DEFeND Architecture: A Privacy by Design Platform for GDPR Compliance

Abstract

The advent of the European General Data Protection Regulation (GDPR) imposes organizations to cope with radical changes concerning user data protection paradigms. GDPR, by promoting a Privacy by Design approach, obliges organizations to drastically change their methods regarding user data acquisition, management, processing, as well as data breaches monitoring, notification and preparation of prevention plans. This enforces data subjects (e.g., citizens, customers) rights by enabling them to have more information regarding usage of their data, and to take decisions (e.g., revoking usage permissions). Moreover, organizations are required to trace precisely their activities on user data, enabling authorities to monitor and sanction more easily. Indeed, since GDPR has been introduced, authorities have heavily sanctioned companies found as not GDPR compliant. GDPR is difficult to apply also for its length, complexity, covering many aspects, and not providing details concerning technical and organizational security measures to apply. This calls for tools and methods able to support organizations in achieving GDPR compliance. From the industry and the literature, there are many tools and prototypes fulfilling specific/isolated GDPR aspects, however there is not a comprehensive platform able to support organizations in being compliant regarding all GDPR requirements. In this paper, we propose the design of an architecture for such a platform, able to reuse and integrate peculiarities of those heterogeneous tools, and 2 L. Piras et al. to support organizations in achieving GDPR compliance. We describe the architecture, designed within the DEFeND EU project, and discuss challenges and preliminary benefits in applying it to the healthcare and energy domains.

DEFeND DSM: A Data Scope Management Service for Model-Based Privacy by Design GDPR Compliance

“…1. DSM components, modules and DSM Data Models (green rectangles) [12,16,17] in DSM are the Data Assessment Model (DAM) and the Data Privacy Model (DPM). DAM is produced in the Data Assessment Component (DAC), then read in the Data Privacy Analysis Component (DPAC) that in turn produces the DPM model.…”

“…DAM is produced in the Data Assessment Component (DAC), then read in the Data Privacy Analysis Component (DPAC) that in turn produces the DPM model. The DPM model is then used by other services of the DEFeND Platform, for instance from the GDPR Reporting Service [12]. Concerning DSM components and modules ( Fig.…”

“…This paper provides a novel structured framework and a toolkit that fulfils this gap of the current state of the art. The Data Scope Management (DSM) solution presented is part of the DEFeND EU Project 2 platform [12], and builds on previous work presented at [12]. In particular, this paper addresses the following Research Questions (RQs):…”

Privacy CURE: Consent Comprehension Made Easy

“…However, the focus is primarily on the architecture as opposed to the design of a usable and understandable user interface. Consent, compliance, and transparency systems [16,24,34], tools 8 and dashboards [26,5,2] are a related topic in the privacy literature as well as in industry, however, in this paper we focus primarily on the UI aspects of a consent request. Although consent request design features offered by Railean et al [25] have some promising results, the authors received inconsistent outcomes concerning the comprehension of their "privacy facts" labels which indicates a need for a reevaluation.…”

Towards an Accountable Web of Personal Information: The Web-of-Receipts

“…The on-going EU SMOOTH project [38] plans on automating compliance by combining machine learning (such as text mining) and software analysis (such as mobile apps). The DEFeND project [39] approaches the problem of enforcing Consent by creating a set of tools organisations can use to create and monitor contracts, along with providing notifications. A key component, similar to Project SPECIAL, is the detection of inconsistencies between Consent and usage of data.…”