A Systematic Mapping Study on Privacy by Design in Software Engineering

Abstract

Protecting personal data in current software systems is a complex issue that requires legal regulations and constraints to manage personal data as well as a methodological support to develop software systems that would safeguard data privacy of their respective users. Privacy by Design (PbD) approach has been proposed to address this issue and has been applied to systems development in a variety of application domains. The aim of this work is to determine the presence of PbD and its extent in software development efforts. A systematic mapping study was conducted in order to identify relevant literature that collects PbD principles and goals in software development as well as methods and/or practices that support privacy aware software development. 53 selected papers address PbD mostly from a theoretical perspective with proposals validation based primarily on experiences or examples. The findings suggest that there is a need to develop privacy-aware methods to be integrated at all stages of software development life cycle and validate them in industrial settings.

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

“…The first study attempts to define Privacy by Design (PbD), identify privacy goals, and examine the various approaches to this topic [15]. This study provides a coherent definition of PbD, lists the privacy goals discussed in the literature, and presents various tools, methods, models, and patterns for PbD implementation.…”

The Effects of Applying Privacy by Design to Preserve Privacy and Personal Data Protection in Mobile Cloud Computing: An Exploratory Study

“…Although the debate continues about the best strategies for dealing with the various issues for privacy and personal data protection in MCC, the benefits of utilizing PbD for privacy and personal data protection in MCC are not explored. Specifically, no single study exists which explored the effects of applying PbD for privacy and personal data protection in MCC [2,40]. PbD is a general philosophy that demonstrates privacy should not be overviewed as an afterthought, but rather as a first-class requirement in the design of IT systems [41].…”

“…For this study, external validity is about utilizing the visibility and transparency principle out of the seven principles of PbD is a threat to the external validity of the study. This threat is migrated, since investigating one principle in PbD and generalized the results is a common practice in the research domain [40,[88][89][90]. Moreover, a recent systemic mapping study has revealed that many studies in PbD have studied at least one PbD principle and generalized the results [40].…”

Data, data and even more data : empowering users to make well-informed decisions about online privacy

“…Anonymization was ranked as the fifth most important attribute by users and the eighth most important attribute by privacy experts, but received surprisingly little attention in literature. Anonymization is technically challenging (Morales-Trujillo et al, 2018) and privacy experts know this. Because true anonymization is seldom achievable (Pedarsani & Grossglauser, 2011;Wondracek et al, 2010), various degrees of pseudonymity are implemented instead.…”

“…Martín et al (2014) highlighted a lack of technical privacy requirements and criticized disagreement between high-level privacy principles. According to Morales-Trujillo et al (2018), in order to address privacy during software development and to be able to respond to user's privacy concerns, a conceptual framework is needed that goes beyond data minimization and access control. Acquisti et al (2017) saw potential in efforts toward assisting users with online privacy decisions by helping them reflect on their actions before the fact or by 'nudging' them toward certain behaviors.…”