DataProVe: Fully Automated Conformance Verification Between Data Protection Policies and System Architectures

Abstract

Privacy and data protection by design are relevant parts of the General Data Protection Regulation (GDPR), in which businesses and organisations are encouraged to implement measures at an early stage of the system design phase to fulfil data protection requirements. This paper addresses the policy and system architecture design and propose two variants of privacy policy language and architecture description language, respectively, for specifying and verifying data protection and privacy requirements. In addition, we develop a fully automated algorithm based on logic, for verifying three types of conformance relations (privacy, data protection, and functional conformance) between a policy and an architecture specified in our languages’ variants. Compared to related works, this approach supports a more systematic and fine-grained analysis of the privacy, data protection, and functional properties of a system. Our theoretical methods are then implemented as a software tool called DataProVe and its feasibility is demonstrated based on the centralised and decentralised approaches of COVID-19 contact tracing applications.

Context Specification Language for Formally Verifying Consent Properties on Models and Code

“…Formal ML PL Language Tool properties [3] × unnamed × [6] × CAPVerDE CAPVerDE [31] × unnamed DataProVe [24] × Prolog Prolog-based [25] × ×…”

“…Consent properties target why personal data is processed and not who has access to the data and are thus complementary. Some approaches verify consent properties at model level: they rely on smart contracts for blockchains [3], a specific architecture design and verification based on second-order logic [6], a policy language and an architecture description language [31], or logs to verify actions scheduling [24]. Three of those approaches rely on tools: Bavendiek et al [6], and Ta and Eiza [31] use their own dedicated tool, while de Montety et al use Prolog [24].…”

Evolution of Composition, Readability, and Structure of Privacy Policies over Two Decades

“…Even with these privacy regulations, data protection principles sometimes need to be clarified, and manual conformance verification can be error-prone [15,58,62]. Additionally, the design of regulations overlooks the cognitive frame of personal intrusion to comprehend privacy issues [45,50].…”