Will They Use It or Not? Investigating Software Developers’ Intention to Follow Privacy Engineering Methodologies

Abstract

With the increasing concerns over privacy in software systems, there is a growing enthusiasm to develop methods to support the development of privacy aware software systems. Inadequate privacy in software system designs could result in users losing their sensitive data, such as health information and financial information, which may cause financial and reputation loss. Privacy Engineering Methodologies (PEMs) are introduced into the software development processes with the goal of guiding software developers to embed privacy into the systems they design. However, for PEMs to be successful it is imperative that software developers have a positive intention to use PEMs. Otherwise, developers may attempt to bypass the privacy methodologies or use them partially and hence develop software systems that may not protect user privacy appropriately. To investigate the factors that affect software developers’ behavioural intention to follow PEMs, in this article, we conducted a study with 149 software developers. Findings of the study show that the usefulness of the PEM to the developers’ existing work to be the strongest determinant that affects software developers’ intention to follow PEMs. Moreover, the compatibility of the PEM with their way of work and how the PEM demonstrates its results when used were also found to be significant. These findings provide important insights in understanding the behaviour of software developers and how they perceive PEMs. The findings could be used to assist organisations and researchers to deploy PEMs and design PEMs that are positively accepted by software developers.

Privacy Champions in Software Teams: Understanding Their Motivations, Strategies, and Challenges

“…In addition to design and code reviews, to incorporate privacy considerations into formal processes, our fndings suggest using verifed libraries that do not contain privacy threats as well as tools that help to annotate data sets, map data fows, and automate the detection of privacy threats. Such tools should be practically useful and efective, and save developers' time without introducing additional burden [61]. Since security tools are already commonly used in the organisations, the new privacy features can be incorporated into those existing tools to further facilitate adoption.…”

I’m all ears! Listening to software developers on putting GDPR principles into software development practice

“…Software applications, which are developed without the ability to preserve privacy, are likely to be affected by data breaches [4]. Previous research has revealed that software developers may not adhere to these data privacy principles when implementing privacy-preserving software systems [10][11][12][13].…”

Privacy Engineering Meets Software Engineering. On the Challenges of Engineering Privacy ByDesign

“…We first identify three challenges that the agile and services shift in software engineering practices described in the previous Section II raises for methodological works and proposals for engineering privacy by design. A few recent studies show the impediments that software developers experience and/or express towards adopting privacy engineering methodologies in their work [48], [86], [87], [94]. Prominently, incompatibility between privacy engineering methodologies and usual development processes and a lack of demonstrable use are considered to be an obstacle to the adoption of privacy engineering methods [86], [87].…”

“…A few recent studies show the impediments that software developers experience and/or express towards adopting privacy engineering methodologies in their work [48], [86], [87], [94]. Prominently, incompatibility between privacy engineering methodologies and usual development processes and a lack of demonstrable use are considered to be an obstacle to the adoption of privacy engineering methods [86], [87]. We analyze what privacy engineering methodological works face in the current agile and services software development practices and we identify the following challenges.…”