Analysis of Automation Potentials in Privacy Impact Assessment Processes

Zibuschka, Jan

doi:10.1007/978-3-030-42048-2_18

Cited by 6 publications

(5 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another solution for this challenge suggests the advantages of creating automated tools to decrease required time and resources [1]. Nevertheless, in several privacy requirements engineering implementations, this has yet to be explored [75], [76], which presents another challenge.…”

Section: ) Time and Resourcesmentioning

confidence: 99%

“…In the context of automation, its value in the software engineering community is well-recognized [77]. However, automation's application in privacy requirements engineering is still nascent [75], [76]. Automation can effectively describe privacy target systems, set goals, choose technical measures, and evaluate results [75], [76].…”

Section: ) Tools and Automationmentioning

confidence: 99%

See 1 more Smart Citation

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

Herwanto,

Ekaputra,

Quirchmayr

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Privacy requirements engineering is a crucial aspect of privacy engineering. It aims to integrate privacy principles into organizational and technical processes throughout the software development lifecycle. This specialized field involves various strategies, including compliance with regulatory frameworks, asset analysis, and system diagram development for threat modeling. The wide range of approaches, while beneficial in providing different perspectives, presents a significant challenge to the novice privacy engineer or developer in identifying the most effective methodologies. The lack of a single methodology highlights the need for a systematic literature review (SLR) to establish a standardized process for privacy requirements engineering that promotes consistency across different methodologies. To address this issue, we conducted a comprehensive SLR to synthesize existing privacy requirements engineering methodologies. Our analysis involved dissecting each method's processes, tasks, techniques, work products, and resources. Our review examined 40 privacy requirements engineering methodologies detailed in 50 papers, from which we extracted five key processes commonly followed in privacy requirements engineering research. We used this as the foundation for a holistic approach to facilitate the adoption of a comprehensive privacy requirements engineering process. The review also identifies ongoing challenges and suggests future directions in this field.INDEX TERMS privacy requirements engineering, privacy design engineering, privacy engineering, privacy by design

show abstract

Section: ) Time and Resourcesmentioning

confidence: 99%

Section: ) Tools and Automationmentioning

confidence: 99%

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

Herwanto,

Ekaputra,

Quirchmayr

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Some researchers suggest that the automation of some of the repetitive steps in such privacy engineering techniques could turn them into standard everyday practices [91], [92]. Automated testing tools can be used to check the security configuration of servers and communication channels and that the personal data is being collected according to specified purposes, helping organisations achieve "continuous privacy compliance" [93].…”

Section: Evaluating Privacy Engineering Practicesmentioning

confidence: 99%

Privacy Engineering in the Wild: Understanding the Practitioners’ Mindset, Organizational Aspects, and Current Practices

Iwaya

Babar

Rashid

2023

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

Privacy engineering, as an emerging field of research and practice, comprises the technical capabilities and management processes needed to implement, deploy, and operate privacy features and controls in working systems. For that, software practitioners and other stakeholders in software companies need to work cooperatively toward building privacy-preserving businesses and engineering solutions. Significant research has been done to understand the software practitioners' perceptions of information privacy, but more emphasis should be given to the uptake of concrete privacy engineering components. This research delves into the software practitioners' perspectives and mindset, organisational aspects, and current practices on privacy and its engineering processes. A total of 30 practitioners from nine countries and backgrounds were interviewed, sharing their experiences and voicing their opinions on a broad range of privacy topics. The thematic analysis methodology was adopted to code the interview data qualitatively and construct a rich and nuanced thematic framework. As a result, we identified three critical interconnected themes that compose our thematic framework for privacy engineering "in the wild": (1) personal privacy mindset and stance, categorised into practitioners' privacy knowledge, attitudes and behaviours; (2) organisational privacy aspects, such as decision-power and positive and negative examples of privacy climate; and, (3) privacy engineering practices, such as procedures and controls concretely used in the industry. Among the main findings, this study provides many insights about the state-of-the-practice of privacy engineering, pointing to a positive influence of privacy laws (e.g., EU General Data Protection Regulation) on practitioners' behaviours and organisations' cultures. Aspects such as organisational privacy culture and climate were also confirmed to have a powerful influence on the practitioners' privacy behaviours. A conducive environment for privacy engineering needs to be created, aligning the privacy values of practitioners and their organisations, with particular attention to the leaders and top management's commitment to privacy. Organisations can also facilitate education and awareness training for software practitioners on existing privacy engineering theories, methods and tools that have already been proven effective.

show abstract

“…For instance, some well-known methodologies for privacy risk analysis, i.e., LINDDUN [72] and PIAs, are also known for being time-consuming and hard to scale, especially if we think in terms of service-orientated architectures (hundreds of services). Some researchers suggest that the automation of some of the repetitive steps in such privacy engineering techniques could turn them into standard everyday practices [73], [74]. Automated testing tools can be used to check the security configuration of servers and communication channels and that the personal data is being collected according to specified purposes, helping organisations achieve "continuous privacy compliance" [75].…”

Section: Evaluating Privacy Engineering Practicesmentioning

confidence: 99%

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Iwaya¹,

Babar²,

Rashid³

2022

Preprint

View full text Add to dashboard Cite

Privacy engineering, as an emerging field of research and practice, comprises the technical capabilities and management processes needed to implement, deploy, and operate privacy features and controls in working systems. For that, software practitioners and other stakeholders in software companies need to work cooperatively toward building privacy-preserving businesses and engineering solutions. Significant research has been done to understand the software practitioners' perceptions of information privacy, but more emphasis should be given to the uptake of concrete privacy engineering components. This research delves into the software practitioners' perspectives and mindset, organisational aspects, and current practices on privacy and its engineering processes. A total of 30 practitioners from various countries and backgrounds were interviewed, sharing their experiences and voicing their opinions on a broad range of privacy topics. The thematic analysis methodology was adopted to code the interview data qualitatively and construct a rich and nuanced thematic framework. As a result, we identified three critical interconnected themes that compose our thematic framework for privacy engineering "in the wild": (1) personal privacy mindset and stance, categorised into practitioners' privacy knowledge, attitudes and behaviours; (2) organisational privacy culture, such as decision-power and positive and negative examples of privacy climate; and, (3) privacy engineering practices, such as procedures and controls concretely used in the industry. Among the main findings, this study provides many insights about the state-of-the-practice of privacy engineering, pointing to a positive influence of privacy laws (e.g., EU General Data Protection Regulation) on practitioners' behaviours and organisations' cultures. Aspects such as organisational privacy culture and climate were also confirmed to have a powerful influence on the practitioners' privacy behaviours. A conducive environment for privacy engineering needs to be created, aligning the privacy values of practitioners and their organisations, with particular attention to the leaders' and top management's commitment to privacy. Organisations can also facilitate education and awareness training for software practitioners on existing privacy engineering theories, methods and tools that have already been proven effective.

show abstract

Analysis of Automation Potentials in Privacy Impact Assessment Processes

Cited by 6 publications

References 17 publications

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

Toward a Holistic Privacy Requirements Engineering Process: Insights From a Systematic Literature Review

Privacy Engineering in the Wild: Understanding the Practitioners’ Mindset, Organizational Aspects, and Current Practices

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

Contact Info

Product

Resources

About