IBM builds XML-based privacy language

IBM has developed a new XML-based language which will allow organisations automatically to enforce privacy policies across their IT systems.

Big Blue plans to submit the Enterprise Privacy Authorisation Language (Epal) draft to a standards body in the next few months, and will add Epal support to its Tivoli enterprise privacy management software.

Epal allows developers to express natural language policy statements in a format understandable to applications and privacy management tools.

One such tool for privacy specifications - the Worldwide Web Consortium's Platform for Privacy Preferences (P3P) released in April 2002 - communicates a privacy policy from business to consumer applications.

But IBM stressed that Epal goes further, allowing companies to enforce P3P policies in back-end systems, applications and databases. It also provides visible evidence that privacy policies have been implemented in practice.

"With Epal and other privacy innovations, developers can enhance consumer trust and better demonstrate how their organisations' privacy obligations are being kept," said Arvind Krishna, vice president of security products for IBM Tivoli Software.

Epal was developed jointly by IBM Research and IBM Software Group. The draft specification can be found here.

To help developers make use of Epal to author and edit privacy policies, a team of students at North Carolina State University has developed the Privacy Authoring Editor.

The Editor was developed as an open source software project enabling others to contribute as the Epal specification evolves. It is available here.