Understanding the Implementation of Technical Measures in the Process of Data Privacy Compliance: A Qualitative Study

Abstract

Background: Modern privacy regulations, such as the General Data Protection Regulation (GDPR), address privacy in software systems in a technologically agnostic way by mentioning general "technical measures" for data privacy compliance rather than dictating how these should be implemented. An understanding of the concept of technical measures and how exactly these can be handled in practice, however, is not trivial due to its interdisciplinary nature and the necessary technical-legal interactions.Aims: We aim to investigate how the concept of technical measures for data privacy compliance is understood in practice as well as the technical-legal interaction intrinsic to the process of implementing those technical measures.Methods: We follow a research design that is 1) exploratory in nature, 2) qualitative, and 3) interview-based, with 16 selected privacy professionals in the technical and legal domains.Results: Our results suggest that there is no clear mutual understanding and commonly accepted approach to handling technical measures. Both technical and legal roles are involved in the implementation of such measures. While they still often operate in separate spheres, a predominant opinion amongst the interviewees is to promote more interdisciplinary collaboration.Conclusions: Our empirical findings confirm the need for better interaction between legal and engineering teams when implementing technical measures for data privacy. We posit that interdisciplinary collaboration is paramount to a more complete understanding of technical measures, which currently lacks a mutually accepted notion. Yet, as strongly suggested by our results, there is still a lack of systematic approaches to such interaction. Therefore, the results strengthen our confidence in the need for further investigations into the technical-legal dynamic of data privacy compliance.

Digital transitions in healthcare: the need for transdisciplinary research to overcome barriers of privacy enhancing technologies uptake

“…Most studies that have investigated the challenges of technology adoption in healthcare [3,5,6,8,19,22,[31][32][33][34] primarily focused on identifying these obstacles. As two key examples, Witjas-Paalberends et al [8] outlined key challenges faced by multidisciplinary teams adopting digital technologies in healthcare, including managing data variety, addressing data sharing and quality issues, implementing effective data management strategies, and overcoming a lack of big data skills.…”

“…They proposed that adopting best practices, fostering trust, and reducing conservatism in the field could accelerate the integration of advanced big-data technologies and methods into collaborative healthcare innovations. Similarly, Klymenko et al [19] emphasised the gap between academia and industry regarding PETs specifically, highlighting the need for tailored education on PETs to navigate privacy compliance complexities. Future steps involve creating learning materials and deploying e-learning platforms to bridge academia-industry gap.…”

“…The widespread adoption of PETs remains elusive, as indicated by Klymenko et al [19]. Well-known challenges in technology adoption and diffusion persist [2,6,11,16].…”

“…Well-known challenges in technology adoption and diffusion persist [2,6,11,16]. Achieving widespread adoption requires research into methods that extend beyond mere technical constraints [20,21]. The Nonadoption, Abandonment, Scale-up, Spread, and Sustainability (NASSS), based on a comprehensive review [22], describes seven key domains for assessing healthcare technologies: the condition or illness, the technology, the value proposition, the adopter system, the organisation(s), the wider context, and the interaction and mutual adaptation between all these domains over time.…”