We
audited privacy policies of healthcare organizations from three different
countries, USA, UK, and India that have all their health information in
English and have different health laws. In this direction, we make the
following contributions.

  * •

Using our workflow we put forward a first-ever large-scale representative
dataset of privacy policies from hospitals of three countries: India (377), UK
(183), and USA (1,505) (Section 3).

  * •

Through the graph-clustering-based data cleaning phase of our workflow, our
audit shows that for USA roughly 50% of the policies are extremely similar to
each other and also discussed the practices in a similar fashion as use-cases
described in the body of HIPAA. In contrast, in India, few policies actually
discussed the handling of users’ sensitive medical information (Section 3.2).

  * •

Finally, we found and validated (using feedback from a team of legal experts)
potential non-compliance in the data practices (i.e., how they
collect/process/store/share health-related data) of Indian hospitals’ privacy
policies. In fact, our audit found six main reasons of non-alignment in Indian
privacy policies which were present in 21.8% data practices of which four were
identified as potential violations (Section 5).

Ethical considerations: In this study we automatically collected publicly
available privacy policies from healthcare organizations in line with earlier
work [59, 60, 40]. The only human-subjects study phase was the expert
feedback. Although our institute lacks a traditional IRB, we extensively
discussed among ourselves and with other researchers to minimize any harm in
our protocol. During our feedback phase by legal experts (Section 5) we were
extremely careful about ethically collecting data and followed the best
practices prescribed in the Menlo report [20]. Specifically, to protect
privacy of our legal experts we removed all personally identifiable
information (e.g., name or email id) before storing and analyzing the
annotated data and qualitative feedback. Also the experts had the option to
abort any time from giving feedback on legal compliance. Lastly, we only
report aggregate results without revealing any individual or organization.

Next, we start with discussing the necessary related work and then move to
describing our auditing workflow as well as findings of our audit after
applying the workflow in practice.

##  2 Related Work

We present the prior work along three dimensions—mining privacy policies,
leveraging natural language processing (NLP) for consumer privacy protection,
and leveraging CI (Contextual Integrity) theory.

Privacy policy mining. Prior studies focused on automated mining privacy
policies, often with the goal to uncover potential privacy violations. These
earlier studies range from mining privacy policies of mobile applications from
Google Play store to mining generic privacy policies [59, 60, 40]. Some of
them even proposed to improve readability and structure using automated
learning methods [17, 26]. In general, these studies often collected privacy
policy data from the most popular websites—Using Google trends (to get
websites against most popular queries) or Alexa.com to identify top domains
[40, 6, 28, 46]. They identified privacy policies of these domains by
collecting hyperlinks with “privacy policy” or “terms of service” mentioned in
the associated text or even looked for specific keywords like “privacy” in the
URL itself [27, 6, 46]. We build on these studies, but our work is quite
distinct—we focused on privacy policies from USA, UK, and Indian Healthcare
Organizations which is distinctly separate from top (often shopping or
technology-focused) websites. Furthermore, we study variation of privacy
policies across different countries and audit their legal compliance (e.g.,
selling customer information without consent).

NLP for consumer privacy. Ravichander et al, 2021 [43], discuss how NLP can
benefit consumer privacy. Furthermore, Wilson et al. [55] have identified data
practices from policies and put forward OPP-115—a dataset of 115 privacy
policies with 3,792 annotated segments. These segments were annotated across
10 data privacy categories like first party collection, data retention etc.
Earlier works also extracted opt-out choices present from policy text using
NLP techniques [45, 6]. Works of Zimmeck et al [60, 59] employed NLP
techniques to analyze privacy policies of mobile applications to identify
potential legal non-compliance. Other works utilized NLP techniques to carry
out the readability of privacy policies using NLP techniques [31, 33] and
explored possibility of question answering over privacy policies to allow
consumers to selectively query privacy policies for issues that are important
to them [44, 1]. Some studies even utilized summarization techniques to
construct summaries to help the users easily understand the practices
described in the privacy policy [57, 22, 52]. We leveraged these earlier
studies on classification of data practices and summarization techniques.

Theory of Contextual Integrity (CI). Contextual Integrity [38] theory provides
a systematic framework to study privacy norms and expectations. CI defines
privacy as appropriate flows of information. Each information flow consists of
five parameters: subject, sender, recipient, information type (or attribute),
and transmission principle. Appropriate information flows conform to the
socially acceptable values of these parameters. Earlier work demonstrates that
we can infer privacy norms (i.e., rules regulating acceptable information
flow) by measuring the acceptability of different information flows (created
with a varying combination of CI parameter values) [4, 5, 47, 34]. For
example, users in general might be comfortable when a healthcare organization
(sender) discloses user’s medical records (attribute) to the doctor in-charge
(recipient) to monitor the health status (transmission principle). However,
they might be uncomfortable if the recipient is a health insurance provider.
Our work aims to understand appropriateness of the privacy policy data
practices and check their alignment with law. Thus we build on prior work and
choose CI as a suitable framework for our purpose.

Now, we present our first stage of auditing workflow for collecting and
analyzing privacy policies from healthcare organizations.

##  3 Data Collection and Cleaning

We start with the first phase of our workflow—automatically collecting the
privacy policies of healthcare organizations (in this work) from USA, UK and
India. We will discuss our approach to collect a set of privacy policies, and
then discuss how we obtain clean hospital-specific privacy policies.

###  3.1 Approach to Collect Privacy Policy Text At-scale

We follow the following three-step method for each country to systematically
collect privacy policies from healthcare organizations and extract privacy
policy text:

Step-I: We collect the list of healthcare organization (or Hospital) urls
using an automated approach.

Step-II: For every collected url, we visit the landing page and find
hyperlinks on the page which potentially are privacy policy urls. Specifically
in the ‘a’ tag of a url we checked for words like privacy policy, privacy
notice, terms and conditions (in line with [48]).

Step-III: We parse the HTML text present on privacy policy urls to finally
extract privacy policy text (using Trafilatura [7]). We apply these steps for
USA, UK and Indian hospitals.

####  3.1.1 Collecting Country-Specific Privacy Policies

For each country, we adopted different ways for obtaining the urls of the
Healthcare organizations for (Step-I).

USA. We used an official list of USA Hospitals [51] that lists hospitals in
the USA along with the State, type of facility, ratings etc., for a total of
5299 hospitals. We used a simple google query search using the format:
$<Hospital\\_Name+State>$ and extracted the top url result [39]. We finally
had 2511 hospital urls for a total of 4333 hospitals. Using this set after
processing through Step-II, we get 1828 URLs of which 1735 were unique URLs
for a total of 3250 hospitals. For remaining 583 urls for which we could not
find a url in an automated fashion, we manually checked and found 88 more
privacy policy urls. After processing these policy urls using Step-III, we
collected total 1,505 unique privacy policies (several hospitals had identical
privacy policies).

UK. For the UK, NHS (National Health Service) Trusts are the main entities
responsible for functioning of the healthcare organizations. Using a list of
NHS Trusts [53] we obtained 220 urls for web pages on this list and parsed the
webpages to obtain privacy policies. We thus obtain a final set of 183 unique
privacy policies after applying Step-II and III of our collection process.

India. We used the MedIndia’s Hospital Directory [32] of 31,522 hospitals. We
extracted the name of the hospitals along with the city from this directory.
We then used the following query on Google: $<Hospital\\_Name+City>$, and
extracted the top url using the googlesearch package [39]. We only consider
the resulting urls if domains have non-empty overlap with the corresponding
Hospital_Name (we removed common words like ‘hospital’, ‘nursing’ etc. to
preserve the specificity of hospital names). We also removed urls which
contain obviously non-Indian domain names (e.g., ‘.co.uk’ and ‘.au’). We
finally end up with 6,015 unique urls from 7,662 unique hospitals. On
processing these urls (using Steps-II and III) we obtained 657 unique privacy
policies.

We noted that India lacked global repositories, which were the primary and a
credible source for UK and USA. So we manually verified each of the 657
policies whether they correctly mapped to the corresponding hospitals, and in
fact, were a healthcare organization policy. On manual verification, we found
several urls corresponding to either government (or private) directories
mentioning these hospitals or news articles which we discarded. Finally, we
identified 370 unique privacy policies from 3,120 hospitals.

Type of Facility | Percentage
---|---
| Initial | Clean
USA
Acute Care Hospitals | 66.18 | 64.12
Critical Access Hospitals | 22.56 | 23.62
Psychiatric | 8.25 | 7.76
Children | 2.06 | 1.98
Acute Care - Department of Defense | 0.95 | 2.52
India
Clinic | 30.27 | 35.95
Multi-Specialty Hospital | 19.92 | 15.58
Pathology lab and Diagnostic Centre | 17.36 | 16.46
Diagnostic and Treatment center | 8.90 | 16.32
Super-Speciality Hospital | 6.69 | 3.18
Medical College/Institute/Hospital | 5.16 | 7.49
Speciality Hospital | 1.73 | 1.29
Others | 9.97 | 3.73
Table 1: Type of Facilities covered in USA and India

####  3.1.2  Coverage of our Collection Strategy

Since we searched privacy policy urls on only the landing-page, we might have
missed privacy policy urls not present on the landing pages. So, we manually
looked into landing pages from India and USA that our algorithm discarded due
to not finding a privacy policy (all urls from UK had a privacy policy). We
found that in only 2 cases of India (out of 100) the discarded website had a
privacy policy—however, in both the cases the policy is simple terms of
service, not related to healthcare data. For USA we initially discarded 583
landing pages; upon manual inspection we discovered 88 privacy policies from
them. We added these 88 policies to our dataset and arrived at 1,505 policies
in total. Thus, 1,505 privacy policies for USA, 183 for UK and 370 for India
constituted our final dataset. Next, we discuss the representativeness of
these policies from healthcare organizations.

####  3.1.3 Representativeness of Collected Policies

To judge the representativenenss of the policies obtained we looked into how
many states were covered by the policies obtained. We found that for USA, 50
out of 50 states were covered, for UK we covered 183 out of 219 NHSs and for
India we covered 24 out of 29 states. For USA and India, we also checked the
diverse types of hospitals covered in our dataset (Table 1). In short, we
covered diverse type of healthcare organizations across countries from various
states, giving us confidence about representativeness of our dataset.

####  3.1.4 Linguistic Properties of Privacy Policy Text

We first investigated the distribution of the number of words, sentences, and
Flesch Reading Ease Score—the result is shown in Table 2. We did this analysis
to understand the variation in the linguistic complexity of the policies
across countries and check for trivial (essential empty) policies that we
might have accidentally collected.The Indian privacy policies are on average
1125.21 words and 36.60 sentences long, whereas policies from the USA and the
UK are 2459.01 and 1783.80 words long and are made up of 96.93 and 61.0
sentences 444Sentences obtained using NLTK sent_tokenize module. The word and
sentence distribution was statistically significantly different (using Mann-
Whitney U test) with a medium effect size (using Cohen’s D) between India and
US (p < 0.0001, Cohen’s D = 0.49), and India and UK (p < 0.0001, Cohen’s D =
0.43). The Flesch Reading Ease scores of all policies were between 50 to 60
which indicate that the documents are uniformly fairly difficult to read (and
non-empty)—perhaps due to potentially complex privacy policies.

Country (#Policies) | #Words | #Sentences | Readability Score
---|---|---|---
| Mean | Median | Mean | Median | Mean | Median
USA (1505) | 2549.01 | 2401.0 | 96.93 | 84.0 | 51.15 | 51.66
UK (183) | 1783.80 | 1040.0 | 61.0 | 42.0 | 55.88 | 55.73
India (370) | 1125.21 | 747.0 | 40.47 | 32.0 | 52.47 | 52.58

Table 2: Distribution of Number of Words, Sentences and Flesch Reading Ease
score for each country

####  3.1.5 Type of Information Mentioned in Policies: First Party Collection

USA and UK. We find for USA, out of 1,505 policies 435 (28.9%) mention ‘PHI’
(short for Personal Health Information), and 1179 (78.4%) policies mention
medical records, whereas 350 (25.3%) policies mention ‘cookie’, and only 43
(2.9%) policies mention ‘logs’. For UK, out of 183 policies, 41 (22.4%)
policies mention ‘PHI’, 71 (38.7%) policies mention medical records, whereas
98 (53.5%) policies mention ‘cookies’ and only 12(6.5%) policies mention
‘logs’.

India. The Indian IT Rules, 2011 [35] identifies ‘medical records and history’
as one of the healthcare specific sensitive information. We checked (using
keywords) if Indian policies talk about this information. We find that out of
370 policies, 46 (12.2%) policies mention ‘medical history’ and ‘medical
records’. We also looked into how many policies talk about online data
(cookies and logs) and found that 236 (62.6%) policies mention ‘cookie’, and
25 (6.6%) mentions ‘logs’ in them. Interestingly, potentially with different
healthcare laws in place for USA and UK, we see that the mention of attributes
relevant to patient information is much more frequent (78.4% and 38.7%
respectively) in USA and UK than India (12.2%) (Blocks 1 and 2 of Table 3).

Keywords |  USA (#,%) |  UK (#,%) |  India (#,%)
---|---|---|---
Healthcare Specific Information
medical records |  1179, 78.4% |  71, 38.7% |  46, 12.2%
PHI |  435, 28.9% |  41, 22.4% |  0, 0%
Online Information
cookies |  350, 23.3% |  98, 53.5% |  236, 62.6%
logs |  43, 2.9% |  12, 6.5% |  25, 6.6%
Data Disclosure Practices
share |  1084, 72.1% |  118, 64.5% |  200, 53.1%
sell |  374, 24.8% |  19, 10.4% |  93, 24.7%
disclose |  806, 81.7% |  62, 33.8% |  175, 43.8%
pass |  12, 0.7% |  71, 38.8% |  4, 1.1%

Table 3: Attributes corresponding to type of information as discussed in
policies along with the count of policies they occur in and percentages.

####  3.1.6 Type of Information Mentioned in Policies: Data Disclosure
Practices

We identify how many policies actually mention the data disclosure practices
(to disclose users’ information) of these organizations. Specifically, we
looked for mentions of keywords share, disclose, sell, provide, and pass [3,
8, 19]. We find that 81.7% and 64.5% policies from the USA and UK mention data
disclosure practices, whereas 53.1% Indian policies mention such data
disclosure practices (Block 3 of Table 3). Thus the fraction of policies that
discuss such practices is almost similar (the most frequent practices are
presented in Table 11, Appendix A).

However, we noted that the data disclosure practices (i.e., the sentences)
from USA and UK are detailed and diligently mentioned under what conditions
and to whom is the data being disclosed. In contrast, in India, we noted that
the policies just mentioned ‘We do not sell, trade or rent users personal
identification information to others’, where others seems indefinite—it
doesn’t explicitly mention the third parties and organizations (either govt.
or private), and what information  covered by these clauses. A potential
reason is the right to ‘Accounting of Disclosures’, which is exclusive to USA
(mentioned in 245 policies)—consequently, the USA hospitals are required to
give the patient an account of the disclosures it has made of the patient’s
data over a specific time frame (e.g. 6 months, 1 year). In Section 4 and 5,
we further explore these data practices and their legal compliance. Next, we
present our methodolgy to obtain clean hospital policies.

###  3.2 Obtaining Clean Privacy Policy Text

Since we collected policies from websites, our policies might be a mixture of
policies dedicated to website and cookie and policies specific to hospitals’
handling of sensitive information of its users (as observed in Table 3). Thus
in our data cleaning phase, we aim to obtain a clean set of hospital policies
which we will analyze in the further stages of the workflow. We leverage a
simple intuition: Multiple privacy policies of hospitals operating in same
country (regulated by same law interpreted in a similar way), would have
similar data practices and similar policy text—these similar policies can be
analyzed together in a group, and a set of clean policies can thus be
obtained. So, we take a graph clustering-based approach to group policies with
similar text and in extension similar data practices.

####  3.2.1 Clustering of Privacy Policies

In our clustering phase, we leverage a popular graph community detection
algorithm Louvain [10] on policies from a country. It utilizes semantic
similarity at the policy level (obtained using Word Mover Distance [23]) above
a particular threshold as edge weights, to cluster together the policies that
are very similar in nature. We now discuss in brief our clustering strategy.

Building graph of privacy policies. The nodes in our graph are privacy
policies and the weights on the edges are the similarity scores based on Word
Mover Distance [23]. Specifically, we obtain the Word Mover Distance score for
every node pair (i.e. Privacy Policy) in the graph, we next normalize the
scores thus obtained to scale them between 0 and 1, we then apply a
$1-normalizedscore$ step to take this score from distance domain to similarity
domain. We assigned an edge between a pair of nodes if the corresponding
similarity is greater than some threshold. This was necessary, as simply
putting all possible edges with similarity weights led to all the policies
collapsing into a single community. We next discuss how we identify thresholds
for each country.

Selecting edge-thresholds for each country. To decide on the threshold to
assign edges for the community detection, we looked into several community
metrics [25] that determined the quality of generated communities. We used
modularity, normalized cut-ratio, and conductance. Additionally, we also used
coverage, which is computed as the fraction of policies covered at a
threshold.

To determine the thresholds, we choose the regions of higher modularity, lower
cut Ratio, and lower conductance, and moderate coverage. The distribution of
scores for each metric across similarity scores is shown in Figures 2 (India),
3 (UK), and 4 (USA) with threshold highlighted in red (See Appendix B).

Country | #Thres- | #Policies | #Comm- | Size of Communities
---|---|---|---|---
| hold | Covered | unities | >50 | 11-50 | 6-10 | 2-5
USA | 0.44 | 1110 | 4 | 2 | 0 | 2 | 0
UK | 0.45 | 161 | 3 | 2 | 0 | 1 | 0
India | 0.49 | 212 | 8 | 2 | 3 | 1 | 2

Table 4: Privacy policy communities for USA, UK and India.

Sizes of communities obtained. After applying the graph-based community
detection algorithm, the community distribution for each country is shown in
Table 4. Next we characterize these communities in order to obtain a set of
cleaned privacy policies.

####  3.2.2 Characterizing Communities to Obtain Clean
Policies

To perform a detailed characterization study for each of the countries, we
selected the most populous communities covering in total at least 80% of the
policies of the country. The communities thus selected for each country are as
follows: (a). India: Total 8 communities (I-1 to I-6) with the respective
sizes of 79, 66, 24, 19, 12, 8 (b). UK: A total of 2 communities of sizes 82
(UK-1) and 73 (UK-2) (c). USA: A total of 2 communities of sizes of 765 (US-1)
and 327 (US-2). The other communities are much smaller and sparser.

Coding privacy policies. In the coding phase two researchers coded whether a
privacy policy discusses specific data practices using Open Coding [54]. Our
initial codebook was inspired by OPP-115 codes [55]. Then a researcher went
over the dataset and augmented the codebook with additional data practices.
Next two researchers used this codebook to independently code the dataset.
Cohen’s kappa between two sets of codes was 0.8, showing significant
agreement. Finally, the two coders met to discuss and resolve small number of
disagreements, and assigned final codes.

Final codebook: There are six categories namely, (a). Online Data Collection
(OD), (b). First Party Collection (1C), (c). First Party Usage (1U), (d).
Third Party Disclosure (3D), (e). Data Retention (DR), and (f). User Rights
(edit, access, and delete) (UR) across which the annotation task was carried
out. OD covers practices specific to collection and processing of user’s
online Non-PII information (such as cookies, logs, IP address and so on). 1C
and 1U cover practices specific to collection and processing of user’s
(sensitive) healthcare information. 3D covers practices specific to disclosure
of information to third parties and to entities outside the healthcare
organizations. UR covers practices discussing users’ rights over their
information being held by the healthcare organizations.

Comm | OD | 1C | 1U | 3D | DR | UR | Avg
---|---|---|---|---|---|---|---
USA
US-1 | 0.04 | 0.43 | 1 | 1 | 0 | 1 | 0.69
US-2 | 0.97 | 0.03 | 0.03 | 1 | 0 | 0.06 | 0.22
UK
UK-1 | 0.32 | 0.86 | 0.96 | 0.96 | 0.78 | 0.78 | 0.87
UK-2 | 0.92 | 0.38 | 0.28 | 0.52 | 0.34 | 0.16 | 0.34
INDIA
I-1 | 0.96 | 0.78 | 0.53 | 0.97 | 0.50 | 0.61 | 0.68
I-2 | 1 | 0.06 | 0.06 | 0.92 | 0.18 | 0.30 | 0.30
I-3 | 0.63 | 0.08 | 0.08 | 0.92 | 0.04 | 0.04 | 0.23
I-4 | 1 | 0 | 0 | 0 | 0 | 0.74 | 0.14
I-5 | 1 | 0 | 0 | 0 | 0.83 | 0.91 | 0.35
I-6 | 1 | 0 | 0 | 0.75 | 0 | 0.75 | 0.3

Table 5: Scores for communities from each country for a data practice
category. Categories are shortened for brevity.

Scores: Using this codebook, researchers coded random 110 policies from USA
(77 from US-1, and 33 from US-2), random 100 from UK (50 from UK-1 and UK-2
each) and 208 policies from India (spanning all 6 communities from I-1 to
I-6). Overall 418 policies across 3 different countries were coded. We
tabulate the final codes and assign a score to each community under a category
as the fraction of policies actually discussing that category. Ideally, a
‘clean’ community should have a majority of policies discussing all the
categories. Average scores for selected communities, across each data practice
is in Table 5 (excluding $OD$). ‘clean’ communities for each country (with
highest average score) are in bold.

Discussion. We now discuss insights (using the final coded privacy policies)
about the privacy policy communities we detected for each country.

(i) USA. We see that US-1 performs much better than US-2 across all the
categories (See Table 5, Under USA Row US-1 and US-2) except for OD. Looking
into the text from the US-1 community, we found that policies discuss in-depth
health information usage of by the first party (1U,1). The salient difference
between these two communities is that US-2 contains policies discussing
website and cookie privacy policy (OD, 0.97) whereas US-1 community discusses
more detailed healthcare privacy policy (OD, 0.06 and 1U, 1).

(ii) UK. Like USA, we see that UK-1 performs much better than UK-2 across all
the categories (See Table 5, Under UK Row UK-1 and UK-2). We found that
(similar to USA) policies from UK-2 are mostly website and cookie privacy
policies (OD, 0.92) and have low scores across categories.

(iii) India. We observe that on average the policies for the I-1 community
(See Table 5, Under India, Rows for I-1), discusses about most of the accepted
data practices. We find that the policies present in this community comprises
the hospital privacy policies discussing the handling of user-health data(1C,
0.78) and practices related to third parties(3D, 0.97). For the rest of the
communities, we found the focus mainly to be on online data (OD>0.5) with
almost no focus on handling of sensitive personal medical information (1C,
1U$\leq$0.08).

Summary. Our cleaned data revealed that the countries with strict healthcare-
specific laws in place (UK and USA) for a significant period, resulted in a
few big communities, where the difference was observed primarily in the nature
of policies, some being online website privacy and cookie policies, whereas
others being hospital privacy policies. But for India, with the lack of a
descriptive, concise healthcare-specific law, we have a lot of small
communities which exhibit different traits as discussed. We found that (a)
policies from India were more focused on discussing Online Data (OD>0.5 for
all), whereas with USA and UK that was not the case. (b) policies for USA had
no mention of how the hospital retains Personal Health Information (PHI) of
the user (DR,0) and little mention of how it collects this information
(1C,0.43).

After identifying clean, hospital-specific policies we now delve into our
analysis part of the workflow focusing on the policies from clean clusters
from each country namely US-1 containing 765 policies, UK-1 with 82 policies,
and I-1 with 79 policies. We note that the clean set also retains the
representativeness and diversity of initial data (Sec.3.1.3) as shown in Table
1. The state distribution for USA and India also remained same in clean data.

##  4 Summarization and Thematic Analysis

In this step of the workflow, we aim to compare the data practices of privacy
policies across countries (which are regulated by different laws) across two
broad categories of First Party Collection and Usage, and Third Party
Disclosure. Since each policy community consisted of similar privacy policies,
we created a representative summary (template) for a given community which
encompassed the data practices of the policies in the community—for each
community, we use automated text-summarization followed by a thematic analysis
to (i) preserve original practices in summary (ii) omit redundant manual
effort of checking hundreds of (very similar) privacy policies from healthcare
organizations (iii) ensure inclusion of most frequent and diverse data
practices.

###  4.1 Methodology to Create Templates

The methodology of identifying our category-specific templates is broadly
classified into two phases: (a) Phase-I Finding Segments: In this phase, for a
community we identify the segments present in each policies across four data
practice categories in an automated fashion. (b) Phase-II Summarization: In
this phase, we summarize the segments identified from the previous phase to
bring out representative sentences for each category and create templates
using an extractive summarization framework. Note that these segments belong
to a single community with policies containing very similar data practices (by
construction).

####  4.1.1 Phase-I: Finding Segments

We used the OPP-115 corpus [55] which has 3,792 annotated segments from 115
privacy policies. We consider annotations across 2 different categories of
data practices that aligns with our discussion in Section 3.2.2 :“First party
Collection/Use”(1U + 1C) and “Third party Disclosure” (3D) which are also
grounded from the laws of the countries we consider in this study, and have
significant data support in the OPP-115 dataset (around 40%). The rest are
marked as “Others”. We used the annotated segments from OPP-115 dataset to
train 5 different text classification models to identify the particular data
practice category discussed in the segment in an automated fashion. Out of
these five models, the best performing was TextCNN (See Table 12 in Appendix
C). Next for our dataset of policies, we first parse the policies using the
ASDUS tool [18] to create the segments and then classify them using TextCNN to
obtain category-specific practices.

####  4.1.2 Phase-II: Constructing Templates

To construct category-specific templates which comes from multiple segments,
we use an unsupervised multi-document extractive summarization technique (in-
line with [58]). First, we obtain cosine similarity for each segment pair with
segments encoded using a 300-dimension fasttext [11] model tuned on privacy
policy corpus [2]. Then, we construct a graph of these segments with edge
weight as cosine similarity and obtain importance score for each segment as
PageRank [41] weights obtained from the above graph. Lastly, we apply MMR
(Maximal Marginal Relevance) [12] using the importance scores and inter-
segment cosine similarities to identify a set of top-10 important yet diverse
segments. We call this set as template from a country for a category. We also
compare this approach to various multi-document summarization baselines in
Appendix C. Now we present the thematic analysis that we conduct on the
templates thus obtained, in a cross-country fashion.

###  4.2 Comparing USA, UK and India Templates

After capturing the representative data practices in Templates, we now explore
how the descriptiveness of such practices vary across countries. Specifically,
we conduct a thematic analysis on data practices and then unpack the thematic
differences across countries.

Category | Themes(Countries it occurs in)
---|---
First Party Collection, | Use of data collected (IN, USA, UK)
Use (1U + 1C) | Sources of information collected (IN, UK)
| Explicit attributes collected (IN)
| Defines SPI (IN)
| Methods of Information storage (UK)
| Transmission of information (UK)
| Defines PHI (USA)
| Regarding Authorization for Usage (USA)
Third Party Disclosure (3D) | Legal Disclosure (IN,UK,USA)
| Purpose of Disclosure (IN, UK, USA)
| Information Disclosed To (IN, UK, USA)
| Restrict Disclosure (USA)
| Limited Disclosure (USA)
| Third-Party Responsibilities (IN)

Table 6: Themes identified in the templates along with countries where the
theme is identified in parenthesis. (IN: India)

Theme | India | UK
---|---|---
Sources of information collected |  Collection of information through from you when you make payment … to complete optional online surveys |  Information from you … face to face, during a telephone call …via a form we have asked you to complete.
Use of Data Collected |  … use your Personal Information to contact you and deliver information to you … targeted to your interests, such as targeted banner advertisements |  Purpose is for your direct care and treatment this includes to ensure safe and high-quality care for all our patients. … for other purposes such as research.

Table 7: First Party Collection/Use (1U + 1C) Example Practices (India and UK)

Theme | India | UK
---|---|---
Legal Disclosure |  … disclose any information as is necessary to satisfy or comply with any applicable law, regulation, legal process or governmental request |  … due to a legal requirement disclosure under a court order, … to the Health and Safety Executive … to the police … to debt collecting agencies
Purpose of Disclosure |  … for reasons such as website hosting, data storage, software services, email services, marketing, fulfilling customer orders,providing payment services, data analytics |  … to obtain payment for services that we provide to you … may use and disclose medical information about you for research purposes
Information Disclosed To |  … may also disclose or transfer End-User’s personal and other information a User provides, to a third party as part of reorganization or a sale of the assets |  … with health and care organisations and other bodies engaged in disease surveillance, … to the Department of Health, with authorised non-NHS authorities and organisation

Table 8: Third Party Disclosure (3D) Example Practices (India and UK)

####  4.2.1 Thematic Analysis

We manually coded these templates using Open Coding [54] to bring out the data
collection, usage and disclosure-related themes covered in the templates for
each country. In our open coding two researchers first collaboratively created
a codebook to identify codes pertaining to the two key categories–First party
collection/use and Third party disclosure by going over the templates. Next
they independently coded the sentences from the template (cohen’s kappa 0.72,
substantial agreement). The codes finally met, resolved the differences in
codes and assigned final codes. The themes identified are shown in Table 6. We
note that the UK and USA have similar themes under the same category. From our
analysis of the countries’ templates we find 2 distinct groups coming
forth–India on one side and the UK and the USA on the other. We take the UK’s
template as representative of the latter group and compared India and the UK.

Comparing First Party Collection/Use. In India’s template we see explicit
mention of the information (SPI as mentioned in clauses of IT Rules, 2011
[35]) collected whereas UK’s and USA’s do not. India and USA explain
SPI/PHI(Sensitive Personal Information and Personal Health Information), but
the UK does not. UK’s template included practices of information storage and
transmission. The themes common to both India and the UK are sources of
information collected and the way information is used. Examples from the
templates for these themes are shown in Table 7. In the first row, the theme
identified is the ‘Sources of information collected’—UK’s template mentions
even the most specific sources of information, whereas India mentions
collection through broad payment gateways or surveys. In the second row, the
theme being discussed is ‘Use of data collected’. We discover that in India,
the major use of information is for communication, whereas the UK’s template
mentions treatment of the patient as the primary reason.

Comparing Third-Party Disclosure. The themes common to both India and the UK
are legal disclosure, purpose of disclosure of information to third parties,
and description of which third parties get the information. We discuss these
themes using Table 8 to highlight the differences between India and UK’s
templates. From the first row, under the theme ‘Legal Disclosure’, we see that
unlike India, in UK there are details of exactly which legal agency will be
given access to one’s data. In the second row the theme is ‘Purpose of
Disclosure’. India’s template focuses on the operational side of
storing/processing the data. On the other hand UK’s template focuses on
payment and research when it comes to reasons for disclosing data. The final
row, under the theme ‘Information Disclosed To’, illustrates that India’s
template stresses upon the complete transfer of data as a subset of ‘data
sharing’. UK’s template is much more explicit, naming the possible entities
for data sharing. The Indian template explicitly discuss the responsibilities
of third-parties for the data received from hospitals—possibly due to explicit
directive in Rule 7 of IT Rules, 2011 [35].

Uniqueness of template from USA. In the template for USA we see two notable
exceptions of ‘Restrict the Disclosure’ and ‘Regarding Authorization for
usage’. Since HIPAA [13] is a law primarily about the accountability on
account of data, it focuses especially on users’ rights. According to the
above two categories we see user’s choice of disallowing the sharing of data
is respected and permission is taken for some specific data sharing (e.g.
‘Written authorization is required prior to using or disclosing your PHI for
marketing activities’ ). Under third party disclosure we get the full list of
healthcare professionals with whom the user’s data may be shared (e.g.
‘doctors, nurses, technicians, students preparing for health care related
careers’). Under legal disclosure, we found a complete list of
claims/proceedings which might necessitate information disclosure (e.g.
‘accreditation purposes, patients and residents claims, grievances or
lawsuits, health care contracting relating to our operations’). Under ‘Limited
Disclosure’ the policies stated disclosing limited information of patients to
their care taker in case of an incapacitated (e.g. unconscious) patient.

Summary. Overall our analysis uncovered a strong correlation between country-
specific law and privacy policy structure. More detailed and thorough
legislation forces privacy policy makers to be at least as explicit as the law
demands. We found that in the case of USA and UK the data practices identified
discuss the permitted and authorized usage and disclosure practices as
prescribed in the respective laws. However, for Indian policies things were
more general because of absence of a clear, concise, descriptive law with the
practices often been linked more to the operation of website and general
communication and payment related discussion. This further ascertains our
findings in Sec. 3.2.2 where we saw very few Indian policies discussing the
practices specific to sensitive medical information of users.

##  5 Appropriateness and Compliance of Data Practices

In the final phase of our auditing workflow, we checked the legal compliance
of the healthcare organization’s data practices with country-specific laws.
Specifically, we (a) using Contextual Integrity theory(CI) [38] and Vagueness
theory [9] checked the appropriateness of the data practices [47], and (b)
checked legal compliance of these data practices using feedback from legal
experts.

###  5.1 Identifying Data Practices

We used the following 3-step approach to identify the data practices that we
further evaluated for appropriateness and legal compliance:

(i). We used the segmentation and classification approach (Sec. 4.1.1) to
obtain segments specific to First Party Collection/Usage(1U+1C) and Third
Party Disclosure (3D).

(ii). We ran the PageRank+MMR algorithm (Sec. 4.1.2) on these segments to
obtain a ranking where important yet diverse set of segments were present at
the top.

(iii). We then manually selected a list of non-redundant and important
segments from the output of PageRank+MMR and leverage these segments for
further analysis.

We finally analyzed 69 segments from USA, 37 from UK, and 55 from India to
investigate appropriateness and legal compliance of data practices with
applicable laws.

###  5.2 Appropriateness of Data Practices

We leveraged the theory of contextual integrity (CI) to identify how complete
the practices are in terms of the presence of CI-parameters. Recall that (Sec.
2), according to CI, a data practice is an information flow constituted of
five parameters related to the information: subject, attributed, sender,
recipient, transmission principle. Following the lines of prior work [47], we
check if our data practices are incomplete. A practice is incomplete if any of
the CI parameters is absent in the practice, leading to the following
categories of incompleteness: missing recipient, missing sender, missing
attribute, and missing transmission principle. We further examined the data
practices to check if the practices are vague (in line with the vagueness
taxonomy [9]). We categorize the practices with mention of keywords from one
or more combinations of vague terms thus classifying them into four
categories: Conditionality (C), Generalization (G), Modality (M), and Numeric
Quantifier (N). Descriptions of these categories are in Table 9. All the data
practices were annotated by two researchers following the guidelines described
in the respective studies (with a near-perfect inter-annotator agreement.) We
now discuss our key observations in terms of appropriateness.

Category |  Definition
---|---
Conditionality(C) |  the action to be performed is dependent upon a variable or unclear trigger
Generalization(G) |  the action or information types are vaguely abstracted with unclear conditions
Modality(M) |  the likelihood or possibility of the action is vague or ambiguous
Numerical(N) |  the action or information type has a vague quantifier
Table 9: Explaining category of Vagueness [9]

USA. In the case of USA, we find that 6 out of 69 data practices discussed
were incomplete. Out of these, 3 had missing recipients and 3 had missing
transmission principle. In terms of vagueness, we found that in USA “modality”
was the most dominant category (50 data practices) followed by “numeric” (2
data practices).

UK. In the case of UK, we find that 5 out of 37 data practices discussed were
incomplete, all of which had missing recipients. Just like USA, also in UK, in
terms of vagueness “modality” was the most dominant category (18 practices)
followed by “numeric” (3 practices).

India. We find that 5 out of 55 data practices in India were incomplete. Out
of these 2 had missing recipients and 3 had missing transmission principle In
fact data practices in India almost never clearly mention the information
being used or disclosed—they just mentioned ‘Personal Information’ without
clarifying what specific type of information is under consideration, unlike
USA where examples of PHI were explicitly mentioned. In terms of Vagueness,
the most dominant category was “modality” (23 practices), followed by
“numeric” (2 practices), and “generalization” (1 practice).

Implications. In all of the three countries for a few cases either
transmission principle or recipient is missing. We show examples of such
incomplete statements in Table 15 (Appendix D). In those cases, the users are
ill-informed about with whom the data is being shared or why it is being
shared (or collected). In terms of vagueness, the most dominant category is
“modality”—in the case of USA and UK that is mostly because of such practices
being directly copied from law which itself uses vague terms like ‘can’, ‘may’
etc. Our findings are in line with Kaur et al. [19] which presented a
comprehensive keywords based analysis of online general privacy policies in
Canada, USA, UK, and Germany. In the case of India, vagueness is observed
because of the construct of the practices. We note that, such vagueness
further denies a user the surety of knowing why exactly their information will
be used (or shared). When the vagueness is ‘numeric’ the user is also unsure
about how much and how often their data will be used (or shared). Alarmingly,
‘Generalization’, the most severe form of vagueness was encountered only in
India—the data practice vaguely described what party will have the right to
use and disclose user information (stating “Generally these contractors do not
have any independent right to share this information, however certain
contractors…will have rights to use and disclose the personal information…in
accordance with their own privacy policies”).

###  5.3 Legal Compliance of Data Practices

In the light of revealed incompleteness in some policies, we finally ask: are
some of the data practices legally non-compliant? For USA and UK, we leveraged
the clauses of the respective laws as they are quite well-defined and
healthcare-specific (HIPAA and DPA). We find that semantically the data
practices are very similar to law , whereas for India there were no specific
use-cases/clauses to evaluate against. So for India we took help from legal
experts (experienced in Indian IT law) to capture potential multiple
interpretations of the law.

####  5.3.1  Legal compliance of USA privacy policies.

PART 164, SUBPART-E of HIPAA [13] mentions several cases of usage and
disclosures: [164.502] Uses and disclosures of protected health information:
General rules, [164.504] Uses and disclosures: Organizational requirements,
[164.506] Uses and disclosures to carry out treatment, payment, or health care
operations, [164.508] Uses and disclosures for which an authorization is
required, [164.510] Uses and disclosures requiring an opportunity for the
individual to agree or to object, [164.512] Uses and disclosures for which an
authorization or opportunity to agree or object is not required. Using these
clauses we evaluated the compliance of the identified data practices (both
complete and incomplete), and found all the practices to be compliant within
the definitions of the clauses mentioned above.

####  5.3.2 Legal compliance of UK privacy policies.

Schedule 1, Part 1, Paragraphs 2, 3, and 4 of DPA 2018 [24] mention explicitly
the reasons for which data should be used/processed by a healthcare
organization. These paragraphs are to be read with Art. 6 (Lawfulness of
processing), Art. 9 (Processing of special categories of personal data) and
Art. 11(1) of GDPR. Using the clauses in the above parts of DPA 2018 and GDPR
we checked the compliance of the data practices. We found, like USA, all the
UK data practices to be fully compliant with the law.

Understanding the reason for legal compliance in USA and UK data practices. We
noted (Section 5.2) that in USA and UK some data practices are sometimes
directly copied from law. We surmised that this strategy of copying from law
is a key reason behind the compliance of privacy policies in USA and UK.
However, one can argue that simply copying a few keywords or even phrases from
law might not ensure compliance—data practices are often contextual and open
to interpretation. Such interpretation might require in-depth knowledge of the
underlying laws (like HIPAA, GDPR, and DPA). So to capture if the strategy of
copying from law in USA and UK preserves the meaning of the data practices
identified in law, we conduct a WMD-based (Word Mover Distance) analysis
between the data practices and the applicable legal clauses. WMD-based
similarity captures not only the syntactic similarity (at word-level), but
also semantic similarity (capturing context) [30]. Thus, we simply compute the
WMD between the data practices and applicable legal clauses/provisions (the
full results are in Appendix F). We found that the minimum WMD for the USA and
UK data practices are respectively 0.52 and 0.68—considerably lower than that
of Indian data practices (0.90), signifying higher similarity between law and
privacy policies for USA and UK. In fact, the WMD values for both USA and UK
are statistically significantly lower than India (using U-test) with very
large effect sizes: for India-USA, p_value<0.0001 (Cohen’s d: 2.07), and for
India-UK, p_value<0.0001 (Cohen’s d: 3.07). These results indicate that for
USA and UK, the data practices are copied from law with intact semantic
meaning, which is not the case for India. Hence for Indian policies, we use an
expert-in-the-loop strategy to evaluate the state of compliance of the
practices from Indian Hospitals.

####  5.3.3 Legal compliance of Indian data practices

Indian policies are governed by IT Rules, 2011 (more commonly known as SPDI
Rules, 2011 [35]). Rule 3 defines what attributes are classified as sensitive
personal data or information, Rule 4 mandates body corporate (Healthcare
Organization) to provide policy for privacy and disclosure of information,
Rule 5 pertains to the collection of information, Rule 6 deals with the
disclosure and Rule 7 deals with the transfer of information. Using this
background, we conducted a small survey with four experts (formally studied
and working with Indian IT law).

Survey set up: In the survey, our four experts were shown each of the data
practices and asked to annotate the legal compliance of the data practice in
line with IT Rules, 2011 [35]. They were also required to mention the rules
from these laws based on which they made their decision, along with the
rationale for their judgement. Apart from judging compliance, the annotators
were also asked to rate the vagueness in the practice and also identify the
cause of vagueness. In total, the survey took 10 hours (spread across a week)
and each of the experts were compensated INR 2000 (approx. $26.62). For
ethical reasons throughout the study, we did not collect any personally
identifiable information from the legal experts.

Inter rater agreement: After our pilot deployment with two experts, we found
the inter-annotator agreement (Krippendorff’s alpha) for the compliance for
data practices is very low (0.018). Upon further investigation using rationale
provided in survey, we identified three reasons for confusion: First, although
the IT Rule 5(2)(a) mentioned data collection should be for lawful purpose, it
did not differentiate between lawful and unlawful purposes. Second, there were
no explicit guidelines regarding non-Personally Identifiable information
(PII). Third, the experts sometimes implicitly assumed consent was taken from
the user while processing (or disclosing) the data. The reason is: privacy
policy follows the ‘Notice and Consent’ paradigm—a user agrees to all the
practices being notified in the policy. We discussed with the experts in the
pilot and resolved confusion by revisiting the interpretation of existing law
in the context of healthcare with them. After the second round of deployment
with the improved contextual understanding, the inter-annotator agreement was
0.78, with very small cases of disagreement, which the experts then discussed
and resolved within themselves. The experts also found the data practices and
the IT Rules, 2011 themselves to be far less descriptive than that of HIPAA.

Results: Our survey results indicated that out of 55 practices (derived from
48 policies), 12 practices (i.e., 21.8%) were found to be unaligned with the
IT Rules due to a total of six themes. Out of these 12, 10 practices were
vague in accordance with IT Rules [35]. The primary cause of non-alignment for
these 10 was in the construct of the data practice. We identified five themes
after analyzing experts’ responses: First, absolute discretion is given to
“third parties” to collect information (3 practices) (not in-line with Rule
6), Second, not mentioning what explicit SPI is being used or disclosed (3
practices) (not in-line with Rule 4, 5 and 6), Third, not clearly disclosing
purpose for which information was collected (or disclosed) (3 practices) (not
in line with Rule 4, 5 and 6), Fourth, unclear description of third-parties to
which information is disclosed (2 practices) (not in line with Rule 6 and 7),
and Fifth, upon updating policy, consent was not taken again (1 practice) (not
in line with Rule 5). Remaining two practices were not vague but unaligned
with the law under the sixth theme: absence of explicit consent and/or lawful
purpose for which information was collected (not in line with Rule 5).

Validation using senior legal counsel: Finally we took additional counsel from
a senior legal professional with a survey to validate our findings. The legal
professional has more than 10 years of experience in healthcare privacy (self-
reported, independently verified by us) and is conversant in Indian IT laws as
well as HIPAA and GDPR. The senior professional completely agreed with the
findings (both compliance and non-compliance) with high inter-annotator
agreement. The senior professional also pointed out case verdicts from Indian
courts that ruled the non-alignments observed in the policies as potential
violations of Rule 4 (AADHAR case [49], TDB case [21]), and Rule 5 (WhatsApp
Policy case [14]) of the IT Rules, 2011. Using the court verdicts, we surmised
the following four non-alignments observed (from 48 policies) above as
potential violation: not mentioning what explicit SPI is being used or
disclosed (found in 10 policies), not clearly disclosing the purpose for which
information was collected (or disclosed) (found in 7 policies), upon updating
policy, consent was not taken again (found in 5 policies), and absence of
explicit consent and/or lawful purpose for which information was collected
(found in 1 policy). We present samples of data practices from each of these
categories in Table 16 (Appendix E). In fact, they mentioned—‘The
implementation of the SPDI Rules is woeful in some parts of the healthcare
sector. Often, when we read policies of some hospitals, we do not see the
mention of a Grievance Officer, Option of withdrawal, how data retention is
done.’

Impact of PDP Bill, 2022 in India. Apart from IT Rules, 2011 which governs the
current state of handling users’ data, India is also seeing an upcoming data
protection framework: The Digital Personal Data Protection Act, 2022 (PDP
Bill, 2022) [36]. However this framework is not enacted as a law yet. Thus, we
simply discuss the data practices which would be in-line with the provisions
of PDP Bill, 2022. This new data protection framework aims at affirming a
Notice-and-Consent Paradigm. In Chapter 2 Section 5, the Bill quotes that
processing can only be done for a lawful purpose. In Chapter 2 Section 6, the
Bill discusses various clauses to ensure that the Data Fiduciary (Hospitals)
provides a clear, clean notice describing the type of personal data to be
collected and the purpose for processing such information. In Chapter 2
Section 7, the Bill discusses the need for consent from Data Principal and
also highlights the right to withdraw consent without any obstruction in the
services to be provided. In Chapter 2 Section 8, Bill discusses the notion of
deemed consent, in which it lists cases where the Data Principal is deemed to
have given consent. In Chapter 2 Section 9, the Bill discusses the obligations
on Data Fiduciary to store/collect/process the sensitive data. It also
includes a clause to appoint a Data Protection Officer like the IT Rules,
2011. Additionally in Chapter 3, it clearly discusses the rights of the Data
Principal in a manner similar to GDPR. In comparison to the current framework
of IT Rules 2011, this new data protection framework does reduce some
vagueness. However, the data practices identified in this work in violation
with IT Rules 2011, also remain in violation with the PDP Bill, 2022. Thus our
findings remain valid even in the context of the proposed PDP Bill, 2022 in
India.

####  5.3.4 Implications for better compliance

Interestingly, practices in USA and UK are in some sense copied from the
relevant parts of the law itself, ensuring compliance. On the contrary,
privacy policy creators in India rely on more general IT Rules, 2011 which our
experts found to be less concise and descriptive than HIPAA. In India, we
observed that non-alignment (and vagueness) often came from improper drafting
of sentences in policies and resulted in potential violations with the law.
However, in absence of a mixed-method auditing workflow as proposed in this
work, it is difficult for policy makers to identify potential violations and
potentially explain the law in a uniform and concise manner. Similarly,
without such a mixed-method workflow, it might be difficult for even hospitals
(that might have misinterpreted the law in absence of concise use cases) to
find and fix these violating data practices at scale and handle the data of
their patients more responsibly.

##  6 Limitations

We identify two limitations of our study. First, the number of unique privacy
policies is comparatively low when compared to the total number of hospitals
in a country. However, we have tried our best and used established methods of
identifying and analyzing privacy policies. Support from a government or
regulators will possibly improve our dataset. However, even with our best-
effort analysis, we identified interesting findings including legal non-
compliance. Second, our segmentation-summarization based approach might miss
certain important data practices(or segments) which could not be identified
correctly either in the segmentation or summarization phase. Thus, we only
identified relatively clearly mentioned data practices. In spite of the
limitation, our audit uncovered problems even with these relatively clearly
mentioned data practices, underlining the value of our research.

##  7 Conclusion and Future Work

The significance of our work lies in building up a novel workflow to audit the
privacy policies of the healthcare organizations of a country or a region. The
application of this workflow to the three countries brings out interesting
insights—although we find that all the three countries have some
incompleteness in data practices, we find that the policies in India are much
less specific than the other two countries. We conclude (after consultation
with legal experts) that a primary reason behind this is the absence of
concise use cases and descriptive rules in the Information Technology Rules,
2011 [35] for regulating health data practices. Overall, during audit we found
unclear statements, vague (and non-compliant) data practices in Indian
healthcare organizations. However, there are subtle but significant
differences even between UK and USA privacy policies—in USA there is much more
stress on users’ consent for usage and disclosure but less stress on the mode
of data collection and retention; these may have arisen due to differences in
the law of the two countries. We strongly believe upon presenting this useful
mixed-method auditing workflow, a natural key future avenue of exploration is
to provide concrete data-driven suggestions to the healthcare organization to
create better privacy policies as well as help regulators in removing
ambiguity from existing legal policies. To that end, the present work would
act as a solid foundation.

## References

  * [1] Wasi Ahmad, Jianfeng Chi, Yuan Tian, and Kai-Wei Chang.  PolicyQA: A reading comprehension dataset for privacy policies.  In EMNLP Findings, pages 743–749, 2020.  https://aclanthology.org/2020.findings-emnlp.66.
  * [2] Ryan Amos, Gunes Acar, Elena Lucherini, Mihir Kshirsagar, Arvind Narayanan, and Jonathan Mayer.  Privacy policies over time: Curation and analysis of a million-document dataset.  In Proceedings of the Web Conference 2021, pages 2165–2176, 2021\.
  * [3] A.I. Anton, J.B. Earp, and A. Reese.  Analyzing website privacy requirements using a privacy goal taxonomy.  In IEEE RE, pages 23–31, 2002.  https://ieeexplore.ieee.org/document/1048502.
  * [4] Noah Apthorpe, Yan Shvartzshnaider, Arunesh Mathur, Dillon Reisman, and Nick Feamster.  Discovering smart home internet of things privacy norms using contextual integrity.  ACM IMWUT, pages 1–23, 2018.  https://dl.acm.org/doi/10.1145/3214262.
  * [5] Noah Apthorpe, Sarah Varghese, and Nick Feamster.  Evaluating the Contextual Integrity of Privacy Regulation: Parents’ IoT Toy Privacy Norms Versus COPPA.  In Usenix Security, pages 123–140, 2019.  https://www.usenix.org/conference/usenixsecurity19/presentation/apthorpe.
  * [6] Vinayshekhar Bannihatti Kumar, Roger Iyengar, Namita Nisal, Yuanyuan Feng, Hana Habib, Peter Story, Sushain Cherivirala, Margaret Hagan, Lorrie Cranor, Shomir Wilson, et al.  Finding a choice in a haystack: automatic extraction of opt-out statements from privacy policy text.  In ACM WWW’20, pages 1943–1954, 2020.  https://doi.org/10.1145/3366423.3380262.
  * [7] Adrien Barbaresi.  Trafilatura: A Web Scraping Library and Command-Line Tool for Text Discovery and Extraction.  In ACL-IJCNLP, pages 122–131, 2021.  https://aclanthology.org/2021.acl-demo.15.
  * [8] Nastaran Bateni, Jasmin Kaur, Rozita Dara, and Fei Song.  Content analysis of privacy policies before and after gdpr.  In 2022 19th Annual International Conference on Privacy, Security & Trust (PST), pages 1–9, 2022.
  * [9] Jaspreet Bhatia, Travis D Breaux, Joel R Reidenberg, and Thomas B Norton.  A theory of vagueness and privacy risk perception.  In IEEE (RE) Conference, pages 26–35, 2016.  https://ieeexplore.ieee.org/document/7765508.
  * [10] Vincent D Blondel, Jean-Loup Guillaume, Renaud Lambiotte, and Etienne Lefebvre.  Fast unfolding of communities in large networks.  Journal of Statistical Mechanics: Theory and Experiment, 2008(10):P10008, 2008.  http://dx.doi.org/10.1088/1742-5468/2008/10/P10008.
  * [11] Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov.  Enriching word vectors with subword information.  arXiv preprint arXiv:1607.04606, 2016.
  * [12] Jaime Carbonell and Jade Goldstein.  The use of MMR, diversity-based reranking for reordering documents and producing summaries.  In ACM SIGIR, pages 335–336, 1998.  https://doi.org/10.1145/290941.291025.
  * [13] Center for Disease Control and Prevention.  Health Insurance Portability and Accountability Act of 1996 (HIPAA).  https://www.cdc.gov/phlp/publications/topic/hipaa.html, 1996.
  * [14] Competition Commission of India.  Updated Terms Of Service And … vs Whatsapp Llc.  https://indiankanoon.org/doc/99533020/, 2022.
  * [15] Yang Gao, Wei Zhao, and Steffen Eger.  SUPERT: Towards new frontiers in unsupervised evaluation metrics for multi-document summarization.  In ACL, pages 1347–1354, 2020.  https://aclanthology.org/2020.acl-main.124.
  * [16] Joaquim Gonçalves, Brígida Mónica Faria, Luís Paulo Reis, Victor Carvalho, and Álvaro Rocha.  Data mining and electronic devices applied to quality of life related to health data.  In CISTI, pages 1–4, 2015.  https://ieeexplore.ieee.org/document/7170627.
  * [17] Abhijith Athreya Mysore Gopinath, Vinayshekhar Bannihatti Kumar, Shomir Wilson, and Norman Sadeh.  Automatic Section Title Generation to Improve the Readability of Privacy Policies.  In USENIX SOUPS, 2020.  https://www.usenix.org/conference/soups2020/presentation/gopinath.
  * [18] Abhijith Athreya Mysore Gopinath, Shomir Wilson, and Norman Sadeh.  Supervised and unsupervised methods for robust separation of section titles and prose text in web documents.  In EMNLP, pages 850–855, 2018.  https://aclanthology.org/D18-1099/.
  * [19] Jasmin Kaur, Rozita A. Dara, Charlie Obimbo, Fei Song, and Karen Menard.  A comprehensive keyword analysis of online privacy policies.  Information Security Journal: A Global Perspective, 27(5-6):260–275, 2018.
  * [20] Erin Kenneally and David Dittrich.  The menlo report: Ethical principles guiding information and communication technology research.  Available at SSRN 2445102, 2012.  https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2445102.
  * [21] Kerala High Court.  Kerela High Court: Suo Motu vs Travancore Devaswom Board - TBD.  https://indiankanoon.org/doc/142754318/, 2022.
  * [22] Moniba Keymanesh, Micha Elsner, and Srinivasan Parthasarathy.  Toward Domain-Guided Controllable Summarization of Privacy Policies.  In NLLP, pages 18–24, 2020.  http://ceur-ws.org/Vol-2645/#paper3.
  * [23] Matt Kusner, Yu Sun, Nicholas Kolkin, and Kilian Weinberger.  From word embeddings to document distances.  In ICML, pages 957–966, 2015.  https://proceedings.mlr.press/v37/kusnerb15.html.
  * [24] UK Legislation.  Data Protection Act of 2018 (DPA18).  https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted, 2018\.
  * [25] Jure Leskovec, Kevin J Lang, and Michael Mahoney.  Empirical comparison of algorithms for network community detection.  In WWW, pages 631–640, 2010.  https://dl.acm.org/doi/10.1145/1772690.1772755.
  * [26] Song Liao, Christin Wilson, Long Cheng, Hongxin Hu, and Huixing Deng.  Measuring the effectiveness of privacy policies for voice assistant applications.  In ACM ACSAC, page 856–869, 2020.  https://doi.org/10.1145/3427228.3427250.
  * [27] Timothy Libert.  An automated approach to auditing disclosure of third-party data collection in website privacy policies.  In WWW, pages 207–216, 2018.  https://doi.org/10.1145/3178876.3186087.
  * [28] Fei Liu, Rohan Ramanath, Norman Sadeh, and Noah A Smith.  A step towards usable privacy policy: Automatic alignment of privacy statements.  In ACL-COLING, pages 884–894, 2014.  https://aclanthology.org/C14-1084/.
  * [29] Annie Louis and Ani Nenkova.  Automatically assessing machine summary content without a gold standard.  Computational Linguistics, 39(2):267–300, 2013.  https://aclanthology.org/J13-2002/.
  * [30] Yinglong Ma, Peng Zhang, and Jiangang Ma.  An ontology driven knowledge block summarization approach for chinese judgment document classification.  IEEE Access, 6:71327–71338, 2018.
  * [31] Aaron Massey, Jacob Eisenstein, Annie Antón, and Peter Swire.  Automated text mining for requirements analysis of policy documents.  In IEEE RE 2013, pages 4–13, 2013.  https://ieeexplore.ieee.org/document/6636700.
  * [32] Medindia.  Directory for Indian Hospitals.  https://www.medindia.net/patients/hospital_search/hospital_list.asp, 2001\.
  * [33] Gabriele Meiselwitz.  Readability assessment of policies and procedures of social networking sites.  In OCSC, pages 67–75, 2013.  https://link.springer.com/chapter/10.1007/978-3-642-39371-6_8.
  * [34] Mohsen Minaei, Mainack Mondal, and Aniket Kate.  "My Friend Wanted to Talk About It and I Didn’t": Understanding Perceptions of Deletion Privacy in Social Platforms.  CoRR, 2020.  https://arxiv.org/abs/2008.11317.
  * [35] Ministry of communications & Information technology.  Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, 2011.  https://www.meity.gov.in/writereaddata/files/GSR313E_10511(1)_0.pdf.
  * [36] Government of India Ministry of Electronics & Information Technology \̇lx@bibnewblockThe digital personal data protection bill, 2022, 2018.
  * [37] Ministry of Health and Family Welfare.  Digital lnformation Security in Healthcare, act (DISHA), 2018.  https://www.nhp.gov.in/NHPfiles/R_4179_1521627488625_0.pdf.
  * [38] Helen Nissenbaum.  Privacy as contextual integrity.  Wash. L. Rev., 79:119, 2004.  https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10/.
  * [39] Nv7-Github.  GoogleSearch.  https://github.com/Nv7-GitHub/googlesearch, 2020.
  * [40] Alessandro Oltramari, Dhivya Piraviperumal, Florian Schaub, Shomir Wilson, Sushain Cherivirala, Thomas B Norton, N Cameron Russell, Peter Story, Joel Reidenberg, and Norman Sadeh.  PrivOnto: A semantic framework for the analysis of privacy policies.  Semantic Web, 9(2), 2018.  https://dl.acm.org/doi/abs/10.3233/SW-170283.
  * [41] Lawrence Page, Sergey Brin, Rajeev Motwani, and Terry Winograd.  The pagerank citation ranking: Bringing order to the web.  Technical report, Stanford InfoLab, 1999.  http://ilpubs.stanford.edu:8090/422/.
  * [42] European Parliament and Council of the European Union.  GDPR.  https://eur-lex.europa.eu/eli/reg/2016/679/oj, 2016.
  * [43] Abhilasha Ravichander, Alan W Black, Thomas Norton, Shomir Wilson, and Norman Sadeh.  Breaking Down Walls of Text: How Can NLP Benefit Consumer Privacy?  In ACL-IJCNLP, pages 4125–4140, 2021.  https://aclanthology.org/2021.acl-long.319.
  * [44] Abhilasha Ravichander, Alan W Black, Shomir Wilson, Thomas Norton, and Norman Sadeh.  Question answering for privacy policies: Combining computational and legal perspectives.  In EMNLP-IJCNLP, pages 4947–4958, 2019.  https://aclanthology.org/D19-1500.
  * [45] Kanthashree Mysore Sathyendra, Abhilasha Ravichander, Peter Garth Story, Alan W Black, and Norman Sadeh.  Helping users understand privacy notices with automated query answering functionality: An exploratory study.  Technical report, Technical report, Carnegie Mellon University, 2017.  https://usableprivacy.org/static/files/CMU-ISR-17-114R.pdf.
  * [46] Kanthashree Mysore Sathyendra, Shomir Wilson, Florian Schaub, Sebastian Zimmeck, and Norman Sadeh.  Identifying the Provision of Choices in Privacy Policy Text.  In ACL-EMNLP, pages 2774–2779, 2017.  https://aclanthology.org/D17-1294/.
  * [47] Yan Shvartzshnaider, Noah Apthorpe, Nick Feamster, and Helen Nissenbaum.  Going against the (appropriate) flow: a contextual integrity approach to privacy policy analysis.  In HCOMP, pages 162–170, 2019.  https://ojs.aaai.org/index.php/HCOMP/article/view/5266.
  * [48] Mukund Srinath, Shomir Wilson, and C Lee Giles.  Privacy at scale: Introducing the PrivaSeer corpus of web privacy policies.  In ACL-ICNLP, pages 6829–6839, 2021.  https://aclanthology.org/2021.acl-long.532.
  * [49] Supreme Court of India.  Justice K.S.Puttaswamy(retd) vs Union of India.  https://indiankanoon.org/doc/127517806/, 2022.
  * [50] Mohammad Hossein Tekieh and Bijan Raahemi.  Importance of Data Mining in Healthcare: A Survey.  In ASONAM, pages 1057–1062, 2015.  https://ieeexplore.ieee.org/document/7403678.
  * [51] The Centers for Medicare & Medicaid Services.  Hospital General Information.  https://data.cms.gov/provider-data/dataset/xubh-q36u, 2022.
  * [52] Noriko Tomuro, Steven Lytinen, and Kurt Hornsburg.  Automatic Summarization of Privacy Policies using Ensemble Learning.  In CODASPY, pages 133–135, 2016.  https://dl.acm.org/doi/10.1145/2857705.2857741.
  * [53] NHS UK.  Authorities and Trusts.  https://www.nhs.uk/servicedirectories/pages/nhstrustlisting.aspx, 2018.
  * [54] Maike Vollstedt and Sebastian Rezat.  An Introduction to Grounded Theory with a Special Focus on Axial Coding and the Coding Paradigm, pages 81–100.  Springer International Publishing, 2019.  https://doi.org/10.1007/978-3-030-15636-7_4.
  * [55] Shomir Wilson, Florian Schaub, Aswarth Abhilash Dara, Frederick Liu, Sushain Cherivirala, Pedro Giovanni Leon, Mads Schaarup Andersen, Sebastian Zimmeck, Kanthashree Mysore Sathyendra, N Cameron Russell, et al.  The creation and analysis of a website privacy policy corpus.  In ACL 2016, pages 1330–1340, 2016.  https://aclanthology.org/P16-1126/.
  * [56] Baohong Xue and Ting Liu.  Physical Health Data Mining of College Students Based on DRF Algorithm.  Wireless Personal Communications, 102(4), 2018.  https://link.springer.com/article/10.1007/s11277-018-5410-5.
  * [57] Razieh Nokhbeh Zaeem, Rachel L German, and K Suzanne Barber.  Privacycheck: Automatic summarization of privacy policies using data mining.  ACM TOIT, 18(4):1–18, 2018.
  * [58] Jinming Zhao, Ming Liu, Longxiang Gao, Yuan Jin, Lan Du, He Zhao, He Zhang, and Gholamreza Haffari.  Summpip: Unsupervised multi-document summarization with sentence graph compression.  In Proceedings of the 43rd international acm sigir conference on research and development in information retrieval, pages 1949–1952, 2020.
  * [59] Sebastian Zimmeck, Peter Story, Daniel Smullen, Abhilasha Ravichander, Ziqi Wang, Joel Reidenberg, N Cameron Russell, and Norman Sadeh.  MAPS: Scaling privacy compliance analysis to a million apps.  PETS, 2019(3):66–86, 2019.  https://usableprivacy.org/static/files/popets-2019-maps.pdf.
  * [60] Sebastian Zimmeck, Ziqi Wang, Lieyong Zou, Roger Iyengar, Bin Liu, Florian Schaub, Shomir Wilson, Norman Sadeh, Steven Bellovin, and Joel Reidenberg.  Automated analysis of privacy requirements for mobile apps.  In 2016 AAAI Fall Symposium Series, 2016.  https://www.aaai.org/ocs/index.php/FSS/FSS16/paper/viewPaper/14113.

## Appendix

##  Appendix A Data Disclosure Practices

Two most frequent data practices observed for India, UK, and USA is shown in
Table 11.

##  Appendix B Community Metric Distribution

Here we show the plots for each of the country reporting the metrics across
thresholds. For India the plots are in Figure 2. For the UK in Figure 3, for
USA in Figure 4.

India: In Figure 2, we observe that at value 0.58 for India, we have 58%
coverage. After 0.58 the Cut Ratio, Conductance and Modularity just
stabilizes. So we choose this point as our threshold for obtaining
communities.

UK: In Figure 3, we observe two peaks in modularity one at 0.45 and other at
0.70. A similar trend is observed for conductance and cut ratio, where local
minimas occur at these two points. At 0.70, we see that coverage is at 20%,
which is very less as compared to coverage at 0.45 (>80%). Hence we pick this
as threshold, since we don’t want to make conclusions based on a very small
fraction of policies.

USA: In Figure 4, just like the case with UK, we observe peaks in modularity
one at 0.38. But for rest of the metrics we see peek at 0.44. Hence we pick it
as the threshold as there is not a huge drop in modularity with very less
conductance and cut ration.

##  Appendix C Analysis of Templates

Here we show our results discussing best performing classification model
OPP-115 dataset in Table 12. Other than the summarization approach discused in
Sec. 4.1.2 [PageRank+MMR], we use 2 baseline summarization methods: two well-
known strategies [29] namely Random-N, Avg Probability. To evaluate the
summaries, we used the standard metrics employed for unsupervised multi-
document summarization framework [29]: JS-Divergence, Cosine Similarity, and
Word Mover Distance. Additionally, we also used SUPERT [15] which aims to
compute the semantic similarity between a summary and a pseudo-summary
generated by [15]. A higher SUPERT value means a good summary. The template
evaluation scores are in Table 13. A full discussion of themes along with
sample statements is shown in Table 14.

##  Appendix D Incomplete Data Practices

We discuss the cases of incomplete complete data practices observed in USA,
UK, and India along with the reasoning in Table 15.

##  Appendix E Examples of Data Practices

Here we show a data practice from each of the category of potential violation
we discussed in Section 5.3.3 in Table 16.

##  Appendix F WMD analysis for checking alignment of data practices and law
across countries

Country |  WMD (Min/Median/Max)
---|---
USA | 0.5185/0.8621/1.0274
UK | 0.6789/0.8523/0.9085
India | 0.8986/1.0368/1.1856
Table 10: WMD Analysis for countries: USA, UK and India. We computed the WMD
on the data practices with the applicable provisions from the governing laws.

We computed WMD between data practices from privacy policies and applicable
legal regulations and report minimum/median/maximum WMD across data practices
in a country. Our WMD analysis is shown in Table 10. Note that for data
practices in India, the WMD is high, signifying that the privacy policiy data
practices might not be copied from the law.

India |  UK |  USA
---|---|---
We will not disclose or sell any of your personal information, including your name, address, age, sex or medical history to any third party without your permission. |  Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak |  Except as set forth above, you will be notified when PII may be shared with third parties, and will be able to prevent the sharing of this information.
We do not sell, trade, or rent Users personal identification information to others |  … share personal/confidential patient information … in disease surveillance for the purposes of protecting public health, … and managing the outbreak |  … disclose personal information … when required by law … Cooperate with the investigations of purported unlawful activities and conform … - Protect and defend the rights … - Identify persons … misusing our Website or its related properties.
Table 11: Two most frequent data disclosure practices as observed for each
country.

Figure 2: Community Metric Plots: Modularity, Cut Ratio, Conductance and
Coverage for India

Figure 3: Community Metric Plots: Modularity, Cut Ratio, Conductance and
Coverage for UK

Figure 4: Community Metric Plots: Modularity, Cut Ratio, Conductance and
Coverage for USA

Model Name | Macro | Accuracy
---|---|---
| P | R | F1 |
FastText | .41 | .41 | .41 | .66
TextCNN | .72 | .67 | .68 | .75
RCNN | .46 | .46 | .46 | .71
TextBiRNN | .58 | .55 | .56 | .68
RCNNVariant | .68 | .61 | .62 | .74
TextRNN | .51 | .50 | .50 | .62
Table 12: Macro and Accuracy Scores as obtained from sklearn’s
classification_report tool

Methods | Metrics Used
---|---
|  JS |  Cos Sim |  SUPERT | WMD
USA Third Party
Random-N |  0.69 |  0.61 |  0.47 |  2.25
Avg Probability |  0.67 |  0.56 |  0.49 |  2.19
PageRank+MMR |  0.67 |  0.56 |  0.54 |  2.18
USA First Party
Random-N |  0.68 |  0.58 |  0.49 |  2.21
Avg Probability |  0.66 |  0.61 |  0.50 |  2.13
PageRank+MMR |  0.66 |  0.56 |  0.52 |  2.18
UK Third Party
Random-N |  0.76 |  0.66 |  0.47 |  2.39
Avg Probability |  0.69 |  0.57 |  0.46 |  2.45
PageRank+MMR |  0.68 |  0.63 |  0.50 |  2.43
UK First Party
Random-N |  0.76 |  0.62 |  0.36 |  2.39
Avg Probability |  0.77 |  0.56 |  0.37 |  2.45
PageRank+MMR |  0.73 |  0.59 |  0.44 |  2.38
India Third Party
Random-N |  0.67 |  0.70 |  0.45 |  2.58
Avg Probability |  0.79 |  0.57 |  0.51 |  2.56
PageRank+MMR |  0.67 |  0.74 |  0.45 |  2.48
India First Party
Random-N |  0.59 |  0.72 |  0.52 |  2.45
Avg Probability |  0.79 |  0.55 |  0.47 |  2.45
PageRank+MMR |  0.57 |  0.76 |  0.54 |  2.41

Table 13: Metrics reported across each category for summarization methods

Category |  Themes |  Sample Sentences
---|---|---
India
First Party Collection/Use |  Explicit attributes collected |  information collected … a. Contact data … your mobile number, email address and phone number b. Demographic data … your gender, nationality, date of birth, postal address and pin code
|  Explains what is SPI |  Personal information … mean any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person
|  Source of information collection |  We collect personally identifiable information (Email Id., Name, Contact number, etc.) from you when you make payment … to complete optional online surveys. … ask you for contact information and demographic information (like zip code, age, or income level)
|  Use of data collected |  … use your Personal Information to contact you and deliver information to you … targeted to your interests, such as targeted banner advertisements
Third Party Disclosure |  Explicit use of information collected |  To send or facilitate communications to you, send you communications we think will be of interest to you, including information about products
|  Legal Disclosure |  disclose any information as is necessary to satisfy or comply with any applicable law, regulation, legal process or governmental request
|  Specific law regulations |  Regulation 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011
|  Purpose of Disclosure |  … for reasons such as website hosting, data storage, software services, email services, marketing, fulfilling customer orders, providing payment services, data analytics, providing customer services, and conducting surveys
|  Information Disclosed To |  … may also disclose or transfer End-User’s personal and other information a User provides, to a third party as part of reorganization or a sale of the assets
|  Responsibilities of Third Parties |  will place contractual obligations on the transferee which will oblige the transferee to adhere to the provisions of this Privacy Policy
UK
First Party Collection/Use |  Sources of Information collection |  … from you and this is likely to be done either face to face, during a telephone call, or via email. Your information … a referral from your GP or other healthcare organisation, or … via a form we have asked you to complete.
|  Purpose of information collection |  … for your direct care and treatment this includes to ensure safe and high-quality care for all our patients. … for other purposes such as research.
|  Methods of information storage |  The information may be written down on paper, held on a computer, or a mixture of both
|  Transmission of Information |  … may be transferred from this Trust to other NHS Trusts to support the safe, efficient and effective transfer of staff information
Third Party Disclosure |  Legal Disclosure |  … we are under a duty to share your information, due to a legal requirement disclosure under a court order, … to the Health and Safety Executive … to the police … to debt collecting agencies
|  Purpose of disclosure |  … to pay a supplier, our legal basis is that its use is necessary for the purposes of our legitimate interests as a buyer of goods and services
|  Information Disclosed To |  with health and care organisations and other bodies engaged in disease surveillance, … to the Department of Health, with authorised non-NHS authorities and organisations
USA
First Party Collection/Use |  Explicit use of information |  to conduct our standard internal operations, including proper administration of records, evaluation of the quality of Treatment,payment purposes of those health professionals and facilities
|  Defines PHI |  PHI) is information that you provide us or that we create or receive about your health care. PHI includes a patient’s name, age, race, sex, … patient’s physical or mental health in the past, present, or future, and to the care, treatment, services and payment for care needed by a patient because of his or her health.
|  Regarding Authorization for usage |  Written authorization is required prior to using or disclosing your PHI for marketing activities that are supported by payments from third parties
Third Party Disclosure |  Purpose for disclosure |  We may use and disclose your health information to obtain payment for services that we provide to you … may use and disclose medical information about you for research purposes We may disclose medical information about you to another health care provider or covered entity … under certain circumstances
|  Information Disclosed To |  … to doctors, nurses, technicians, students preparing for health care related careers, or other personnel who are involved in your care or treatment, including your primary care physician. … for an insurance company to pay for your treatment, we must submit a bill that identifies you, your diagnosis, and the treatment provided to you
|  Legal Disclosure |  … used or disclosed to comply with laws and regulations, accreditation purposes, patients and residents claims, grievances or lawsuits, health care contracting relating to our operations, legal services, … business management and administration, underwriting and other insurance activities.
|  Restrict Disclosure |  You may ask for restrictions on how your health information is used or to whom your health information is disclosed: … While we will consider all requests for restrictions, we are not required to agree to your request
|  Limited Disclosure |  If you are unavailable, incapacitated, or . . . we determine that a limited disclosure may be in your best interest, we may share limited personal health information with such individuals without your approval
Table 14: Thematic Analysis of Templates

Case |  Example |  Explanation
---|---|---
USA
Missing Transmission Principle |  We and our Affiliates and Service Providers may collect personal information about you on the Website and from other sources, including commercially available sources. |  The purpose for which such information is used is not discussed
Missing Recipient |  If you are present and able to agree or object then we may only disclose your PHI if you don’t object after you have been informed of your opportunity to do so (although such agreement may be reasonably inferred from the circumstances). |  To whom the information will be disclosed is not mentioned
UK
Missing Recipient |  Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. |  Clear description of the party recieving the information is absent
India
Missing Transmission Principle |  We may collect any and all personal information you provide to us, like your name, mobile phone number, email address . . . feedback, and any other information you provide us. |  The purpose for which information is collected is not mentioned in the text
Missing Recipients |  You acknowledge that some countries where we may transfer Your Personal Information may not have data protection laws …. SIMS will place contractual obligations on the transferee which will oblige the transferee to adhere to the provisions of this Privacy Policy. |  A clear description of entities to whom the information is disclosed is absent in the statement.
Table 15: Incomplete Information Flows examples Category of Potential Violation |  Sample Data Practice |  Explanation
---|---|---
Not mentioning what explicit SPI is being used or disclosed |  When you use our Website, we collect and store your Personal Information which is provided by you from time to time. Our primary goal in doing so is to provide you a safe, efficient, smooth and customized experience. This allows us to provide Services and Features that most likely meet your needs, and to customize our Website to make your experience safer and easier. |  It violates Rule 4(1)(ii) because of not clearly mentioning the type of personal data that is been collected.
Not clearly disclosing the purpose for which information was collected (or disclosed) |  Institution will be free to use, collect and disclose information that is freely available in the public domain without your consent. |  There is a need to comply with Rule 5(3)(a) and (b) i.e. tell that information will be collected/used and further the purpose of use.
Upon updating policy, consent not taken again |  By choosing the Opt-In option on the Website and after that, by providing us your personal information or availing services of hospital or by making use of the facilities provided by the Website, it is agreed by you that you have freely consented to the collection, storage, processing, disclosure and transfer of Your personal information following the provisions of this Privacy Policy and any amendments thereof. |  For each and every amendment in policy, there is a fresh requirement to comply with IT Rules 2011, and importantly Rule 5 as a whole.
Absence of explicit consent and/or lawful purpose for which information was collected |  We may collect any and all personal information you provide to us, like your name, mobile phone number, email address, delivery address, order, invoicing details, materials or data you may sync through other applications (e.g. photos, contact lists), information in relation to creating an account, phone numbers you insert into your contacts or to send a message, feedback, and any other information you provide us. |  It does not complies with Rule 5 generally. Specifically with Rule 5(1) as no explicit consent is taken, and Rule 5(2) as it does not specify any lawful purpose.
Table 16: Sample Statements from each category of potential violations as
discussed in Section 5.3.3.