Top 10 Mistakes in System Design from a Privacy Perspective and Privacy Protection Goals

Abstract

Privacy requirements are often not well considered in system design. The objective of this paper is to help interested system designers in three ways: First, it is discussed how "privacy" should be understood when designing systems that take into account the protection of individuals' rights and their private spheres. Here specifically the concept of linkage control as an essence of privacy is introduced. Second, the paper presents a list of ten issues in system design collected during the daily work of a Data Protection Authority. Some of the mistakes are based on today's design of data processing systems; some belong to typical attitudes or mindsets of various disciplines dealing with system design (technology, law, economics and others). Third, it is explained how working with protection goals can improve system design: In addition to the well-known information security protection goals, namely confidentiality, integrity and availability, three complementing privacy protection goals -unlinkability, transparency and intervenability -are proposed.

Policy-Carrying Data: A Step Towards Transparent Data Sharing

“…Thus, expectations about the treatment of data must be revised to accept transparency in place of privacy, although this too cannot necessarily be assured, some of the practicalities of which are discussed in [17] . Hansen [10] sets out higher level requirements: "unlinkability when possible and desired, transparency on possible and actual linkages, and the feasibility for data subjects to exercise control or at least intervene in the processing of data." We notice "where possible": there cannot be absolute guarantees, only best efforts, hence our notion of satisficing security.…”

Security and Privacy as Hygiene Factors of Developer Behavior in Small and Agile Teams

“…These goals focus on the infrastructure and the organization as a whole. From a privacy engineering perspective new approaches [7,8] argue to integrate unlinkability, transparency, intervenability in a similar way as privacy protection goals into software engineering. Several researchers ( [9][10][11]) have identified that secure software not only requires secure algorithms but that their usage has to be fostered in software engineering processes.…”

Computer-Aided Identification and Validation of Intervenability Requirements

“…In this paper, we consider the generation of privacy requirements related to the protection goals for privacy engineering proposed by Hansen [5]. These protection goals include the classical security goals confidentiality, integrity, and availability and the privacy goals unlinkability, transparency, and intervenability.…”

“…End-users wish for more empowerment, i.e., they want to keep control of their personal data and how their data is processed by information systems. Hansen [5] summarizes this and other privacy needs into the privacy goal of intervenability. Hansen states "Intervenability aims at the possibility for parties involved in any privacy-relevant data processing to interfere with the ongoing or planned data processing.…”

“…The objective of intervenability is the application of corrective measures and counterbalances where necessary." [5] Intervenability is a complex software quality that is strongly coupled with other privacy-related goals. For example, end-users have to be sufficiently aware of how and what personal data is processed and which options exist to intervene in order to be able to exercise these options.…”