Privacy Law Classifier
Reads one sentence about company records and names the rule it most likely points to, out of 21: HIPAA, 42 CFR Part 2, CCPA and CPRA, other US state privacy laws, GDPR, UK GDPR, PIPEDA and Quebec Law 25, GLBA and the FTC Safeguards Rule, FCRA, COPPA, PCI DSS, CAN-SPAM, the Fair Housing Act, the Driver's Privacy Protection Act, ITAR and EAR, CUI and DFARS, GINA, 21 CFR Part 11, attorney-client privilege, contractual confidentiality and NDAs, and trade secret protection.
Every name, number and address it was trained on is made up. Nothing comes from a real person, patient, customer or business.
Why it exists
When a company prepares records for an AI data license, the first question is which rules the data falls under, and that depends on what the records mention: patient charts, card numbers, EU customers, tenant screening, export-controlled drawings. This model sorts notes, tickets and review comments by the rule they raise, so the right checklist and the right counsel see them. It is a router for review, not a legal answer.
Use it
from transformers import pipeline
classify = pipeline("text-classification", model="aitrainingdatabroker/privacy-law-classifier", top_k=3)
print(classify("We found cardholder data and CVV codes in free-text notes during the scan."))
How it was trained
Fine-tuned from distilroberta-base for 6 epochs on one RTX 3070. Training data: data-compliance-frameworks (1256 rows), all invented. The scripts that built the data, trained the model and scored it are in source/; the full scores are in scores.json.
Test scores
On 471 held-out rows: accuracy 0.93, macro F1 0.936.
| Label | F1 | Count |
|---|---|---|
21 CFR Part 11 |
1.0 | 24 |
42 CFR Part 2 |
1.0 | 24 |
Attorney-client privilege and professional conduct rules |
0.95 | 21 |
CAN-SPAM |
0.865 | 21 |
CCPA and CPRA |
0.8 | 21 |
COPPA |
1.0 | 21 |
CUI and DFARS |
0.913 | 21 |
Contractual confidentiality and NDAs |
0.95 | 21 |
Driver's Privacy Protection Act |
1.0 | 21 |
FCRA |
1.0 | 24 |
Fair Housing Act |
1.0 | 21 |
GDPR |
0.685 | 27 |
GINA |
1.0 | 21 |
GLBA and the FTC Safeguards Rule |
0.976 | 21 |
HIPAA |
0.966 | 30 |
ITAR and EAR |
0.906 | 24 |
Other US state privacy laws |
0.941 | 18 |
PCI DSS |
0.957 | 24 |
PIPEDA and Quebec Law 25 |
0.909 | 21 |
Trade secret protection |
0.909 | 24 |
UK GDPR |
0.923 | 21 |
Limits
- One label per sentence. Real records often fall under several rules at once (an EU patient's card number); use the top few scores, not only the first.
- Trained on invented sentences built from each rule's key terms, so it reacts to vocabulary. A sentence that describes health data without health words can be missed.
- GDPR and UK GDPR, and CCPA and other US state laws, share most of their vocabulary and are the classes it confuses most.
- This model is not legal advice and not a certification. Whether a de-identification method meets HIPAA Safe Harbor or Expert Determination, CCPA and CPRA, GDPR or UK GDPR anonymisation, PIPEDA, Quebec Law 25 or another rule is a question for your counsel and, where a rule requires one, a qualified expert. A person should review its output before any data is shared.
Read more
- Privacy rules by region before you sell company data to AI
- De-identified data under CCPA vs anonymous data under GDPR
License and credit
Apache 2.0. Please credit AI Training Data Broker and link to https://aitrainingdatabroker.com/ when you share or build on it.
About
AI Training Data Broker is a broker and technical advisor for companies that sell or license their data to AI labs. It guides the technical side, including export, format, de-identification and compliance, and publishes free checklists on de-identifying data and keeping it within the privacy rules that apply.