Towards a privacy debt

Abstract

This study argues the difference between security and privacy and outlines the concept of Privacy Debt as a new Technical Debt. Privacy is gaining momentum in any software system due to mandatory compliance with respect to laws and regulations. There are several types of technical debts within the umbrella of software engineering, and most of them arise during different phases of software development. Several research studies have been focussed on highlighting different types of technical debts. However, authors introduce Privacy Debt as a particular technical debt focussed on privacy management and linked to a perturbative method. Privacy must be considered not only as technical debt requirements but also at design and deployment phases, among others. In addition, this method is illustrated with a use case.

Integrating privacy debt and VSE's software developments

“…However, it is hard to measure these elements, because There is a lack of empirical evidence on measuring Technical Debt principal and interest 40 . In a previous research work, 41 we motivated the need and provided some hints on the concept. Here, we provide an approach aims to ease the PD principal calculation at each step of a development process.…”

“…Our aim is to create a generic approach, and we include the two most used privacy frameworks as example (Figure 1). In a previous work 41 we used the NIST privacy framework, but our approach is not to define a set of privacy‐related activities. Instead we want to highlight that for each software implementation activity we need to carry out a set of privacy‐related activities, and as result, we generate a PD.…”