LAST-JD; CIRSFID Dusan Pavlovic
email: serpavlovic@gmail.com

Identification of online gamblers in the EU: a two-edged sword

Keywords: European Union, identification, online gambling, problem gambling

Online gambling in Europe is a challenge for all stakeholdersservice providers, gamblers, regulators and academic researchers. Despite a lack of harmonization of national gambling-specific legislations and consequent legal uncertainty, online gambling is the most progressive online service in the European Union (EU). Service providers are supposed to promote and implement strategies and measures that ensure an acceptable level of gamblers' protection and prevention of problem gambling. At the same time, the online environment offers numerous novel opportunities for business development. Data is the central online business focus and, for that reason, it can be used for multifold purposes. This paper discusses how data collected for identifying online gamblers could include additional functions, both negative and positive, from the gamblers' protection perspective. Thus, the paper answers the research question: What are the tensions in gamblers' protection that derive from the identification of online gamblers in the EU?

Introduction

Online gambling is a rapidly growing service in the EU. This relatively new form of entertainment has been taken up on a massive scale by European gamblers. However, the current EU regulatory landscape in the gambling domain does not appear to favor business development, nor to facilitate optimal gamblers' protection.

The growing popularity of online gambling experiences

Online gambling in Europe is a lucrative reality with a peculiar nature [START_REF] Planzer | Empirical views on European gambling law and addiction[END_REF]. Statistical data show that this branch of industry is the fastest growing service activity in Europe. Around 6.8 million online players in Europe generate significant economic outcomes. 1 Many reasons account for online gambling's progress and general popularity, including the greater acceptance of this new form of gambling among both traditional and new gamblers. The growing popularity of online gambling among European consumers is a consequence of easier and more convenient access to gambling than is the case with traditional, offline gambling [20, p. 1396]. Gamblers have the opportunity to gamble 24/7 without leaving their house or wherever they are. Among the desirable features of this shift are the possibilities to gamble for those who cannot access brickand-mortar gambling premises, and the accessibility of gambling instructions, manuals and other useful information. In addition, a variety of gambling options, better payout rates, higher odds and a better reward system as consequences of a cheaper online business model all favor online gambling [20, p. 1389]. A combination of these factors creates positive attitudes among consumers regarding online gambling, and subsequently influences industrial progress and potential [20, p. 1397].

The EU and online gambling

The history of online gambling starts in 1994, when the small Caribbean country of Antigua and Barbuda adopted the Free Trade and Processing Zone Act. The main point of the act was liberal licensing, including the licensing necessary for gambling operations on the Internet. This new situation attracted business opportunity seekers from all over the world. The first online casino, Interactive Casino Inc., was established in August 1995 [START_REF] Manzin | Online Gambling: Today's Possibilities and Tomorrow's Opportunities[END_REF]. In the first decade of operation, the online gambling industry was primarily focused on the American (US) market. However, the US authorities were concerned about the regulation of the industry abroad as well as the risk of money laundering. Therefore, in 2006 the US authorities announced the Unlawful Internet Gambling Enforcement Act (UIGEA), as a measure that prevents the use of illegally-gained proceeds for terrorism financing, and banned the realization of financial transactions derived from gambling via the Internet. Taking into consideration that gambling in Europe has been very popular and well developed for a long time (for more information see [START_REF] Schwartz | Roll the bones: the history of gambling[END_REF]Ch. 1]), the online gambling industry shifted its focus to Europe.

Today, Europe is the most developed online gambling market worldwide [START_REF]EGBA Facts and Figures[END_REF]. The EU regulatory institutions are supposed to play an important role in regulating gambling activities; however, EU Member States draw upon different cultural, social, religious and political elements regarding gambling in order to justify regulation on the national level [START_REF]European Parliament Portal: The Principle of Subsidiarity[END_REF]. As a consequence, online gambling is controlled, organized and regulated exclusively by the Member States as a service with distinctive attributes separate from harmonized services. This approach is officially justified by the protection of national policies (e.g. on public health and youth). Several rulings by the Court of Justice of the European Union (CJEU) represent the cornerstones for regulating gambling at the national level. The CJEU case law can be viewed as providing a carte blanche for the Member States to regulate gambling in accordance with national policies, going so far as to justify a state monopoly or gambling bans as measures to regulate (online) gambling [25, p. 2]. Consequently the current state of the art in the domain of gambling in the EU can be described as legislatively fragmented (28 Member States with 28 different gambling legislations), diverging from the principle of the freedom to provide services in the EU. Thus, all 28 Member States require online gambling providers to ensure that their operations comply with national, regional or local legislations, as otherwise service providers are considered to be illegal.

Nevertheless, the Internet is a global network where national borders and national legislations are not crucial limiting factors for data transmission. Therefore, insisting on the enforcement of current online gambling legislation is almost meaningless. Despite national governments' activities toward the suppression of illegal gambling activities in their jurisdictions, in the case of online gambling, so-called "gray" [14, Ref 3] and illegal online markets are well-developed due to the co-existence of different Member States regulatory models and various problems related to their enforcement [START_REF]Green Paper on on-Line Gambling in the Internal Market[END_REF]. Illegal online gambling service providers in the EU can be classified as follows:

 Service providers that are not licensed and formally established in any jurisdiction.2  Service providers that are licensed outside the EU, but whose services are accessible in the EU's Member States.  Service providers licensed in one or more EU Member States, but whose services are also provided in Member States in which they are not licensed.

The European Commission (EC) and the European Parliament have undertaken an initiative to harmonize gambling and online gambling regulations. The European Parliament adopted two resolutions related to online gambling matters [15; 16]. In addition, the European Commission strengthened public discussion on online gambling in the EU with a Green Paper on on-Line Gambling in the Internal Market [START_REF]Green Paper on on-Line Gambling in the Internal Market[END_REF]. Despite extensive political and public discussions, overall efforts toward harmonizing gambling regulations have so far only resulted in legally non-binding documents. The latest outcome is the EU Commission's "Recommendation on the Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online" (EC Recommendation) [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]. The EC Recommendation promotes principles that serve to protect online gamblers and encourages Member States to adopt these principles.

Contribution of this paper

Gambling-specific legislation is mainly concerned with protecting gamblers from various kinds of risks in order to prevent problem gambling. There are several groups of measures in gambling-specific legislations, including the identification of gamblers. The identification of gamblers is a legal requirement imposed by all EU Member States' gambling legislations. Despite non-harmonized regulations in the field of gambling at the EU level, the purposes of players' identification are not dissimilar in different national legislations. The EC Recommendation proposes the registration process of players with the aim to verify players' identity and track players' behavior [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Recital 18]. However, there is a lack of empirical knowledge regarding the additional purposes for which providers process gamblers' personal data that are initially collected for players' identification and tracking. This paper focuses on online gamblers' identification in the EU, and discusses its function as a two-edged sword. The paper addresses the following research question: What are the tensions in gamblers' protection that derive from the identification of online gamblers in the EU? In order to answer this question, three tasks have been undertaken. Firstly, the paper briefly explains the main concerns regarding online gambling and presents the EC Recommendation, particularly the part that recommends rules for the identification of players. Secondly, the paper sheds light on service providers' self-regulation regarding the identification of online gamblers, through a comparative analysis of 11 privacy policies announced by selected online gambling service providers. Thirdly and finally, the paper explains the advantages and disadvantages of gamblers' personal data processing in the context of identification of online gambling and reveals that it is a "two-edged sword". This two-edged sword refers to how personal data processing used for identification purposes can have two completely opposite effectsprevention of problem gambling on the one hand, and causing problem gambling on the other. For the purpose of the analysis, the paper pays special attention to behavioral tracking tools as the instruments for the prevention of problem gambling and to commercial communication as an important provocation of problem gambling.

3

Gambling-related concerns and the EC Recommendation

The importance and functions of gamblers' protection

In general, the greatest concerns regarding gambling are the prevention of problem gambling. Notwithstanding the lack of a widely accepted concept of "problem gambling" [11, pp. 20-21], this term refers to a broad spectrum of negative consequences of gambling. Problem gambling may refer to a health disorder, economic problems, various individual harms, to classification of certain groups of gamblers, or to broad social problems [27, p. 5]. Clear boundaries between these categories do not exist, but they are identifiable. It could be said that problem gambling as a health disorder is a foundation for all other forms of problem gambling. The prevention of problem gambling as a health disorder is the main focal point in the protection of gamblers from other gambling-associated risks. Thus, maintaining public order is tightly knit with the prevention of problem gambling. In favor of this claim is the fact that gamblers with a health disorder are more prone to commit crimes than people without this kind of problem [30, pp. 47-52].

A general approach toward the regulation of gambling in Europe follows principles of restrictivism [10, p. 597]. In other words, gambling is not prohibited, but is rather considered to be a service that deserves a special regulatory approach necessary to mitigate gambling-related harms. In line with this approach, the EC Recommendation encourages EU Member States "to achieve a high level of protection for consumers, players and minors through the adoption of principles for online gambling services and for responsible commercial communication of those services in order to safeguard health and also to minimize a possible economic harm that may result from compulsive or excessive gambling" [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 1]. Despite Member States' strong opposition to the harmonization of national gambling-related legislations, the EC Recommendation could be considered as an outline of the very principles for online gambling that already exist in Member States' national gambling legislations. 3 As can be seen, the goal of the national gambling-related legislations is not only to protect human health, but also to minimize the negative effects that problem gambling has on the economy. The legislator sets up a hypothesis that the effective protection of online gamblers, besides preventing individual harm, has a broad societal importance that is reflected in economic impacts.

The EC Recommendation is formally designed "to improve the protection of consumers, players and to prevent minors from gambling online" [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Recital 2]. This document intends to ensure that gambling remains a source of entertainment and to provide a safe gambling environment. The purpose of the proposed measures is to "counter the risk of financial or social harm as well as to set out action needed to prevent minors from gambling online" [13, Recital 2]. Key measures toward improved gamblers' protection proposed by the EC Recommendation can be grouped into the following eight categories:  Information requirements.  Protection of minors.  Player account and registration.  Player funds and activity.  Time-out and self-exclusion.  Advertising.  Sponsorship.  Education and supervision.

The EC Recommendation and identification of gamblers

A substantial part of the EC Recommendation that is supposed to enhance online gamblers' protection relates to gamblers' personal data processing. Section V of the EC Recommendation sets up norms related to the registration of gamblers and the creation of their gambling accounts. Any person who intends to gamble online has to register and open an account. Therefore, online gambling service providers request several types of personal data for registration purposes. The EC Recommendation, which is in line with Member States' national legislations, suggests that the following information has to be revealed for the purpose of player registration and gambling account creation: the player's name, address, date of birth, electronic mail address or mobile telephone number. In addition, a unique username and password have to be created [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Ch. 5]. The email address and telephone number should be validated by the player or verified by the operator [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 17]. In cases where direct electronic verification is not possible, "Member States are encouraged to facilitate access to national registers, databases or other official documents against which operators should verify identity details" [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 18]. For that reason, Member States are encouraged to adopt an electronic identification system for the registration purposes [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 20].

The full registration of a gambler's account is composed of two sets of actions. Gamblers have to provide the requested data and their identity has to be verified afterwards. Considering that the verification of the identity details provided takes some time, service providers should ensure that players have access through temporary accounts [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 22(a)]. Verification should be done in a reasonable period of time and for that purpose "the registration system allows alternative means to verify identification" [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 21(b)]. In the case when the identity or age of the person cannot be verified, the registration process should be cancelled. Cancelation includes the suspension of temporary accounts [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 19]. In practice, this solution allows gambling subsequent to the creation of an account, but before the completion of a registration process. Thus, gamblers may gamble even if their personal data are not verified. However, if they cannot verify their personal data their accounts will be suspended and the situation provokes certain consequences (e.g. the retention of funds without the possibility of withdrawal). The consequences depend on the particular gambling service provider and its related policy.

According to the EC Recommendation, players' activities have to be monitored. Operators have to be able to inform players and alert them about their winnings and losses and about the duration of play. This sort of information has to be sent on a regular basis [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 26]. Moreover, operators' policies and procedures should facilitate players' interaction whenever a player's gambling behavior indicates a risk of developing a gambling disorder [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 30]. Players whose behavior indicates problem gambling should be supported and offered professional assistance [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 25].

Players themselves can initiate the limitation of their own gambling activities using self-exclusion mechanisms. The self-exclusion mechanism is a voluntary tool that should be at the gamblers' disposal so as to restrict their access to gambling services for a certain period of time. According to the EC Recommendation, any player who excludes himself or herself should not be allowed to gamble for at least for six months from the moment of self-exclusion. In addition, commercial communication should not target players who have excluded themselves from gambling or who have been excluded from receiving online gambling services due to problem gambling [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 43]. The EC Recommendation encourages Member States to establish a national registry of self-excluded players [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 37]. Member States should facilitate the access of operators to the national registries of self-excluded players and ensure that operators regularly consult registries in order to prevent self-excluded players from continuing to gamble [START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]Art. 38].

Identification and personal data processing: business practice

This part of the paper highlights service providers' self-regulation regarding the identification of online gamblers. For the purpose of the analysis, 11 online gambling service providers' privacy policies have been examined. The selection of online gambling service providers operating in Europe was based on their presence in the most developed marketthe United Kingdom (UK)and on their size (large and small providers). Relevant data were taken from the Data Report created by Gambling Compliance [START_REF]Gambling Compliance: European Regulated Online Markets[END_REF], a global provider of independent business intelligence to the gambling industry. The five largest online sports betting providers' policies were examined (Betfair, Bet 365, William Hill, Paddy Power, and Ladbrokes), who together have a UK market share of about 75%. The privacy policies of an additional six operators (Betfred, Stan James, Coral, BetClick, Betwin and Bet at Home) were also assessed, who have from 2.5% to less than a 1% presence on the UK online sports betting market. In total, the market presence of the listed companies was around 84% in UK online sports betting. The privacy policies of these providers have been examined to identify which data they process for gambler identification and for which (other) purposes they allow these data to be used. The first step in gambling online is a registration process that a gambler must complete on a chosen service provider's web page. In order to conduct this procedure, a new gambler has to open an account, accept several policies (terms and conditions), verify his/her identity and provide the personal data requested by a service provider. By registering with any of the service providers analyzed here, a gambler accepts its privacy policy and provides consent for further personal data processing. According to Betfair's regulations, registering as well as logging onto its website is considered to indicate an explicit consent to processing and disclosing personal information [START_REF]Betfair, Privacy and Data Protection policy[END_REF].

Other policies consider the first registration to be a sufficient condition for any further personal data processing. A common feature of all policies is that personal data processing is a necessary condition for the registration process.

Considering the scope of the collected data and the purpose of data processing, the policies mainly regulate these issues in a similar manner. Paddy Power collects information about players during the account registration process and during service provision. This information may include, but is not limited to, name, postal address, e-mail address, phone number, credit/debit card details and "any other details" [START_REF]Paddy Power Privacy and Cookie Policy[END_REF]Art. 4.1]. Similarly, Bet 365 enumerates how and which data could be collected by describing the purposes of the collected data. It emphasizes that data could be used for different purposes, including but not limited to bet processing, account management, complying of legal duties, research and analyses, promotional or monitoring purposes [START_REF]Bet365 Privacy Policy[END_REF]. In the case of Bet at Home, "collection or processing of customer data is a necessary condition for the conclusion of contract and is solely for this purpose" [4, Art. 2]. Ladbrokes explicitly lists reasons why personal data are collected [START_REF]Ladrokes Privacy policy[END_REF]. Bwin collects gamblers' personal data to deliver the service, to provide customer support, undertake security and identify verification checks, process online transactions, assist participation in third-party promotions, meet certain business requirements, and for any other purpose related to the operation of the service [8]. Betfair processes personal data to allow access and use of the website and participation in the services offered, to administer accounts, to maintain accounts and records, to monitor website usage levels and the quality of the service provided, and to share information about products and services it considers interesting for gamblers [START_REF]Betfair, Privacy and Data Protection policy[END_REF].

Taking into consideration the important role of gambling advertisement in provoking gambling problems (see next section), particular attention was paid in this research to the parts of policies that regulate the use of personal data for commercial communication purposes. All privacy policies allow service providers to send gambling advertisements to players. Players provide consent for various purposes including service providers' right to send gambling-related advertisements. However, in the case of Betfair, if a player does not wish to receive future marketing, promotional or sales material, he/she may notify the company to stop sending further material [START_REF]Betfair, Privacy and Data Protection policy[END_REF]. In that sense, players can "qualify, vary, modify or limit consent in relation to marketing communications or in circumstances where any processing of personal data is likely to cause damage or distress or such other circumstances as the law allows (...)" [START_REF]Betfair, Privacy and Data Protection policy[END_REF]. Bet 365's privacy policy prescribes that the information collected about players can be used for "providing information about promotional offers, products and services, where players have consented" [START_REF]Bet365 Privacy Policy[END_REF]. Ladbrokes' policy allows this service provider to provide information about promotional offers to its customers [START_REF]Ladrokes Privacy policy[END_REF]. However, if players do not wish to receive this kind of information they have to opt out of this option in the account registration form. William Hill's privacy policy prescribes that this company is allowed to use players' personal data for "preparing and displaying appropriate individualized marketing material and content" [START_REF] Hill | [END_REF]Art. 3.2.6]. As in the case of Ladbrokes, William Hill's customers can opt out from being informed about gambling events, promotions and offers [32, Art. 2.6]. Also, Paddy Power uses players' data to send appropriate marketing material and content via "SMS, email, phone, post or otherwise" [28, Art. 6.2]. Coral uses personal information, such as the email address and telephone number, to send promotional material to players if they agree on that [9, Art. 4.6]. Thus, all privacy policies regulate commercial communication between service providers and their customers in a largely similar manner. Service providers are allowed to use collected data for marketing activities in order to share information regarding offers, promotions and events. However, the majority of policies also include a possibility for players to change their consent given in the part of the website related to advertisements or to later adjust their own preferences related to commercial communication.

All privacy policies contain rules regarding the flow of gamblers' data. Despite slight differences among policies related to this issue, a common feature in all the policies examined is that gamblers' data can be transferred to third parties. Very large parts of the policies are devoted to the use of cookies. By registering online and consenting to all the rules in the privacy policies, gamblers accept the use of cookies for different purposes. From the observed privacy policies, it can be concluded that the purpose of cookies is not only to improve the performance of webpage functioning and the facilitation of users' identification, but also for advertising and analytical purposes.

Prevention and provocation of problem gamblingthe context of behavioral tracking tools and commercial communication

Gambling-related regulations in the EU Member States govern the monitoring of gamblers' activities for the sake of finding indications of problematic gambling. Gambling service providers should warn gamblers about their gambling behavior where this is supposed to be risky. Apart from gamblers' protection measures imposed by gambling-specific legislation, it is up to online gambling service providers to decide whether to use additional protective measures as well as on the kind of measures for gamblers' protection from gambling-associated risks.

In recent years, the online gambling industry introduced behavioral tracking tools that alert gamblers to their problematic gambling behavior while they are playing (these are called "in-play" notifications) or after gambling. New intelligent real-time systems combine gamblers' personal data and their gambling behavior in order to recognize patterns of problematic gambling. Sophisticated technological tools can calculate gambling trends from the processed data and thus generate personalized feedback. 4 Despite the fact that the use of the above-described technology is still nonmandatory, initial scientific findings have demonstrated that the use of this kind of technology is beneficial for the prevention of problem gambling [1; 2; 19].

The concept of problem gambling as a health disorder is a challenge not only for practical prevention, but also in the scientific domain. Despite various opinions and findings, scientific studies support claims that problem gambling as a health disorder (i.e., addiction) can be observed in many contexts [START_REF] Griffiths | Conceptualizing Addiction: The Case for the Complex System Account[END_REF]. Earlier, Blaszczyncki and Nower tried to outline common features of gambling addiction in their "pathway model of gambling addiction" [START_REF] Blaszczynski | A pathways model of problem and pathological gambling[END_REF]. They agreed on environmental factors as important stimulants of a gambling addiction. The notion of "environmental factors" refers to activities and components that increase the availability and accessibility of a rewarding activity. Advertising, for example, is considered to be an important environmental factor.

Advertising is an inseparable part of today's business development. However, measuring the impact of advertising is very complex. Different types of advertising strategies, target groups of consumers, market features, as well as different advertising effects lead to a variety of methodological problems for assessing advertising effects. Although there is a relative paucity of scientific research about the influence of advertising on problem gambling, so far studies have shown causal relations between the advertising of gambling-related content and problem gambling. Gambling advertising does not have the same impact on everyone within the overall gambling population. However, certain groups of gamblers who are affected by gambling advertising are triggered to gamble above a constant level [START_REF] Binde | Exploring the Impact of Gambling Advertising: An Interview Study of Problem Gamblers[END_REF]. Derevensky et al. found that gambling advertising has a particularly strong influence on adolescents. Among this group of consumers, advertising is suitable to attract new gamblers as well as to maintain already created gambling behavior [START_REF] Derevensky | An Empirical Study Examining the Impact of Gambling Advertisements on Adolescent Gambling Attitudes and Behaviors[END_REF]. Hing et al. conducted a study about the contribution of advertising to the increased consumption of online gambling [START_REF] Hing | Do advertising and promotions for online gambling increase gambling consumption? An exploratory study[END_REF]. The authors' findings confirm that "the role of advertising and promotions of online gambling in attracting new users" is limited [23, p. 404]. However, advertising and promotions of online gambling increase gambling among the current population of gamblers, especially among online gamblers and particularly among gamblers who have been treated for addiction. Gambling-related advertisements tempt gamblers who try to leave or to limit the scope of gambling [23, p. 405]. In addition, the largest population of the researched sample agreed that promotion and advertising cause longer time spent on gambling [23, p. 404].

Discussion

The preceding findings reveal a number of problems regarding gambling-related regulation in the EU. In addition, certain relations between the encouragement of problem gambling and gamblers' data processing have been indicated. This section of the paper analyses these issues and discusses the presented findings. Firstly, observations on the protection of online gamblers in the EU are made. Secondly, some controversies regarding online gamblers' data processing are discussed. Finally, attempting a balance between business needs and problem gambling is addressed.

Protection of online gamblers in the EU

The development of online gambling imposed a need for higher consumer protection and better prevention of problematic gambling, especially in Europe. Gambling legislation in Europe is fragmented and is limited by national borders. Mandatory gambling legislations in the EU Member States tally with broad societal interests of gamblers' protection. However, the enforcement of the law with conventional standards that should be applied in the online context is not ideal. Considering non-harmonized regulations at the EU level as well as the lack of enforceable regulations in the domain of online gambling, service providers' activities can be easily operate beyond the legal zone into the "gray" or illegal zone.

It is a widely held view that risk is a part and parcel of gambling. Personal health, personal wealth, personal relations, health policy, youth policy, public policy, economy and public finances could be disrupted by undesirable harms deriving from gambling. Taking into consideration the progressive growth of the online gambling industry, it can be assumed that gambling-related problems will continue to occur more frequently. Thus, the EC Recommendation for the stronger protection of online gamblers is quite a desirable document. The proposed regulation regarding the identification of gamblers would tend to decrease the possibilities for vulnerable groups of people (e.g. under-aged and problem gamblers) to gamble. However, the enforcement of the EC Recommendation regarding the identification of players occurs at the expense of personal data protection. The EC Recommendation involves the processing of a large volume of gamblers data both by service providers and states. However, pro-privacy oriented policy makers and researchers argue that such extensive personal data processing jeopardizes the privacy of data subjects. Despite these claims, which are not incorrect in themselves, processing online gamblers' data is an essential means that can also be used for their own protection. Thus, it can be reasonably concluded that one of the main challenges regarding gamblers' protection will be to reach a proper balance between the protection of gamblers' privacy on the one hand and the prevention of gambling-related problems on the other.

Treatment of online gamblers' personal data

From the previous findings, it can be concluded that the online gambling industry processes a broad range of gamblers' data. Privacy policies usually do not limit service providers' opportunities to request different personal data. They enumerate different purposes (including the identification of players), but they always leave room for collecting data that may serve additional purposes. In addition, policies assert a long period of data retention (in case of Labrokes, a data retention period lasts seven years) or do not even mention how long they retain data (e.g. Paddy Power).

All privacy policies impose commercial communications. The gambling registration system relies on a "take it or leave it" approach. In other words, gamblers have to accept policies, including an obligation to receive promotional material about further games. Practically speaking, advertising is an "option" that is included in the same gambling package. This default option could be turned off through self-exclusion from certain lists by consumers not wishing to receive certain promotional materials. Nevertheless, it is questionable how effective the opportunities are to stop receiving gambling-related advertisements. On the one hand, privacy policies contain rules that allow gamblers to change their consent related to receiving promotional material, offers and information about events. On the other hand, these rules are explained in one or two sentences that are usually integrated in very exhaustive lists of rules that compose the privacy policies. Moreover, responsible gambling policies that explain the use of responsible gambling tools are usually presented separately from privacy policies and they do not contain manuals on how to stop or limit gambling advertisements.

Intertwined aspects of the gambling business thus create possibilities that identification data can be used for other purposes. Different activities overlap throughout the process of online gambling (e.g. transfer of funds cannot be initiated without player identification; commercial communication cannot be realized without player registration). Therefore, it is difficult to clearly delineate the purpose of processing particular data. In any case, it is without doubt that online gambling service providers can process huge amounts of gamblers' data. Online gambling service providers have to process a large volume of gamblers' personal data in order to comply with mandatory legal requirements, but they can use that data processing also for commercial reasons.

Finally, collecting and processing personal data for various reasons without the explicit delineation of the scope of the collected data and the purpose of data processing are not unusual in the online environment. Service providers, including those in the ecommerce sector, often do not limit themselves in terms of their possibilities for data collection and data processing. However, it has to be recalled that gambling is not an ordinary service. It is a service that deserves special regulatory treatment aimed toward, inter alia, the prevention of problem gambling.

Balance between business and problem gambling concerns

With the wide variety of purposes for which gamblers' personal data processing occurs, data could be used for advertising as well as for the indication of risky ways of gambling and the prevention of problem gambling. Advertising gambling content and related commercial communication are not prohibited. The EC Recommendation proposes the organization of commercial communication so as to be socially responsible [13, recital 12]. Although it is beyond this paper's scope to discuss relevant academic studies on social responsibility in the marketing and advertising industries, it could be argued that personal data is the most valuable source of online commercial communication. The online environment is a quite desirable playground for sophisticated advertising strategies and personalized commercial communications. The consensus view from the domain of gambling studies seems to be that advertising influences the consumption of gambling [START_REF] Binde | Exploring the Impact of Gambling Advertising: An Interview Study of Problem Gamblers[END_REF][START_REF] Derevensky | An Empirical Study Examining the Impact of Gambling Advertisements on Adolescent Gambling Attitudes and Behaviors[END_REF][START_REF] Hing | Do advertising and promotions for online gambling increase gambling consumption? An exploratory study[END_REF]. In addition, the increased consumption of gambling leads toward risky gambling and health disorders. In contrast, behavioral tracking techniques could detect problem gambling and prevent further harm. Gamblers' personal data serves to support both online gambling commercial commu-nication and behavioral tracking tools. In this context, personal data processing turns out to be a means for decreased as well as increased levels of gamblers' protection.

Therefore, it is in the scope and modes of gamblers' personal data processing that business, public interests and private interests will have to be balanced. However, the use of behavioral tracking tools for gamblers' protection purposes is not mandatory. It seems that the business sector has the discretion to decide whether and to what extent these different interests should be balanced. Thus, it appears that this industrial sector holds a two-edged sword in its hands: an expression that refers to a very sharp tool that can be used precisely to separate wrong from right. But can we leave it up to the industry to decide for themselves how to wield this sword? The online gambling business industry has its own interests that are legitimate from a business perspective. Its interests do not, however, fully coincide with more general public interests. From the above-mentioned examples of concerns, it can be concluded that the business sector may use gambling advertisements as tools that could injure gamblers by opening them up to the serious consequences provoked by a health disorder. Therefore, advertising as a powerful encouragement of problem gambling deserves further attention both from both regulators and researchers.

Conclusion

Gamblers' personal data processing for identification purposes can be used for various goals. Data processing can be practiced for both gambling purposes that are beneficial for the protection of gamblers and as a business model that is not necessarily in favor of gamblers' protection. Data processing is used for commercial communication purposes which is just one, but a very important, factor that may increase the impetus for additional gambling and may provoke problematic gambling. In contrast, gamblers' personal data could also be analyzed for signs of risky gambling, such as an increased amount of time or money spent, and any loss chasing or increased tolerance of losses. However, it appears that the gambling industry favors a particular approach in regard of its own interests, which is not surprising given the lack of harmonized mandatory legislation stipulating measures to prevent problem gambling. As a consequence, gambler protection can be easily put in danger.

From the gamblers' protection perspective, it would be beneficial to have an obligation imposed by Member States' gambling legislations that includes limitations to or the exclusion of gambling advertisement in relevant gambling policies. Easier exclusion (i.e., an opt-out) from receiving gambling related advertisements would probably decrease the risks of new problem gambling. If Member States develop national registers of self-excluded gamblers in accordance with the EC Recommendation, it can be conceivably believed that gamblers' protection will be strengthened. The EC Recommendation prescribes that self-exclusion from gambling should include an optout from gambling-related commercial communication (which is not currently a regular business practice). Furthermore, the development of national registers of selfexcluded players and the use of electronic identification systems could also be proconsumer-oriented. Despite potential polemics that could be provoked by developing centralized systems for collecting large amounts of gamblers' personal data (especially from the part of pro-privacy-oriented researchers and policy makers responsible for high levels of personal data protection), it is likely that the use of such an electronic identification system could shorten the period between gamblers' identification and verification. In such a case, the possibilities for manipulating temporary accounts and gambling by minors would be decreased.

Service providers have at their disposal tools that can influence gamblers' protection. Working on the prevention of problem gambling does not necessarily decrease business opportunities. Gamblers' personal data processing can contribute to the prevention or mitigation of gambling-related harms: these are beneficial not only for gamblers, but also for society at large. In doing so, online gambling service providers can improve their own reputation. As a result of this, they can present themselves as being corporate socially responsible companies, a feature which could be particularly appreciated by the public sector and certain groups of consumers, and which can make the industry more sustainable in the long run.

Finally, scientific research should be used to avoid assumption-based solutions and regulations. To date, there has been little evidence provided about the status or use of online gamblers' personal data processing. There is a lack of knowledge how data are processed by service providers, regulatory bodies or third parties. As in many other online services, data processing provides the foundation for the functioning of the online gambling market. Notwithstanding the variety of opinions and findings, there is now a consensus view that a causal relation exists between the provision of gambling opportunities and problem gambling. In addition, it is likely that the ways in which gamblers' personal data are processed for different purposes influence how online gambling is provided and consumed, and thus also affectsfor better or for worseproblem gamblers. Therefore, for the sake of preventing and mitigating problem gambling, further in-depth research is needed to better understand the practices of online gamblers' personal data processing and how these influence gamblers' behavior. Such empirical knowledge can help to assess the ethical and legal dimensions of online gambling business practices, and thus help regulators to take measures that ensure that providers wield the two-edged sword of gamblers' data processing in a balanced way.

Table 1 .

 1 -Service providers' presence on the UK online sport betting market in 2012

	Service provider	Market share
	Betfair	22.0 %
	Bet 365	19.0 %
	William Hill	15.0 %
	Paddy Power	12.0 %
	Ladbrokes	7.5 %
	Betfred	2.5 %
	Stan James	2.0 %
	Coral	2.5 %
	BetClick	<1 %
	Betwin	<1 %
	Bet at Home	<1 %
	Overall	Approx. 84 %

In 2011 more than 85% of the gambling sites in Europe were operating without any license[START_REF]Recommendation of 14 July 2014 on Principles for the Protection of Consumers and Players of Online Gambling Services and for the Prevention of Minors from Gambling Online[END_REF]

Harrie Temmink, Deputy Head of the Online and Postal unit at DG Internal Market and Services, European Commission, in his speech given at 10th European Conference on Gambling Studies and Policy Issues (Helsinki, Finland; September 2014) stressed the fact that EU Recommendations are a non-legally binding source that outline common principles for online gambling from all Member States' gambling legislations.

Some of the examples used by the online gambling industry are software Playscan (http://playscan.com/, accessed on 24 February 2016), and Mentor (developed by Neccton Itd, see http://www.neccton.com/en/about-mentor-en.html, accessed on 24 February 2016).


Michela D'errico
email: michela.derrico@hpe.com

Siani Pearson
email: siani.pearson@hpe.com

Michela D ' Errico

Enhanced Assurance About Cloud Service Provision Promises

Keywords: assurance, evidence, policy enforcement, Privacy Level Agreement, privacy policy

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cloud Service Providers (CSPs) can disclose the level of data privacy and protection offered in a Privacy Level Agreement (PLA) [START_REF]CSA Privacy Level Agreement[END_REF], which is a Cloud Security Alliance (CSA) standard intended to be used by potential customers to assess data protection related offerings. In this work we envisage the modelling and representation of key information required to be provided in a PLA for different data protection related aspects.

An important source of requirements for CSPs is data protection legislation, which imposes obligations that have to be considered and complied with when offering cloud services. A PLA specifies how the CSP will be compliant with the applicable data protection law; therefore, PLAs are produced by privacy officers of a CSP in the form of natural language documents. Information about how CSPs address different aspects relating to data protection and privacy are reflected in the various sections in which the document is structured. The standardised structure of the agreement is of great help as it provides a way to group the statements found in a privacy policy by the aspect addressed (such as Data Transfer or Breach Notification). PLAv2 [START_REF]CSA Privacy Level Agreement[END_REF] has specifically been developed with the aim of creating an agreement template suitable for containing statements about how a CSP is going to meet obligations set out by the European Union (EU) Data Protection Directive 95/46/EC [2] (DPD in short, hereafter) and other current European data protection requirements 1 . The guidelines provided for each section in the PLA inform CSPs about which information is to be provided. This information will enable a customer to analyse and evaluate how a particular CSP has planned to comply with the European legal data protection framework.

Although the PLA is an important achievement, the evaluation of the information contained within it involves humans analysing the agreement's statements. If we consider an organisational customer wanting to compare services based on the provided PLAs, this task may take a long time as it requires humans to read and compare, section by section, the data protection-related statements. With respect to this issue we see the utility of having a machine readable representation of the policy statements. In fact, the information modelling behind the representation of the PLA policy statements constitutes the basis on which tools supporting the comparison among PLAs can be built. The idea here is to automate as many human-performed tasks as possible, primarily for efficiency reasons (as would be needed for example if hundreds of agreements were available). What we seek to model is the set of core information that can be extracted from the agreements and that are likely to be looked for by consumers when searching for a suitable service. The representation of key PLA privacy policy statements will thus highlight the main offerings from the data protection perspective.

We have been researching the topic of privacy policies and machine readable versions within the A4Cloud project [START_REF]Cloud Accountability Project (A4Cloud)[END_REF], which has been developing a set of tools enabling an accountability based-approach that includes managing policies for fulfillment of obligations. As shown in Fig. 1, the implementation of privacy policies can be seen as a two-phase process. During the first phase (design time) CSPs define the set of policies setting out the different aspects of the service provision. This policy definition step can result in the production of formal agreements such as Service Level Agreements (SLA) [START_REF] Patel | Service Level Agreement in Cloud Computing[END_REF] or PLAs. In the following step the CSP selects the controls that are more suitable to fulfil the defined policies. At the end of this step enforcement systems should be appropriately configured to make the overall service components work as they should. At runtime the components should behave as they have been instructed during the design time phase, and appropriate monitoring components should run to keep track of actions performed and the results of those actions. This is necessary to verify whether operationally the systems are behaving effectively as planned. From an accountability perspective, as we will expand on in Section 2, CSPs need to be prompt to prove deployed controls and performed actions; therefore, each step of the implementation process needs to produce evidence of the specific tasks that have been carried out. This is represented in Fig. 1 with the arrows linking each single step with an exemplary evi-dence repository. If not appropriately described, evidence and its handling can be complex. This is why we propose an ontology for the semantic annotations of evidence elements that can specify the nature of the evidence element and what this latter is evidence of.

Fig. 1. Provision of Evidence for Accountable Implementation of Privacy Policies

We have analysed the capability of software components in a specific instance of a cloud environment to enforce privacy statements. For statements enforceable by the means of software, we extend the PLA ontology that we have developed by adding properties that allow us to enrich the agreement representation. Specifically, we want to augment the representation with the technical policies created for policy enforcement. We see a technical policy, in itself, as an element that may need to be provided as evidence for demonstration purposes. The technical policy is one of the elements of evidence needed to prove that a policy statement has not just been claimed in an agreement but has also been turned into a software artifact. Evidence produced at runtime contributes to further back up the fulfilment of the policy statements. To establish a link between evidence elements and the policy statements whose demonstration they contribute to support, we propose an ontologically based-approach. Specifically, we create a machine understandable representation of the PLA and then we propose a model to semantically describe evidence elements and link them to the privacy statements.

The remainder of the paper is structured as follows. In Section 2 we present the concept of evidence, along with some definitions, highlighting its importance for the sake of accountability. In Section 3 we present the approach we have taken to turn PLA into a software-exploitable tool. We illustrate an example of ontology modelling applied to the data transfer section of PLA. Then we propose an ontology modelling the concept of evidence (about data processing in the cloud), proposing in particular an approach to link evidence elements to the data protection aspect they underpin. In Section 4 we present the tool that we developed within the context of the A4Cloud project to facilitate the translation of policy statements into instances of the PLA-related ontology models. The tool also enables the creation of system level policies for the setup and configuration of enforcement components that are added to the ontology-based representation of the PLA as evidence elements. In Section 5 related work is presented. Section 6 concludes the paper by providing some considerations about the work done and outlining directions for future work.

Evidence and Assurance in Relation to CSPs' Promises

As considered above, the information provided in the PLA represents data protection related promises that a CSP commits to keep with regard to the provision of a service.

A customer selects a service based on an evaluation of the PLAs of the available services. Once a specific service is selected, the related CSP needs to set up and configure the systems so that the PLA terms are met when the customer starts to use the service. Moving towards the adoption of an accountability-based approach in the provision of a service [START_REF] Pearson | Privacy Management and Accountability in Global Organisations[END_REF], the CSP must be able to provide the customer with further assurance that the policies are being enforced as stated in the agreement. This assurance can be built upon the evidence elements that the provider can produce and make available to authorised and interested parties in different phases of the cloud service provision.

From the customer point of view, the result of the evaluation of evidence is meant to be used as an indicator of what they can expect from the service in terms of adherence to the promised policies. From the provider standpoint, being able to produce evidence can be an advantage in service markets. Enterprise businesses are more likely to select services provided by CSPs that can guarantee a certain level of assurance with regard to the fulfillment of obligations, especially when the latter are required legally. Provision of evidence is not just a business-driven choice, though. In fact, for providers that want to disclose their practices by using the last release of CSA PLA [START_REF]CSA Privacy Level Agreement[END_REF], provision of evidence has been turned into a requirement to be addressed to demonstrate the CSPs' accountability in fulfilling obligations.

The Role of Evidence

Evidence is strictly bound to the concept of accountability, as it is one of the elements that must be produced and provided to appropriate parties by an organisation that wants to adopt an accountable approach for the provision of a cloud service. A strong accountability approach requires moving from accountability of policies and procedures to accountability of practices [START_REF] Pearson | Privacy Management and Accountability in Global Organisations[END_REF]. This move requires an organisation to be prompt in providing evidence about how obligations have been fulfilled and not just producing reports based on elements that have been analysed and elaborated by the provider itself. Elements that can be provided as proof of the correct (or incorrect) behaviour of a provider are likely to play an important role. In the PLA the way the provision of evidence has to be disclosed is explained in the guidelines accompanying the accountability section 2 within it, as the provision of evidence is central to the concept of accountability. Evidence is viewed as encompassing different levels. Specifically, "Evidence elements need to be provided at the (i) Organizational policies level to demonstrate that policies are correct and appropriate; at (ii) IT Controls level, to demonstrate that appropriate controls have been deployed; at iii) Operations level, to demonstrate that systems are behaving (or not) as planned" [START_REF]CSA Privacy Level Agreement[END_REF]. Therefore the availability of evidence elements can support the demonstration of the fulfilment of an obligation at different levels, from a declaration level through a documented policy to an operational level through the production of logs or any other system level tangible representation of the processing carried out by the systems. The willingness to produce evidence also reflects the transparency of an organisation and can contribute to building the trust of the customer in the provider.

The need to provide evidence is explicitly stated in the definition of accountability from the EDPS glossary [START_REF]European Data Protection Supervisor (EDPS): Glossary of terms[END_REF] (see text we have underlined), which reads: "Accountability requires that controllers put in place internal mechanisms and control systems that ensure compliance and provide evidencesuch as audit reportsto demonstrate compliance to external stakeholders, including supervisory authorities."

The Article 29 WP (Opinion 05/12, 2012) [START_REF]Opinion 05/12 on Cloud Computing[END_REF] also introduces the notion of (documentary) evidence to be provided to back up the asserted compliance to the data protection principles, "[…] cloud providers should provide documentary evidence of appropriate and effective measures that deliver the outcomes of the data protection principles".

CSPs need therefore to support assertions about practices adopted with related and relevant evidence artifacts. Example of these types of elements are certifications, logs and technical policies. These elements can be evaluated by customers who will make their choice by taking into account, in addition to the more common privacy policy statements, the information that a provider discloses about the evidence that it is able to produce. Some obligations may matter more than others for a specific customer. For those obligations, a customer is likely to view more favourably a provider that is able to produce a larger set, or more compelling, evidence elements.

Evaluation of Evidence Upfront and During Service Provision

As considered above, CSPs may want to provide a tangible demonstration to customers and/or auditors that they adopt an accountable approach. Such accountable CSPs would need to design their systems in such a way that they would be prompted to produce the evidence elements that will be required and analysed for demonstration purposes. The evidence can take different forms and can be used to demonstrate accountability at different levels, namely the organizational, controls and operations levels [START_REF]D:C-2.1 Report detailing conceptual framework[END_REF].

Evidence has to be produced by CSPs before entering into an agreement with a customer and also just after the contract is signed. In the first phase, CSPs need to provide evidence so that customers can make a more informed service selection. During this phase, customers can evaluate tangible evidence elements, such as documented policies, certifications and privacy seals. These elements represent a type of evidence that has been already produced. A different type of evidence is promised evidence, which refers to the elements that CSPs commit to produce. Logs are an example of promised evidence, as they can be produced when the service is in operation. Access to logs and other forms of evidence produced at runtime may be required to assess whether the provider and the systems set up have behaved as agreed or not. Promised evidence is thus key for holding a provider accountable. The two different set of evidence elements that result from this distinction can be used for the evaluation of the accountability attributes appropriateness and effectiveness. According to the definition of these attributes3 [START_REF] Jaatun | Towards Strong Accountability for Cloud Service Providers[END_REF], appropriateness evaluates the capability of contributing, therefore evidence provided upfront shall be used for this purpose; effectiveness evaluates the actual contribution to accountability, therefore for the purpose of this attribute promised evidence elements shall be evaluated when produced at runtime.

Information about the evidence elements available and to be produced can be difficult to analyse and evaluate. We would like to model some aspects of the evidence related disclosure that can be of use for its evaluation. We want to create a model that allows the building of tools that, with reference to a service, can answer questions like "Which types of elements can be produced to demonstrate the fulfilment of this data transfer policy?" To achieve this goal we create an evidence ontology and then link it to the ontology models we created for the PLA sections. In this way it will be possible for a provider to specify whether a specific evidence element has to be used for evaluating the fulfilment of a specific data privacy aspect. Establishing this link will be of help for customers, as there may be some data protection aspects that matter more than others for a customer, and knowing that a CSP can provide a larger set of evidence elements than another CSP, with respect to that aspect, may determine the choice that the customer will make.

The ontology model we build would be used by a provider to create instances of classes and properties that reflect information disclosed about the service. As mentioned above, the duty to produce evidence does not end with the signing of an agreement. The ontology-based representation of the PLA can be enriched with new elements as they are created within the enforcement environment. Ontology classes can be used for tagging the evidence produced at runtime by the enforcement components. Let us consider the case of data transfer policy statements, and let us assume there is a component in charge of monitoring the fulfilment of the restriction about the data processing location. The component can be configured so that the logs for the monitoring of those statements are tagged with the instance of the Data Transfer section being monitored. This would facilitate gathering logs about the monitoring of a specific policy. Our work on PLA formal representation seeks then to structure the concept of evidence into an ontology model and link it to the policy statements that the specific evidence elements aim to prove. This modelling constitutes the base element that can enable the development of a tool that help cloud customers to query, for a specific service, the type of evidence that can be produced to demonstrate the fulfilment of a specific policy.

In the following section we will present the approach taken for the modelling of the PLA ontology. We will give details about the modelling of the Data Transfer section, as we will be referring to it as an example in Section 4 when we will present the ontology-enabled tool to create the PLA representation.

PLA and Evidence Ontology Models

We present in the following subsections a set of classes and properties forming part of our PLA ontology. We present the Data Transfer section as an example of section ontology modelling that shows the approach taken. Then we move to the modelling of evidence.

PLA Model Overview

We would like the PLA ontology model to reflect the structure of the agreement; thus we model the top level class PLA and link it to the Service class and to the DataP-rotectionAspect class. A PLA is associated with one and only one service; a service can have just one PLA, therefore we model this two-way relation through the property isProvidedFor and its inverse provides. The DataProtec-tionAspect class has a list of subclasses which correspond to the sections in the PLA. To give an example, DataTransfer and PersonalDataBreach are two subclasses.

Data Transfer.

In the Data Transfer section of the PLA, CSPs are required to set out the following set of information:  Whether data will be transferred  The reason of the transfer (regular operations or emergency)  The country where data are transferred to (EEA or outside)  The legal grounds for the transfer  The Data Protection role of the recipient of the data being transferred

The Data Transfer ontology is then modelled by turning the above information into the set of properties described below. We give just two examples of the properties we have modelled to represent the information above, as we will be using them in Section 4.

Object property toCountry: this specifies the country where data will be transferred. This property ranges over instances of the class Country, which can be described by exhaustively listing all the possible instances of the class. The individuals of Country class are grouped into relevant areas so that we are able to retrieve additional information from the specific recipient country specified. As we know, for the implementation of DPD the knowledge about the area the country belongs to plays an important role. Knowing whether the country is within or outside the European Economic Area (EEA) is important as it establishes whether additional safeguards have to be guaranteed by the recipient organisation. For this reason we create an EEACountry subclass so that we can also directly obtain the information about the area. For completeness we also model a EUCountry class, a subclass of EEACountry, as it can be useful in other contexts.

Modelling the data transfer policy by specifying not just the area (within or outside EEA) but also the specific country (or set of countries) is of importance for organisations that have stricter requirements in this regard. In fact, there are countries where organisations have to maintain stronger data protection policies because it is required by tougher local laws. Having this piece of information represented in the machine readable version of the Data Transfer section allows customers to search for services able to address their specific need about the location. Object property hasAdequacyBase: this property specifies the means by which data transfer adequacy criteria are met. An instance of DataTransfer class is linked to an instance of the class AdequacyBase. We describe the class by enumerating some individuals belonging to this class, among which there well known legal grounds enabling the transfer of data, namely ECApprovedModelContractClauses, BindingCorporateRules, EEAInternalTranfer, OtherContractu-alAgreement, Consent, Exception. The instantiation of this property is of high importance when the transfer is to be done towards a country outside the EEA.

An Ontology for Evidence

Cloud customers evaluate capabilities of CSPs in demonstrating accountability by taking into consideration the set of evidence artifacts that have been produced in advance.

The set of evidence elements is enriched as new evidence artifacts are produced while the service is in operation. This type of evidence may be requested at any time for the purpose of monitoring the behaviour of the provider and therefore assessing whether actions (and their effects) are compliant with what is expected. Before building our evidence ontology, let us review a few definitions drawn for Evidence and Accountability Evidence. This initial analysis will allow us to extract the main properties that characterise an evidence element and possible connections between an evidence element and other concepts. The result of this analysis will be a set of elements which will drive the modelling of the evidence ontology, which will make the knowledge about evidence explicit.

A4Cloud has defined Accountability Evidence [START_REF] Felici | Cloud Accountability: Glossary of Terms and Definitions[END_REF] as "collection of data, metadata, routine information and formal operations performed on data and metadata which provide attributable and verifiable account of the fulfilment of relevant obligations with respect to the service and that can be used to support an argument shown to a third party about the validity of claims about the appropriate and effective functioning (or not) of an observable system". This definition is broad enough to account for evidence provided in different forms, whether raw or derived. What we highlight from this definition is the established linkage between the evidence and the claims. In our context, where claims are made in the PLA's sections and the capabilities of producing evidence are stated in the PLA Accountability section, we model the link between a specific evidence artifact and the specific data protection aspect that the evidence backs up.

From the guidelines accompanying the accountability section in PLA [START_REF]CSA Privacy Level Agreement[END_REF] we gather a view on the different forms of evidence, namely evidence "can take different forms, such as attestations, certifications, seals, third-party audits, logs, audit trails, system maintenance records, or more general system reports and documentary evidence of all processing operations". This characterisation of the nature of evidence can be translated into an ontology that can be used for classification purposes. Referring to the same section in PLA, evidence can be provided to demonstrate the level of depth that the implementation of the policies has reached. The information about the level is additional information than can be used to augment the description of an evidence artifact. Organisations wanting to adopt an accountable approach need to be prepared to provide evidence at all the levels mentioned above, to prove that policies have not only been declared but are actually being followed in practice. The property of being able to provide evidence at different levels is another feature we aim to model in our ontology so that the populated evidence ontology (i.e. the evidence knowledgebase) can be queried to return the data protection aspects for which all levels have been implemented. It is not the case though that evidence can be provided at all the levels mentioned for all policy statements. For example, operationally, there may not be software-based mechanisms for policy enforcement. This consideration should be taken into account by the actors tasked with evaluation of the evidence-related guarantees.

Evidence Ontology Concepts. In the ontology we aim to model the evidence elements and their use for assessments. At the core of our ontology there is the broad Evidence concept that we want to better characterise by specifying specific evidence elements along with their definitions. Our context is cloud service provision and evidence is used for demonstration of effective implementation of organisational policies, IT controls and operations; therefore, in our ontology we model the evidence elements that can be used for these purposes.

A first characterisation can be done by introducing the concept of Derived Evidence, which is a form of evidence that has been created by examining a set of evidence elements. We introduce the Assessment concept as the general term to express the evaluation of evidence elements that generate Assessment Reports, which are therefore classified as Derived Evidence. We distinguish two main types of assessment, namely Audit-Based Assessment and Continuous Monitoring Assessment. The knowledge about the assessment type affects the level of confidence that stakeholders have about the result of the assessment, therefore it is important to be transparent about this type of information. Audit, according to the ISO/IEC 27000 definition [START_REF]Information technology -Security techniques -Information security management systems -Overview and vocabularyEuropean DG of Justice (Article 29 Working Party)[END_REF], is a "systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled". Audit can be performed in different ways, based on what the audit results are to be used for. We distinguish the type of audit based on the actor playing the role of the auditor. Internal Audit (also called first party audit) is conducted by the organisation itself for internal purposes, such as process management review. The results of internal audits, in the form of Audit Reports, may be requested by customers, and therefore CSPs may wish to include this among the type of (derived) evidence generated. Internal audits can be used to self-assess conformance of organisations to standards/best practices. Third-Party Audit is another type of audit-based assessment which is performed by parties external to the organisation. The results of this type of audit may result in certification, or be used for legal and/or regulatory purposes. They are typically conducted by accredited auditors following specific standard audit procedures. Being produced by actors that have no interest in the organisations being audited, third party audit reports assume importance as they provide a higher level of assurance and consequently customers would show greater trust in them. This is also due to the different factors that may affect the trust relationships between CSPs and customers [START_REF] Pearson | Privacy, Security and Trust in Cloud Computing[END_REF].

Certification is defined in our ontology as a type of derived evidence, whose issuance is based on the result of an assessment. As specific type of certifications we include Attestation and Privacy Seal. Following the classification by ENISA [START_REF]Cloud Computing Certification -CCSL and CCSM[END_REF], the Cloud Certifications class includes the certification schemes relevant for cloud customers. Each certification has a set of underlying standards or best practices. We model this connection through the relationship underlyingPractices between Certification and Practices, which includes Standards and Best Practices.

There are many artifacts produced during a cloud service lifecycle, which encompasses phases such as service design, development, deployment, advertisement, operation. Each produced artifact can be seen as evidence associated with a specific activity carried out during a specific phase. It can be very complex to classify every possible evidence element. The objective within this paper is to include most known and used types of evidence, based on their possible exploitation during the service procurement phase. We model the Policies evidence type and its two main subclasses Privacy Policy and Security Policy. Evidence elements can be classified as belonging to this category if they document respectively the privacy policy and the security policy adopted in an organisation. As an example of privacy policy evidence we have added the Notice class, which can be also be associated to an URL pointing to the resource location where the notice have been published.

Agreements represent evidence of what has been promised to customers. We distinguish Legal Agreements, which are legally binding, and Service Specification Agreements, which are documents describing the features of the service. As agreements addressing specific aspects of a service description we include Privacy Level Agreements (PLAs) and Service Level Agreements (SLAs), which focus on, respectively, data protection aspects and quality of service aspects. A SLA may refer to a PLA, therefore this link should be represented (although it is not explicitly modelled in this ontology).

Enforcement systems, which are in charge of the technical enforcement of what has been described in policies and agreements, need to be configured and set up appropriately before being deployed. The main artifacts produced at this stage can be classified as Technical Policies and Configuration Files. Technical policies are the representation of documented policies and procedures in low level policy languages. An example is the policy language denoted as A-PPL [START_REF] Azraoui | A-PPL: An Accountability Policy Language[END_REF]; policies in A4Cloud are represented by using A-PPL and then enforced by an A-PPL Engine (A-PPLE) [START_REF] Azraoui | A-PPL: An Accountability Policy Language[END_REF] able to process A-PPL policies. A component provided with a set of technical policies should act in a way consistent with that established by those policies. The accountability-driven view of the provision of a cloud service requires provision of proof also about the correct behaviour of the system corresponding to a set of correctly specified policies. Proof of the appropriateness of the policies specified does not imply their effectiveness once they are enforced. Logs will be produced to give evidence of that. Logs are the main source of evidence to prove effectiveness of measures. As a specific type of logs we mention Audit Trails, which represent records of the sequence of operations leading to a relevant event.

Communications also constitute evidence. The main distinction is between Informal Communications, which includes messages exchanged in the form of emails, and Formal Communications. This latter, in turn, includes Notifications, which represent formal reporting of relevant events, and Account, which is defined as a report or description of an event or a process and may be used to communicate audit results and system state. The account provides answers to the "six reporters' questions" by using evidence elements [START_REF]A4Cloud Consortium: Cloud Accountability Reference Architecture[END_REF].

We want to code the implicit linkage between policy statements in a PLA and the evidence that can be evaluated upfront by a customer to assess to which extent the CSP can be considered accountable for specific data protection aspects. This linkage makes explicit the relation between an evidence artifact and a specific data protection aspect. This linkage can be useful to advise customers on the correct use of the evidence elements available. Evidence elements can apply to different data protection aspects but may also target the demonstration of a specific part of the privacy policy. This is modelled in the ontology through the relationship isEvidenceOf which maps evidence elements to the data protection aspect which is the target of the evidence-based demonstration.

This linkage created can also be exploited at runtime. Components creating evidence as a result of the enforcement of a privacy policy statement should be enabled to exploit this link to enrich the knowledge base with a reference, such as a Uniform Resource Identifier (URI), to the evidence being created. The reference can also be an accessible Uniform Resource Locator (URL) that points to a web service endpoint to gather evidence elements of that type being continuously collected. We used the Protégé tool [17] to draw the evidence ontology, which is shown in Fig. 2. This ontology shows the classes to be used for describing the evidence artifacts, along with some relationships that hold among some concepts.

The ontology produced should be seen as a living document to be updated as the knowledge about evidence to be used for accountability purposes is enriched.

Discussion about Use of the Ontologies

The use of the ontology can help to gather and classify the evidence artifacts produced. Metadata describing a specific evidence element can help answer the following questions: "What is the data protection aspect whose demonstration this evidence is meant to contribute to?" About this question, we remark that in the guidelines of the Accountability section of the PLA there is no linkage suggested to be established between the evidence elements provided and a specific data protection aspect. The evidence ontology model we are going to design will also be of use in this respect. The reasoning capabilities of the ontology will be exploited as the semantic description of instances of classes such as Logs will automatically be classified as instances of Evidence holding the properties of having been produced by Software Tools. Information about the type of evidence element can be used to handle this in the right way, based for example on the format of the element provided. About the use of ontologies there are two main issues that arise which we try to address in the following paragraphs by proposing approaches we may take, in a later stage of our work.

Change Management. Privacy Policies can change over time to adapt the service offerings to updated laws or to reflect changes made in the service implementation. Providers need to track changes and inform the effected customers to let them check that the terms still meet their requirements. Providers need then to have processes in place that track changes and promptly require them to take actions on different tasks that are affected by detected changes. Changes can be handled as events, which can be automatically or manually created (as in the case of an updated law), and the change management process will trigger the execution of tasks which involve the active interaction of the provider. Signatu [START_REF] Signatu | [END_REF] is an example of a tool that creates the natural language policy and implements a process that alerts providers in case of changes to the law. Iubenda [19], another tool for privacy policy creation, also promises to keep tracking the privacy policy for necessary adaptation to current legislation.

Regulatory Compliance. Use of the Data Protection Policies Tool (DPPT) facilitates the creation of a privacy policy compliant with the DPD. It does so by presenting the provider with options in UI elements that reflect the knowledge we have about possible practices used by providers. However, an additional layer specifically designed to verify the compliance should be introduced to take into account dependencies between different statements that may render the privacy policy not compliant. Application specific compliance checker modules can be designed to verify the compliance with more stringent requirements than the ones derived from the DPD. We see that the development of these compliance checkers can be built by adding rules to be verified over the statements produced. For the time being we have focused on the use of the ontologies for creation of statements to show what the result would be like and how we envisage to use it.

Fig. 2. Evidence Ontology

Data Protection Policies Tool

We illustrate how instances of the data transfer ontology concepts introduced in subsection 3.1 can be created with the aid of a Data Protection Policies Tool (DPPT), which is a user-friendly tool that we have developed. Data introduced by the user (who typically would be a policy manager or policy administrator) can be used to create the technical representation of the policy that is then sent to the component tasked with the policy enforcement. This technical policy (written in A-PPL as this is the A4Cloud reference policy language) will then be semantically described as evidence of the data transfer policy. The result will be a Web Ontology Language (OWL) [START_REF]Owl 2 web ontology language document overview[END_REF] file containing the data transfer policy and the A-PPL policy.

Creation of Data Transfer Policy Statements

The GUI of the tool presents different panels and reflects the structure of the PLA. The Data Transfer panel is shown in Fig. 3. The elements available in the GUI are bound to the Data Transfer ontology concepts. Actions performed through the GUI, such as typing values in text fields and selecting an option from a combo box, result in the instantiation of corresponding ontology concepts. The GUI layer hides the ontology layer and helps the user in handling ontology-related operations. To clarify this point, let us consider the text field with the label "Country where personal data will be transferred". The name of the country entered by the user, "US" in this example, is an individual of Country class and is linked through the object property toCountry to the instance of the DataTransfer class.

Once the user has provided all the data, an A-PPL policy can be created. We have created A-PPL templates for expressing various policy statements. When we click the "Translate into A-PPL" button, the template for data transfer is used and filled in with the needed data. Depending on the language used and the capability of the enforcement components, all or only a subset of the data may be used. Once the A-PPL policy is created, the tool generates an assertion that declares the policy as an instance of the class TechnicalPolicy that is evidence of the Data Transfer instance, as shown in Fig. 4. The A-PPL policy can also be sent to the A-PPLE engine by clicking the related button on the GUI. The policy is sent by using the web service APIs provided by A-PPLE, therefore an URL identifying the endpoint of the web service is used. This information can be integrated into the ontology-based representation of Data Transfer if we add classes describing the enforcement components. In this case we can model an EnforcementComponent class and create an instance identifying the A-PPLE engine. We can provide more specific information about A-PPLE by adding the object property hasEnpoint which links the A-PPLE instance with an instance of the class WebServiceEndpoint, which is a URL. Having specified that data will be transferred to US, the CSP also needs to select the legal ground allowing the transfer. The CSP in this case selects Binding Corporate Rules (BCRs), which is classified in the ontology as a subclass of Governance Policies. To instantiate this class the CSP needs to provide an URI identifying the BCR text that can then be mapped to Data Transfer class, which is a subclass of Data Protection Aspects. The CSP can also specify that Compliance Reports will be produced during service operation to substantiate the legal compliance of the transfer being performed. This type of evidence further substantiate the data transfer aspect and its production may be based on logs. This information can also been specified at the moment manually (that is, not through the aid of a GUI).

The instances created will be exploited to answer queries about the evidence available for the data transfer data protection aspect.

If we want to know which evidence elements are available for the Data Transfer policy, we need to query the populated ontology by using the DL Query Tab in the Protégé tool, and we obtain references to BCR, compliance report and technical policy (this latter is added to the knowledge base by the DPPT tool). The query and the result are shown in Fig. 5.

Related Work

PLA as a research initiative was launched only in 2012 and PLA v2 was released in June 2015. We are not aware of available examples of real instances of PLA, nor of published work about software-based exploitable PLA, which we introduce with our work. However, there has been significant research in the area of SLAs [START_REF] Patel | Service Level Agreement in Cloud Computing[END_REF], of which PLA is positioned to be supplementary and privacy-focused, and there are a few projects that have addressed the modelling of a machine readable SLA to be exploited by software tools. In particular, the SLA@SOI project [START_REF]SLA@SOI Project[END_REF] has created a SLA model for service lifecycle management [22] [23]. The SPECS project [START_REF]SPECS Project[END_REF] addresses the topic of automating the management of security-oriented SLA. To this aim, the problem of the definition of a machine readable format for the SLA is tackled. SPECS introduces a SLA security conceptual model and proposes an XML schema for this model [START_REF]Report on conceptual framework for Cloud SLA negotiation -Initial[END_REF]. As an example of an ontology-based approach to enable SLA management we cite [START_REF] Labidi | Ontology-Based Context-Aware SLA Management for Cloud Computing[END_REF]. Significant research has been carried out on the representation of privacy policies in a machine readable format. Among relevant background in this area we cite W3C P3P [START_REF] Cranor | Web Privacy with P3P[END_REF], which developed a platform enabling web sites to express their data collection privacy practices in an XML standard format known as a P3P policy, and extensions of this approach in the PRIME project [START_REF]Digital Privacy: PRIME -Privacy and Identity Management for Europe[END_REF] and PRIMELife project [START_REF] Ardagna | Primelife policy language[END_REF], although many other approaches have been taken. There has also been prior work in ontology supported policy generation [START_REF] Rahmouni | Privacy compliance in european healthgrid domains: An ontology-based approach[END_REF] based on the mapping between single eXtensible Access Control Markup Language (XACML) syntax elements and legal requirements modelled in an ontology. The advantage of the approach we propose is that we can utilize a task that needs to be completed by organisations in any case (namely the provision of SLAs and PLAs), and then automatically generate information that has a clear business benefit (namely, provision of assurance that can be used to generate trust).

Evidence-related topics have been tackled in different work for different purposes that relate to evidence generation, the gathering/collection of evidence, secure storage of produced evidence, protocols for evidence retrieval and evidence analysis. For example, Ruebsamen et al. in [START_REF] Ruebsamen | Secure Evidence Collection and Storage for Cloud Accountability Audits[END_REF], as part of work carried out within the A4Cloud project, have tackled the design of a system for secure collection and storage of digital evidence to address the requirements imposed for the purpose of accountability audits. Various evidence sources are considered for evidence collection, with software agents specifically developed for collection of evidence from a specific source. The knowledge about the features of the source and the evidence produced has been used to design the software agents but has not been made explicit once the evidence is generated. This is one of the purposes of our work, to add metadata to evidence elements by means of ontologies so that they are given meaning by different systems being made to be ontologyenabled.

The role of logs and the importance they assume as accountability evidence is discussed by Ruebsamen et al. in [START_REF] Rübsamen | Evidence for Accountable Cloud Computing Services[END_REF], where the need for mappings between evidence data and high level requirements is also raised.

Semantic description of evidence has been tackled in the field of digital investigations for automating the process of integration of evidence [START_REF] Dosis | Semantic Representation and Integration of Digital Evidence[END_REF], which often relies on expertise of expert practitioners who manually perform this task. Dosis et al. [START_REF] Dosis | Semantic Representation and Integration of Digital Evidence[END_REF] in their work describe their ontology-based method to integrate digital evidence. They have specified a number of ontologies for describing sources of evidence commonly used in digital investigations, such as storage media and network traffic. With respect to this work, our ontology can be considered as an upper ontology of evidence, whose concepts can be expanded into additional ontologies in which the knowledge of a specific component can be modeled. Brady at al. [START_REF] Brady | Addressing the Increasing Volume and Variety of Digital Evidence Using an Ontology[END_REF] also propose an ontologythe Digital Evidence Semantic Ontology (DESO)to describe devices that are sources of digital evidence. DESO has been developed to support digital evidence examiners in their job of entailing the classification and comparison of digital evidence artifacts.

The Cloud Trust Protocol [START_REF]CSA Cloud Trust Protocol Initiative[END_REF] is a research initiative launched by CSA that aims to provide cloud customers with mechanisms to make queries about elements of transparency that can help build evidence-based trust towards the CSP. The link with accountability is not explicitly mentioned but, according to the view developed in the A4Cloud project [2], this type of mechanism contributes to displaying accountability. Evidence for demonstrating accountability is addressed by the Privacy Office Guide produced by the Nymity Research Initiative [START_REF]Nymity Research Initiative, A Privacy Office Guide to Demonstrating Accountability[END_REF]. Evidence is seen as one of the three fundamental elements of accountability (together with ownership and responsibility).

Nymity has developed a Privacy Management Accountability Framework which identifies 13 processes for which accountability has to be supported through assessments based on collected evidence.

Conclusions

In this paper we have presented an ontology-based approach to create a machine readable representation of the PLA. To ease the creation of PLA ontology instances we have developed a prototype of a GUI-based tool which presents the user with policy statements that have to be disclosed for a specific section of the PLA, and automatically generates a corresponding machine readable representation that can be used in a number of ways. Provision of evidence is key for an organisation that wants to adopt an accountable approach for service provision. We propose an ontology modelling the concept of evidence and its linkage with privacy policy statements. This modelling allows a semantic description of the evidence elements produced according to their nature. Information about evidence is added to the ontology-based representation of the PLA and can be processed and exploited by customer side tools to extract information about the evidence produced to demonstrate the fulfilment of a data protection aspect. We have shown a specific example related to a Data Transfer policy where the evidence is provided in the form of a technical policy and BCRs, but additional elements could be added in the same way.

Future directions of this research include that we seek to keep working on the tool and the ontologies to keep these aligned with current legal obligations and formal evidence documents being produced and used. We also plan to integrate the tool into a specific real enforcement environment to test the usefulness of the ontology-based tagging.

Fig. 3 .Fig. 4 .

 34 Fig. 3. GUI of Data Transfer Section

Fig. 5 .

 5 Fig. 5. Evidence Elements Query

On December 15th

the European Commission, the European Parliament and the Council agreed on the draft text of the General Data Protection Regulation that, once approved, will update and replace the DPD. It is likely to come into force in spring

with a two-year transition period for organisations to comply. The PLA WG will continue to work on the PLA to keep it aligned with current privacy laws in Europe.

The A4Cloud project, through the authors, has contributed to the text of the accountability section in the PLA.

Appropriateness: the extent to which the technical and organisational measures used have the capability of contributing to accountability. Effectiveness: the extent to which the technical and organisational measures used actually contribute to accountability.

Acknowledgment. This work has been partly funded from the European Commission's Seventh Framework Programme (FP7/2007-2013) under grant agreement no. 317550 (A4CLOUD) Cloud Accountability Project.