privacyTracker: A Privacy-by-Design GDPR-Compliant Framework with Verifiable Data Traceability Controls

Abstract

Breach or lack of online privacy has become almost a commonplace of today's digital age, mainly due to the inability of either enforcing privacy requirements or imposing strict sanctions against violations. The current state of affairs in data privacy is at a turning point for companies operating in EU state members as the enforcement of the General Data Protection Regulation (GDPR) empowers users with control over their personal data, including regulating its disclosure, withdrawing disclosure consent at any given time and tracking their data trail. Compliance with the GDPR is mandatory and it requires signifiant amendments and/or restructuring of data processing routines undertaken by enterprises. Currently, there is no framework to support the GDPR principles. This paper proposes privacyTracker, a GDPR-compliant framework that supports basic GDPR principles including data traceability and allowing a user to get a cryptographically verifiable snapshot of his/her data trail.

GDPR Compliant Information Confidentiality Preservation in Big Data Processing

“…In particular, a study on the impact of GDPR from the London Chamber of Commerce and Industry revealed that in 2018 companies were still not prepared to abide by the privacy preservation issues prescribed by GDPR [8]. Moreover, due to the necessity to motivate users to approach GDPR-based privacy issues, some recent works deal with the problem of making friendlier the management of such issues [9,10]. In [9], authors analysed the state of the art of usability design for privacy notifications, by highlighting how approaches defined in the literature correlate to GDPR recitals, summarising them in terms of guidelines.…”

“…In [9], authors analysed the state of the art of usability design for privacy notifications, by highlighting how approaches defined in the literature correlate to GDPR recitals, summarising them in terms of guidelines. Instead, in [10], a tool named privacyTracker is presented, which aims to support basic GDPR principles, including data traceability, allowing a user to get a cryptographically verifiable snapshot of his/her data trails.…”

The Grace Period Has Ended: An Approach to Operationalize GDPR Requirements

“…Existing research has also provided concrete data protection techniques to support GDPR compliance. For example, Gjermundrød et al [8] proposed a technical framework to generate verifiable snapshots of a user's data trails and track disclosure of personal information. Bolognini and Bistolfi [24] investigated the suitability of pseudonymization as a technique to reduce individuals' privacy risks and to help data processors fulfill their data protection obligations.…”

“…Additionally, extracting requirements from legal texts and interpreting them properly is a complex and error-prone process [7]. Mapping legal obligations into software functionality is also non-trivial [8], [9]. As legal requirements are oftentimes too abstract, they may leave space for multiple interpretations.…”

Blockchain and Privacy Protection in the Case of the European General Data Protection Regulation (GDPR): A Delphi Study

“…An organization that is acting quickly to ensure compliance with the GDPR will thrive in the evolving regulatory environment, potentially also using its compliance as a marketing advantage [53]. In the way of improving existing business practices, some organizations will be able to make essential process improvements and use the standardized regulation to streamline these processes for EU and pan-EU operations for significant efficiency gains [41], [46].…”