The perspective of Brazilian software developers on data privacy

Peixoto, Mariana Maia; Ferreira, Dayse; Cavalcanti, M. A. Q.; Silva, Carla T. L. L.; Vilela, Jéssyka; Araújo, João; Gorschek, Tony

doi:10.1016/j.jss.2022.111523

Cited by 10 publications

(8 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other researchers have looked into the personal factors that influence developers' perceptions, and interpretation of privacy requirements in software development [7], [52]. Drawing significantly from the work of Hadar et al [6], this interview-based study reveals nine personal factors were found to positively and negatively affect developers [7].…”

Section: Various Software Professionalsmentioning

confidence: 87%

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Iwaya¹,

Babar²,

Rashid³

2022

Preprint

View full text Add to dashboard Cite

Privacy engineering, as an emerging field of research and practice, comprises the technical capabilities and management processes needed to implement, deploy, and operate privacy features and controls in working systems. For that, software practitioners and other stakeholders in software companies need to work cooperatively toward building privacy-preserving businesses and engineering solutions. Significant research has been done to understand the software practitioners' perceptions of information privacy, but more emphasis should be given to the uptake of concrete privacy engineering components. This research delves into the software practitioners' perspectives and mindset, organisational aspects, and current practices on privacy and its engineering processes. A total of 30 practitioners from various countries and backgrounds were interviewed, sharing their experiences and voicing their opinions on a broad range of privacy topics. The thematic analysis methodology was adopted to code the interview data qualitatively and construct a rich and nuanced thematic framework. As a result, we identified three critical interconnected themes that compose our thematic framework for privacy engineering "in the wild": (1) personal privacy mindset and stance, categorised into practitioners' privacy knowledge, attitudes and behaviours; (2) organisational privacy culture, such as decision-power and positive and negative examples of privacy climate; and, (3) privacy engineering practices, such as procedures and controls concretely used in the industry. Among the main findings, this study provides many insights about the state-of-the-practice of privacy engineering, pointing to a positive influence of privacy laws (e.g., EU General Data Protection Regulation) on practitioners' behaviours and organisations' cultures. Aspects such as organisational privacy culture and climate were also confirmed to have a powerful influence on the practitioners' privacy behaviours. A conducive environment for privacy engineering needs to be created, aligning the privacy values of practitioners and their organisations, with particular attention to the leaders' and top management's commitment to privacy. Organisations can also facilitate education and awareness training for software practitioners on existing privacy engineering theories, methods and tools that have already been proven effective.

show abstract

Section: Various Software Professionalsmentioning

confidence: 87%

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Iwaya¹,

Babar²,

Rashid³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…The present study sought to investigate how the fundamental principles of Privacy by Design [Cavoukian 2009] can be related to better software engineering practices, recognizing the challenges highlighted by several authors regarding the difficulty of translating these highly abstract principles into practical software development activities [Andrade et al 2022;Baldassarre et al 2020;Morales-Trujillo et al 2018;Peixoto et al 2023]. Faced with this complexity, our approach aimed to create a bridge between principles and tangible actions for developers using the 72 Privacy Patterns cataloged by the University of California [UC Berkeley School of Information 2024].…”

Section: Discussionmentioning

confidence: 99%

“…While implementing PbD principles in software projects is feasible, a significant level of abstraction remains [Andrade et al 2022;Baldassarre et al 2020;Morales-Trujillo et al 2018;Peixoto et al 2023]. PbD lacks the detailed guidance necessary for software engineers to seamlessly adopt regulations during the design and development of applications, thereby posing challenges to its effective implementation.…”

Section: Introductionmentioning

confidence: 99%

Privacy in Practice: Exploring Concrete Relationships Between Privacy Patterns and Privacy by Design Principles in Software Engineering

Andrade,

Ribeiro,

Canteri

et al. 2024

Anais Do XXVII Congresso Ibero-Americano Em Engenharia De Software (CIbSE 2024)

View full text Add to dashboard Cite

Ensuring the fulfillment of customer preferences and requirements and adherence to legal compliance have emerged as critical considerations for software development organizations. Legislation such as the Brazillian LGPD and the European Union's GDPR highlight the importance of integrating personal data privacy rights from the beginning of system development and throughout the data lifecycle, as mentioned in the fundamental principles of Privacy by Design. However, recent studies still emphasize the need for processes, methods, guides, and tools that help translate Privacy by Design principles into practical software engineering activities. In this context, this article aims to explore the integration of abstract Privacy by Design principles into tangible Software Engineering practices. To this end, a mapping was carried out between Privacy Patterns and the principles of Privacy by Design. This process translated abstract concepts into practical activities. The reliability of the mapping process among the researchers was assessed by calculating the Intraclass Correction Coefficient (ICC). The findings underscore that when software engineers apply one or more Privacy Patterns to address personal data privacy requirements, as revealed through the correlations conducted in this study, they also tend to adhere to one or more Privacy by Design principles.

show abstract

“…A junção de estudos nas Áreas de Engenharia de Software e Segurança da Informação não sendo cada vez mais demandada nos últimos anos, uma vez que leis estão impondo a implantação de medidas de segurança às empresas de tecnologia para proteger a privacidade de dados pessoais. A PCM Tool: Privacy Requirements Specification in Agile Software Development, por exemplo, foi proposta como ferramenta para dar suporte à especificação de software [21]. Os autores pontuaram que os desenvolvedores de software possuem uma dificuldade em especificar requisitos de privacidade.…”

Section: Trabalhos Relacionadosunclassified

Ensino da Adequação à LGPD no Desenvolvimento de Software através da Aprendizagem Ativa e Centrada no Discente

Saraiva,

Araújo,

Soares

2024

Anais Do IV Simpósio Brasileiro De Educação Em Computação (EDUCOMP 2024)

View full text Add to dashboard Cite

As abordagens de ensino-aprendizagem nos cursos de Engenharia de Software precisam aproximar a teoria da prática e assim, metodologias ativas e centradas no discente vêm sendo propostas e avaliadas. Ademais, demandas legislativas impõem, multidisciplinarmente, teorias, métodos e técnicas que abordem o desenvolvimento de software seguro, conforme prevê a LGPD que exige que o desenvolvimento de produtos e soluções de software considerem a privacidade de dados pessoais desde a concepção e incorpore esta prática durante toda a vida do software: Princípios de Privacy by Design e Privacy by Default. Este trabalho realizou um experimento com 142 discentes de graduação que produziram 947 artefatos ágeis – Estórias de Usuário e Cenários BDD - a partir do Inventário de Dados LGPD. Foi possível concluir que a Aprendizagem Significativa, o Pensamento Computacional e a Aprendizagem baseada em Problemas demonstraram-se apropriadas no ensino de requisitos legais para a Engenharia de Software.

show abstract

The perspective of Brazilian software developers on data privacy

Cited by 10 publications

References 31 publications

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Privacy in Practice: Exploring Concrete Relationships Between Privacy Patterns and Privacy by Design Principles in Software Engineering

Ensino da Adequação à LGPD no Desenvolvimento de Software através da Aprendizagem Ativa e Centrada no Discente

Contact Info

Product

Resources

About