Is Privacy by Construction Possible?

Schneider, Gerardo

doi:10.1007/978-3-030-03418-4_28

Cited by 16 publications

(13 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All of the retrieved studies were labeled as adopting a design science methodology and contributing a design and action research theory, which follows the trend of studies related to RQ2. Regarding the research type, two studies were classified as position papers [46], [47], whereas the rest were classified as solution proposals. This emphasis on solution proposals is no different than what we have observed in the studies related to the previous research questions.…”

Section: Rq3 Which State-of-the-art Re Solutions Are Available For Achieving Gdpr-compliance?mentioning

confidence: 99%

Exploring Automated GDPR-Compliance in Requirements Engineering: A Systematic Mapping Study

2021

View full text Add to dashboard Cite

The General Data Protection Regulation (GDPR), adopted in 2018, profoundly impacts information processing organizations as they must comply with this regulation. In this research, we consider GDPR-compliance as a high-level goal in software development that should be addressed at the outset of software development, meaning during requirements engineering (RE). In this work, we hypothesize that natural language processing (NLP) can offer a viable means to automate this process. We conducted a systematic mapping study to explore the existing literature on the intersection of GDPR, NLP, and RE. As a result, we identified 448 relevant studies, of which the majority (420) were related to NLP and RE. Research on the intersection of GDPR and NLP yielded nine studies, while 20 studies were related to GDPR and RE. Even though only one study was identified on the convergence of GDPR, NLP, and RE, the mapping results indicate opportunities for bridging the gap between these fields. In particular, we identified possibilities for introducing NLP techniques to automate manual RE tasks in the crossing of GDPR and RE, in addition to possibilities of using NLP-based machine learning techniques to achieve GDPR-compliance in RE.

show abstract

Section: Rq3 Which State-of-the-art Re Solutions Are Available For Achieving Gdpr-compliance?mentioning

confidence: 99%

Exploring Automated GDPR-Compliance in Requirements Engineering: A Systematic Mapping Study

2021

View full text Add to dashboard Cite

show abstract

“…Finally, for further discussion on the challenges and open problems of PbD and privacyby-construction, see Tsormpatzoudi et al (2015); Schneider (2018) and the comprehensive ENISA report by Danezis et al (2015).…”

Section: Related Workmentioning

confidence: 99%

“…When talking about privacy one does not refer to one particular property but rather to a set of properties, including wellknown security properties like confidentiality and secrecy, as well as other concepts like data minimisation (DM), privacy impact assessment (PIA), user consent, the right to be forgotten, purpose limitation, etc. But even when restricted to a specific privacy property, verifying the privacy compliance of legacy software remains a very difficult task-the problem is in general undecidable (Tsormpatzoudi et al, 2015;Schneider, 2018). We therefore advocate an alternative approach known as the Privacy by Design (PbD) principle (Cavoukian, 2012).…”

Section: Introductionmentioning

confidence: 99%

Transforming Data Flow Diagrams for Privacy Compliance (Long Version)

Alshareef,

Stucki,

Schneider

2020

Preprint

Self Cite

View full text Add to dashboard Cite

Recent regulations, such as the European General Data Protection Regulation (GDPR), put stringent constraints on the handling of personal data. Privacy, like security, is a non-functional property, yet most software design tools are focused on functional aspects, using for instance Data Flow Diagrams (DFDs). In previous work, a conceptual model was introduced where DFDs could be extended into so-called Privacy-Aware Data Flow Diagrams (PA-DFDs) with the aim of adding specific privacy checks to existing DFDs. In this paper, we provide an explicit algorithm and a proof-of-concept implementation to transform DFDs into PA-DFDs. Our tool assists software engineers in the critical but error-prone task of systematically inserting privacy checks during design (they are automatically added by our tool) while still allowing them to inspect and edit the PA-DFD if necessary. We have also identified and addressed ambiguities and inaccuracies in the high-level transformation proposed in previous work. We apply our approach to two realistic applications from the construction and online retail sectors.

show abstract

“…Indeed, privacy refers to a whole family of properties, including confidentiality, secrecy, data minimization (DM), privacy impact assessment (PIA), user consent, the right to be forgotten, purpose limitation, and more. Furthermore, even for specific properties, privacy compliance is in general undecidable [30,28].…”

Section: Introductionmentioning

confidence: 99%

Refining Privacy-Aware Data Flow Diagrams

Alshareef

Stucki

Schneider

2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Privacy, like security, is a non-functional property, yet most software design tools are focused on functional aspects, using for instance Data Flow Diagrams (DFDs). In previous work, a conceptual model was introduced where DFDs were extended into so-called Privacy-Aware Data Flow Diagrams (PA-DFDs) with the aim of adding specific privacy checks to existing DFDs. An implementation to add such automatic checks has also been developed. In this paper, we define the notion of refinement for both DFDs and PA-DFDs as a special type of structure-preserving map (or graph homomorphism). We also provide three algorithms to find, check and transform refinements, and we show that the standard diagram "transform→refine / refine→transform" commutes. We have implemented our algorithms in a proof-of-concept tool called DFD Refinery, and have applied it to realistic scenarios.

show abstract

Is Privacy by Construction Possible?

Cited by 16 publications

References 24 publications

Exploring Automated GDPR-Compliance in Requirements Engineering: A Systematic Mapping Study

Exploring Automated GDPR-Compliance in Requirements Engineering: A Systematic Mapping Study

Transforming Data Flow Diagrams for Privacy Compliance (Long Version)

Refining Privacy-Aware Data Flow Diagrams

Contact Info

Product

Resources

About