Abstract:The recent advances in large language models (LLMs) have significantly expanded their applications across various fields such as language generation, summarization, and complex question answering. However, their application to privacy compliance and technical privacy reviews remains under-explored, raising critical concerns about their ability to adhere to global privacy standards and protect sensitive user data. This paper seeks to address this gap by providing a comprehensive case study evaluating LLMs' performance in privacy-related tasks such as privacy information extraction (PIE), legal and regulatory key point detection (KPD), and question answering (QA) with respect to privacy policies and data protection regulations. We introduce a Privacy Technical Review (PTR) framework, highlighting its role in mitigating privacy risks during the software development life-cycle. Through an empirical assessment, we investigate the capacity of several prominent LLMs, including BERT, GPT-3.5, GPT-4, and custom models, in executing privacy compliance checks and technical privacy reviews. Our experiments benchmark the models across multiple dimensions, focusing on their precision, recall, and F1-scores in extracting privacy-sensitive information and detecting key regulatory compliance points. While LLMs show promise in automating privacy reviews and identifying regulatory discrepancies, significant gaps persist in their ability to fully comply with evolving legal standards. We provide actionable recommendations for enhancing LLMs' capabilities in privacy compliance, emphasizing the need for robust model improvements and better integration with legal and regulatory requirements. This study underscores the growing importance of developing privacy-aware LLMs that can both support businesses in compliance efforts and safeguard user privacy rights.

"It's a Fair Game", or Is It? Examining How Users Navigate Disclosure Risks and Benefits When Using LLM-Based Conversational Agents

Trust No Bot: Discovering Personal Disclosures in Human-LLM Conversations in the Wild

Enhancing user experience and trust in advanced LLM-based conversational agents

CLEAR: Towards Contextual LLM-Empowered Privacy Policy Analysis and Risk Generation for Large Language Model Applications

Rescriber: Smaller-LLM-Powered User-Led Data Minimization for Navigating Privacy Trade-offs in LLM-Based Conversational Agent

Empowering Users in Digital Privacy Management through Interactive LLM-Based Agents

Secret Use of Large Language Model (LLM)

"I Always Felt that Something Was Wrong.": Understanding Compliance Risks and Mitigation Strategies when Professionals Use Large Language Models

Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory

A survey on Large Language Model (LLM) security and privacy: The Good, The Bad, and The Ugly

How Privacy-Savvy Are Large Language Models? A Case Study on Compliance and Privacy Technical Review

Natural Language but Omitted? On the Ineffectiveness of Large Language Models' privacy policy from End-users' Perspective

Multi-step Jailbreaking Privacy Attacks on ChatGPT

Exploring the Privacy Protection Capabilities of Chinese Large Language Models

PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Action

The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies

The Dark Side of ChatGPT: Legal and Ethical Challenges from Stochastic Parrots and Hallucination

AI Delegates with a Dual Focus: Ensuring Privacy and Strategic Self-Disclosure

Human-Centered Privacy Research in the Age of Large Language Models

The Ethics of Interaction: Mitigating Security Threats in LLMs