A recent renaissance in privacy law

Kaminski, Margot E.

doi:10.1145/3411049

Cited by 16 publications

(10 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Non-functional requirements, in turn, primarily regard the well-known challenge of ensuring practical applicability and fieldability of PETs [24,25]. In line with other work directed at comparable goals (esp.…”

Section: Gdpr References Summarymentioning

confidence: 84%

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

Grünewald,

Wille,

Pallas

et al. 2021

Preprint

View full text Add to dashboard Cite

Transparency -the provision of information about what personal data is collected for which purposes, how long it is stored, or to which parties it is transferred -is one of the core privacy principles underlying regulations such as the GDPR. Technical approaches for implementing transparency in practice are, however, only rarely considered. In this paper, we present a novel approach for doing so in current, RESTful application architectures and in line with prevailing agile and DevOps-driven practices. For this purpose, we introduce 1) a transparency-focused extension of OpenAPI specifications that allows individual service descriptions to be enriched with transparency-related annotations in a bottomup fashion and 2) a set of higher-order tools for aggregating respective information across multiple, interdependent services and for coherently integrating our approach into automated CI/CD-pipelines. Together, these building blocks pave the way for providing transparency information that is more specific and at the same time better reflects the actual implementation givens within complex service architectures than current, overly broad privacy statements.

show abstract

Section: Gdpr References Summarymentioning

confidence: 84%

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

Grünewald,

Wille,

Pallas

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Many states, such as Virginia, are now following suit in passing CCPA-like laws [23]. If these laws are to succeed, policy makers and regulators must exercise due diligence in addressing vagueness and ambiguity through not just legislation but also enforcement, as suggested by the apparent non-compliance we observed.…”

Section: Implications For Policy Makersmentioning

confidence: 99%

“…[33] estimated that a typical Internet user who carefully reads the privacy policies on the websites that they frequent would need to spend, on average, 244 hours doing so annually. Furthermore, consumers usually have few choices for the entities that they can do business with; combined with the "take it or leave it" approach to privacy controls [15] that has been adopted by many businesses, this implies that the element of choice in notice-and-choice is ultimately illusory [23,44].…”

Section: Background 21 the "Notice-and-choice" Paradigmmentioning

confidence: 99%

See 1 more Smart Citation

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

Chen,

Fang,

Norton

et al. 2021

Preprint

View full text Add to dashboard Cite

Vagueness and ambiguity in privacy policies threaten the ability of consumers to make informed choices about how businesses collect, use, and share their personal information. The California Consumer Privacy Act (CCPA) of 2018 was intended to provide Californian consumers with more control by mandating that businesses (1) clearly disclose their data practices and (2) provide choices for consumers to opt out of specific data practices. In this work, we explore to what extent CCPA's disclosure requirements, as implemented in actual privacy policies, can help consumers to answer questions about the data practices of businesses. First, we analyzed 95 privacy policies from popular websites; our findings showed that there is considerable variance in how businesses interpret CCPA's definitions. Then, our user survey of 364 Californian consumers showed that this variance affects the ability of users to understand the data practices of businesses. Our results suggest that CCPA's mandates for privacy disclosures, as currently implemented, have not yet yielded the level of clarity they were designed to deliver, due to both vagueness and ambiguity in CCPA itself as well as potential non-compliance by businesses in their privacy policies. CCS CONCEPTS• Social and professional topics → Privacy policies; • Security and privacy → Privacy protections; Usability in security and privacy; • Applied computing → Law.

show abstract

“…For reasons similar to the ones listed in [38] -human readability, robustness, broad programming language and tooling support, and resource efficiency -we opted for JSON/JSON Schema as the default representation format. 20 In the following, we first present the core language implementation. In a second step, we then demonstrate how this implementation can be extended.…”

Section: Technical Implementationmentioning

confidence: 99%

TILT: A GDPR-Aligned Transparency Information Language and Toolkit for Practical Privacy Engineering

Grünewald,

Pallas

2020

Preprint

View full text Add to dashboard Cite

In this paper, we present TILT, a transparency information language and toolkit explicitly designed to represent and process transparency information in line with the requirements of the GDPR and allowing for a more automated and adaptive use of such information than established, legalese data protection policies do.We provide a detailed analysis of transparency obligations from the GDPR to identify the expressiveness required for a formal transparency language intended to meet respective legal requirements. In addition, we identify a set of further, non-functional requirements that need to be met to foster practical adoption in real-world (web) information systems engineering. On this basis, we specify our formal language and present a respective, fully implemented toolkit around it. We then evaluate the practical applicability of our language and toolkit and demonstrate the additional prospects it unlocks through two different use cases: a) the inter-organizational analysis of personal data-related practices allowing, for instance, to uncover data sharing networks based on explicitly announced transparency information and b) the presentation of formally represented transparency information to users through novel, more comprehensible, and potentially adaptive user interfaces, heightening data subjects' actual informedness about data-related practices and, thus, their sovereignty.Altogether, our transparency information language and toolkit allow -differently from previous work -to express transparency information in line with actual legal requirements and practices of modern (web) information systems engineering and thereby pave the way for a multitude of novel possibilities to heighten transparency and user sovereignty in practice.

show abstract

A recent renaissance in privacy law

Abstract: Considering the recent increased attention to privacy law issues amid the typically slow pace of legal change.

Cited by 16 publications

References 7 publications

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

TIRA: An OpenAPI Extension and Toolbox for GDPR Transparency in RESTful Architectures

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

TILT: A GDPR-Aligned Transparency Information Language and Toolkit for Practical Privacy Engineering

Contact Info

Product

Resources

About