Opening the black box: Petri nets and Privacy by Design

Abstract

Building on the growing literature in algorithmic accountability, this paper investigates the use of a process visualisation technique known as the Petri net to achieve the aims of Privacy by Design. The strength of the approach is that it can help to bridge the knowledge gap that often exists between those in the legal and technical domains. Intuitive visual representations of the status of a system and the flow of information within and between legal and system models mean developers can embody the aims of the legislation from the very beginning of the software design process, while lawyers can gain an understanding of the inner workings of the software without needing to understand code. The approach can also facilitate automated formal verification of the models' interactions, paving the way for machine-assisted privacy by design and, potentially, more general 'compliance by design'. Opening up the 'black box' in this way could be a step towards achieving better algorithmic accountability.

The Evolving Path of "the Right to Be Left Alone" - When Privacy Meets Technology

“…Moreover, there is an increasing need for transparency, verification, and explainability of privacy-aware IT systems. Disclosing the source code or recurring to the use of open source is indeed a best practice, but it is not sufficient because it does not provide a proper verification instrument for the legal experts, since the gap between legal and technical languages is too big [62]. We remark that checking a source code's correctness and compliance to a given legislation corpus constitutes a notable effort even for an expert developer.…”

A comparison of system description models for data protection by design

“…Petrinets can also be used to model and analyze privacy by design [16,26]. They can be used to model the business flows and algorithms within processes, similar to an activity diagram.…”

The Long Road Toward Tracking the Trackers and De-biasing: A Consensus on Shaking the Black Box and Freeing From Bias

“…A concept that seems to focus on multiple steps of technology, its whole life cycle, is privacy-by-design. Even though its ‗name' refers to design, its interpretation, as provided in small print, footnotes, soft laws, press releases (European Commission, 2010: 17;EDPS, 2018: 4, 10) or literature (Diver & Schafer, 2017), suggests that the relevant principle (here, the protection of privacy) be embedded throughout the entire life cycle of technologies, from the early design stage to their deployment, use and ultimate disposal. Therefore, it would be reasonable and fair to suggest that ethical principles be promoted and incorporated in the many shape-determining steps of technologies.…”