A Systematic Mapping Study on Software Quality Control Techniques for Assessing Privacy in Information Systems

Abstract

Software Quality Control (SQC) techniques are widely used throughout the software development process with the objective of assessing and detecting anomalies that affect the quality of an information system. Privacy is one quality attribute of software systems for which several SQC techniques have been proposed in recent years. However, research has been carried out from different perspectives and, consequently, it has led to a growing body of knowledge scattered across different domains. To bridge this gap, we have carried out a systematic mapping study to provide practitioners and researchers with an overview of the state-of-the-art techniques to carry out software quality control of information systems focusing on aspects of privacy. Our results show a steady growth in the research efforts in this field. The European General Data Protection Regulation seems to have a significant influence on this growth, since 37% of techniques that focus on assessing compliance derive their assessment criteria from this legal framework. The maturity of the techniques varies between the type of technique: Formal verification techniques exhibit the lowest level of maturity while the combination of techniques has demonstrated its successful application in real-world scenarios. The latter seems a promising avenue of research as it provides better results in terms of coverage, precision and effectiveness than the application of individual, isolated techniques. In this paper, we describe the existing SQC techniques focusing on privacy and provide a suitable basis for identifying future research directions.

GDPR Compliance Assessment for Cross-Border Personal Data Transfers in Android Apps

“…A recent systematic literature mapping [17] states that there is growing interest in assessing GDPR compliance of software systems, evidenced by the 37% of techniques that deal with them. Compliance with the GDPR is crucial for organizations because a privacy breach can entail significant financial penalties [45].…”

“…These SLDs are hosted on servers located in 13 different countries, 6 EU countries and 7 non-EU countries hosting 19 and 106 domains respectively. A few domains (8) are hosted on servers located in both EU and non-EU countries 17 . Figure 10 details the number of apps that fulfil the criteria leading to cross-border transfers discussed in Section III.…”

“…Details on selected apps can be found in the metadata_ds.csv available at http://dx.doi.org/10.17632/ws6cx9p65d.116 The corpus is available at https://github.com/PrivApp/IT100-Corpus17 Details can be found in the replication package available at http://dx.doi.org/10.17632/ws6cx9p65d.1.…”

How BIM Contributes to a Building’s Energy Efficiency throughout Its Whole Life Cycle: Systematic Mapping

“…Based on [76,77], the following types of validity were identified and discussed in this study: internal, external, construct and conclusion validity. Although we carefully followed the SM process to minimize any threats to the validity of the results and conclusions drawn, we encountered some issues, which are discussed below.…”

Privacy Assessment in Android Apps: A Systematic Mapping Study

“…As far as we know, there are no recent secondary studies focused on the intersection of the three domains of our scope (i.e., privacy, software quality, and Android applications). The related work is either outdated [6,7] or has a different scope, e.g., by focusing on security instead of privacy [9,10] or missing the overall set of quality assessment techniques we have covered [46,47]. We analyse these studies next.…”