Primer: What Exactly is an Ontology? | by Cillian Kieran | Ethyca

Primer: What Exactly is an Ontology?

6 min read · Oct 29, 2021

Introduction

This post is intended to serve as a basic introduction to ontologies in general, supplementing my recent article on privacy ontologies. If you’d like to learn more, I’ve added a section below with some books and authors that provide a deeper, really inspirational understanding of the topic.

What is an Ontology?

In a recent lunch-and-learn with the Ethyca team, we defined an ontology simply as:

A set of concepts within a domain and the relationships that hold between them in order to represent that system.

But even this is a little esoteric, so this post is going to give a very brief and rough introduction to ontologies, their constituent components and what makes them so powerful as we think about solving complex privacy problems.

Shapes — A simple Example of an Ontology

Shapes and the words we use to describe them are a great example of a simple ontology:

We can see in the above example that, quite logically, “a circle is a shape” and similarly, “a square is a shape”. But we might have a very complex system in which a relatively flat hierarchy like this makes labeling parts of the system challenging, so let’s subdivide…

Now we can see in this case that squares, triangles and rectangles are all polygons, which are in turn shapes. Clearly a circle, in this hierarchical structure at least, is still just a shape. So now we’ll introduce some consistency of levels order (aka levels) here:

Now we’ve introduced non-polygonal and polygonal shapes and — for the heck of it — we’ve introduced regular and irregular polygons. What we’ve actually done thus far is both create the bones of a taxonomy — that is, a hierarchical set of naming conventions — and also their relationships. Here, the relationships are implicit, so let’s just call those out a bit more concretely in the diagram below.

Here we can clearly see that…

A circle is a non-polygonal shape
A square is a regular, polygonal shape
A rectangle is an irregular, polygonal shape

We now have a taxonomy and some basic relationships mapped. We’re closer to an ontology, albeit a very simple one that describes a primitive system of shapes.

Company & Work — A Slightly More Complex Ontology

In order to demonstrate the various components of a more detailed ontology, we’re going to use the concept of a company, its employees, consultants and projects. You can see this illustrated here with the relationships and roles between each.

As you can see in this example above, it shows that there are two companies working together, as a result of a contract between them. In turn, there are employees that work for those companies and with each other, or in some cases, reporting to each other based on seniority. These employees and consultants are in turn, working on a project together.

Components of an Ontology

To summarize, the components of an ontology are:

Entity: Represents an object or thing. For example: person, man, woman or circle.
Relationship: Represents relationships between things, commonly a parent-child relationship between two humans, like the “reports to” relationship between a report and their manager.
Role: Describes the participation of entities in a relation. For example: in marriage, there are typically roles of husband, wife or spouse. In a company, there are roles of manager and report.
Resource: Represents the properties associated with an entity or a relation. For example: a name, date or characteristic.

Examples of Privacy Ontologies

The field of privacy ontologies for technical systems is a young one, and the early privacy ontologies have offered insight into how our ontology can be best designed for maximum effectiveness and adoption in industry. In recent years, ontologies such as PrOnto and COPri v.2 have emerged. I’ve linked the research papers for further reading, and I provide a brief summary here.

PrOnto, based particularly on GDPR requirements, structures processes such as risk analysis, violation detection, and workflow execution. With this ontology to organize data, agents, and other entities with their associated legal relationships under GDPR, users can perform SPARQL queries such as finding the measures needed to mitigate risk of a specific processing activity in a specific organization. The model focuses on translating legal terms into an ontology, to systematize legal reasoning, with an eye towards machine-supported compliance checks using the language LegalRuleML.

COPri v.2 aims to proactively describe privacy behaviors and actively enforce policies. The ontology expands the legal-specific viewpoint of PrOnto to encompass social and organizational settings like “entity social trust”: a measure of actors’ expectations in one another concerning their dependencies. In less academic terms, it models whether parties expect each other to play their part in a privacy workflow. These social settings comprise just one part of a large set of ontological primitives, spanning the dimensions of organizational, privacy, risk, and treatment.

Importance of Consistent Privacy Definitions

Privacy is fundamentally a matter of definitions: defining — and enforcing — what party can perform what actions on what data under what decisions. The task of establishing consistent privacy definitions through a privacy ontology is vital work for all of us privacy practitioners. It’s vital for the soundness of our systems and the protection of the world’s data.