Privacy Shielding by Design — A Strategies Case for Near-Compliance

Abstract

Abstract-Changes to the EU-US agreements on transatlantic data transmission are accepted. With the updates leading to an adequacy decision for the Privacy Shield, the European Commission further advances US adherence to the General Data Protection Regulation. The regulation comes with increasing territorial scope for the processing of personal data of persons in the EU, and includes the risk of substantial fines. Soon, a Privacy Shield self-certification will be necessary for US organizations which process EU data. Compliance with these requirements may be assisted by privacy by design. In particular, a recent approach to this uses privacy design strategies. Our paper takes this approach and applies it to the Privacy Shield and its suggested changes. It then explores a case study within scope of the Privacy Shield to demonstrate how to apply privacy by design using strategies.

A Systematic Mapping Study on Privacy by Design in Software Engineering

“…[65] PbD is an approach for software development which protects privacy from the early/concept stages of the software development life cycle. [39] PbD means embedding privacy proactively in the design process of a technical system by using data minimization techniques. [62] PbD is moving from a design (in which the privacy requirements of an information system have been elicited) to an implementation that fulfills those requirements.…”

“…Figure 6 shows the number of citations of the most mentioned goals, classified by category of study. [83], [47], [35], [42], [70], [71], [67], [39], [75], [62], [66], [49], [68], [69], [72], [51], [52], [59], [73], [74], [41], [44], [56], [54], [55], [53]…”

“…14 [47], [42], [70], [39], [72], [51], [52], [59], [73], [74], [76], [54], [55], [53] Anonymize 12 [15], [35], [42], [48], [66], [40], [59], [73], [76], [41], [44], [56] Enforce 12 [83], [47], [70], [39], [72], [51], [52], [73], [74], [54], [55], [53] Separate 12 [47], [70], [39], [72], [51], [52], [73], [74], [41], [54], [55], [53] Aggregate 11…”

“…A number of the primary papers describe privacy patterns on the basis of an analysis of privacy laws and regulations. Colesky and Ghanavati [39] focus on the analysis of privacy legislation and the extent to which design strategies and patterns can support the PbD approaches. Suphakul and Senivongse [46] propose a set of design patterns that describe information about privacy principles.…”

Legal Linked Data Ecosystems and the Rule of Law

“…Working on the modelling strategy, Colesky and Ghanavati (2016) have proposed to add a further level of abstraction that they define as tactic. Strategy "specifies a distinct architectural goal in privacy by design to achieve a certain level of privacy protection", while tactics is "an approach to privacy by design which contributes to the goal of an overarching privacy design strategy".…”