Engineering privacy requirements valuable lessons from another realm

Abstract

Abstract-The Privacy by Design approach to systems engineering introduces privacy requirements in the early stages of development, instead of patching up a built system afterwards. However, 'vague', 'disconnected from technology', or 'aspirational' are some terms employed nowadays to refer to the privacy principles which must lead the development process. Although privacy has become a first-class citizen in the realm of non-functional requirements and some methodological frameworks help developers by providing design guidance, software engineers often miss a solid reference detailing which specific, technical requirements they must abide by, and a systematic methodology to follow. In this position paper, we look into a domain that has already successfully tackled these problems -web accessibility-, and propose translating their findings into the realm of privacy requirements engineering, analyzing as well the gaps not yet covered by current privacy initiatives.

PRIPARE: Integrating Privacy Best Practices into a Privacy Engineering Methodology

“…A further discussion of the translation of the accessibility requirement concepts into the privacy realm can be found in [28].…”

A Systematic Mapping Study on Privacy by Design in Software Engineering

“…[13] PbD is a software design approach that incorporates privacy requirements from the beginning and throughout the software development process, instead of considering them as an afterthought. [83] PbD is a philosophy, which 'bakes-in' privacy throughout the system development lifecycle.…”

“… specificity in its definition, its vagueness and its high level of abstraction [83] [68] [69] [56].…”

“…Figure 6 shows the number of citations of the most mentioned goals, classified by category of study. [83], [47], [35], [42], [70], [71], [67], [39], [75], [62], [66], [49], [68], [69], [72], [51], [52], [59], [73], [74], [41], [44], [56], [54], [55], [53]…”

“…14 [47], [42], [70], [39], [72], [51], [52], [59], [73], [74], [76], [54], [55], [53] Anonymize 12 [15], [35], [42], [48], [66], [40], [59], [73], [76], [41], [44], [56] Enforce 12 [83], [47], [70], [39], [72], [51], [52], [73], [74], [54], [55], [53] Separate 12 [47], [70], [39], [72], [51], [52], [73], [74], [41], [54], [55], [53] Aggregate 11…”