Engineering Privacy by Design: Are engineers ready to live up to the challenge?

Abstract

Organizations struggle to comply with legal requirements as well as customers' calls for better data protection. On the implementation level, incorporation of privacy protections in products and services depends on the commitment of the engineers who design them. We interviewed six senior engineers, who work for globally leading IT corporations and research institutions, to investigate their motivation and ability to comply with privacy regulations. Our findings point to a lack of perceived responsibility, control, autonomy, and frustrations with interactions with the legal world. While we increasingly call on engineers to go beyond functional requirements and be responsive to human values in our increasingly technological society, we may be facing the dilemma of asking engineers to live up to a challenge they are currently not ready to embrace. ARTICLE HISTORY

Perceptions of ICT Practitioners Regarding Software Privacy

“…The main findings of this research were: (a) ICT practitioners' perception regarding software privacy and privacy requirements corroborates with existing research [13], as software developers do not consider themselves fit to develop/implement this activity assuredly; (b) ICT practitioners' knowledge of the LGPD, to be implemented in 2020, is not sufficient for the development of their activities in projects in which they work; (c) The organizational environment interferes with privacy practices; (d) ICT practitioners believe that changes proposed by LGPD will impact the activities of the requirements elicitation and development phases; (e) There are organizations in which ICT practitioners have not been informed about LGPD and its implementation or possible necessary changes in their current and future systems.…”

“…Protecting the private data included in software systems is a complicated issue that encompasses several factors: legal regulations and restrictions, international standards, methodological support for developing systems in compliance with those regulations and restrictions, organizational environment, developer perceptions, and technologies [3,13,14]. It was possible to find some studies in the literature that highlight how privacy can be impaired or protected depending on the developed system design [21].…”

“…However, it is still unclear how effective these proposed models and guidelines are, and what are the possible limitations for implementing privacy in software engineering practice. Some authors identify the organizational climate (and its relationship to privacy) as a factor influencing the behavior of software developers in implementing privacy in the development of software products [3,13]. Organizations that promote their privacy, supervise, adopt educational and communication means to ensure that employees are conscious of and adhere to the organizational privacy policy, create an organizational climate of privacy awareness, enabling the implementation of privacy in their processes and products [3].…”

“…Data privacy violations can be prevented if privacy requirements are properly elicited during the early stages of software development, that is, in the specification phase of functional and non-functional requirements. Although much work has been developed proposing methodologies for privacy requirements' elicitation [4][5][6][7][8][9][10][11][12], we found few works in the literature that have conducted empirical studies to describe how the software industry faces problems related to software development teams perceptions of system privacy [3,13,14], as well as what knowledge these professionals have, in order to perform correct implementations of these requirements along with the compliance with current legislation [13].…”

Privacy-Preserving Reengineeringof Model-View-Controller ApplicationArchitectures Using Linked Data

“…The challenge concerns Privacy by Design (PbD) principles, which consider privacy as an essential property to be considered during the design phase and throughout the entire engineering lifecycle [22]. Engineers have to go beyond functional requirements and be especially responsive to PbD aspects when engineering software artefacts that deal with personal data [4]. Since confidentiality concerns ethical and legal aspects that are beyond the scope of this paper, in the following we focus on the technical aspects related with data privacy preservation of software systems.…”