Privacy by design is a new paradigm that promotes embedding privacy considerations throughout the development of information systems, to protect user privacy. Privacy engineering is the nascent field of research and practice that aims to realize this new paradigm systematically and efficiently, by delivering reusable elements such as methods, techniques, and tools that software and systems engineers can apply in their daily work. However, as a new field, its contributions are still scattered, and there is little information on their quantity or maturity. To bridge this gap, we have carried out a systematic mapping study to provide engineers and researchers with a snapshot of the reusable elements available for the systematic design of privacy-friendly software-based information systems. The results show that there is an emerging and growing interest in the field, being privacy patterns, the hottest research topic. However, the maturity of some of the contributions found is still low as they usually lack empirical evidence that demonstrates their benefits, which may hinder their adoption in practice. In this paper, we describe the most advanced research areas and discuss some of the gaps found, suggesting areas where researchers and funding institutions can focus their efforts.

Abstract-The Privacy by Design approach to systems engineering introduces privacy requirements in the early stages of development, instead of patching up a built system afterwards. However, 'vague', 'disconnected from technology', or 'aspirational' are some terms employed nowadays to refer to the privacy principles which must lead the development process. Although privacy has become a first-class citizen in the realm of non-functional requirements and some methodological frameworks help developers by providing design guidance, software engineers often miss a solid reference detailing which specific, technical requirements they must abide by, and a systematic methodology to follow. In this position paper, we look into a domain that has already successfully tackled these problems -web accessibility-, and propose translating their findings into the realm of privacy requirements engineering, analyzing as well the gaps not yet covered by current privacy initiatives.

Confidence in information and communication technology services and systems is crucial for the digital society which we live in, but this confidence is not possible without privacy-enhancing tools and technologies, nor without risks management frameworks that guarantee privacy, data protection, and secure digital identities. This paper provides information on ongoing and recent developments in this area in the European Union (EU) space. We start by providing an overview of EU's General Data Protection Regulation (GDPR) and proceed by identifying challenges concerning GDPR implementation, either technical or organizational. For this, we consider the work currently being done by a set of EU projects on the H2020 DS-08-2017 topic, namely BPR4GDPR, DEFeND, SMOOTH, PDP4E, PAPAYA and PoSeID-on, which address and aim at providing specific, operational solutions for the identified challenges. We briefly present these solutions and discuss the ways in which the projects cooperate and complement each other. Finally, we identify guidelines for further research.

No abstract

No abstract