An Integrated Approach to GDPR-compliant Data Sharing Employing Consent, Contracts, and Licenses

@article{TAUQEER2025102510,
title = {An Integrated Approach to GDPR-compliant Data Sharing Employing Consent, Contracts, and Licenses},
journal = {Data & Knowledge Engineering},
pages = {102510},
year = {2025},
issn = {0169-023X},
url = {https://www.sciencedirect.com/science/article/pii/S0169023X25001053},
author = {Amar Tauqeer and Tek Raj Chhetri and Anna Fensel and Robert David and Albin Ahmeti},
keywords = {Data sharing, Digital contracts, GDPR compliance, Ontology, Knowledge graphs, SHACL, SHACL repairs, License, Digital signatures},
abstract = {GDPR defines six legal bases, at least one of which needs to be followed in order to process (or share) personally identifiable data in a lawful manner. Most of the research today is centered around the legal bases of consent and contracts. This limits the options for legal bases that one can select (or use) for data sharing, especially in circumstances where there is a need to use mul-tiple legal bases. For example, one can consent to share data but may want to place restrictions on how it can be used, which requires a license (an extension/add-on to data sharing contracts) in scenarios, where digital assets licensing is involved. Overcoming these limitations and en-abling data sharing via multiple legal bases require combining multiple legal bases. However, incorporating additional (or multiple) legal bases, such as licenses (as an add-on to contracts), in a GDPR-compliant manner remains a challenging task. This is because combining multiple legal bases requires an understanding of each individual legal basis—a task challenging in it-self—and designing a system in a manner that is both compliant with regulatory requirements and practically pertinent. Therefore, in this paper, we present our semantic-based approach and tool that enables GDPR-compliant data sharing via multiple legal bases, consent, and contracts (using licenses as an add-on). This work extends our previous work, GDPR Contract Com-pliance Verification (CCV) tool, which enables GDPR-compliant data sharing via consent and contracts only. We add licenses as a further add-on to contracts, make our previous work more semantically compliant by utilizing SHACL validation for compliance checking, secure the con-tract signing process with digital signatures, introduce SHACL repairs to automatically fix data inconsistencies, and evaluate the performance of the tool and the SHACL components. We demonstrate the effectiveness of SHACL and the enhancement of the tool with GDPR-complaint data sharing based on multiple legal bases by performance testing.},

doi = {https://doi.org/10.1016/j.datak.2025.102510}
}