Privacy Goals for the Data Lifecycle

Abstract

The introduction of Data Protection by Default and Design (DPbDD) brought in as part of the General Data Protection Regulation (GDPR) in 2018, has necessitated that businesses review how best to incorporate privacy into their processes in a transparent manner, so as to build trust and improve decisions around privacy best practice. To address this issue, this paper presents a 7-stage data lifecycle, supported by nine privacy goals that together, will help practitioners manage data holdings throughout data lifecycle. The resulting data lifecycle (7-DL) was created as part of the Ideal-Cities project, a Horizon-2020 Smart-city initiative, that seeks to facilitate data re-use and/or repurposed. We evaluate 7-DL through peer review and an exemplar worked example that applies the data lifecycle to a real-time life logging fire incident scenario, one of the Ideal-Cities use cases to demonstrate the applicability of the framework.

Challenges and Enablers for GDPR Compliance: Systematic Literature Review and Future Research Directions

“…Some studies focus on the risk management approach of the GDPR, such as the development and use of the DPIA (Data Protection Impact Assessment) [82], [83], [84], [85], [86], [87], [88] and on vulnerabilities and threats in international transfers via electronic payment wallets [89].…”

Legislative Conception for the Special Protection of Biometric Information: A Study Based on Extraterritorial Experience

“…The PIPL's legitimacy principle mainly but not exclusively corresponds to the purpose limitation principle of the GDPR. The purpose limitations of the GDPR include that personal information is processed only for specific purposes and must not be processed beyond the purposes originally agreed with the data subject, unless consent has been obtained from the information subject [9]. However, the PIPL principle of legitimacy not only requires that the purpose of personal information processing is specific and clear, but also requires that the purpose of processing is reasonable, that is, it should be in the public interest and legitimate private interests [10].…”