Designing Auditable Privacy Controls From Regulatory Requirements A Product-Level Perspective
DOI:
https://doi.org/10.29284/hjmkt232Keywords:
Auditable privacy controls; Privacy engineering; Regulatory compliance; Accountability mechanisms; Software system architecture.Abstract
The expanding global scope of information protection policies has transformed the concept of privacy from terms associated with policy to a technical system property embedded within software components. Regulation regimes in the modern world are focusing on accountability, and organizations have not only to abide with the privacy requirements but also exhibit compliance with verifiable technical evidence. Although much has already been done in the field of privacy engineering research, the overwhelming majority of the current solutions focus on policy enforcement, and the issue of auditability is not given priority. Consequently, a large number of software systems are still incapable of producing consistent, machine verifiable audit evidence in changing product environments. The article is a product-level synthesis of privacy engineering research on the design of auditable privacy controls. Based on the literature on formal policy modelling, accountability, and data provenance, logging infrastructures, and compliance conscious software architecture, the study has established inherent gaps between regulatory requirements and generated system-level evidence. In order to fill these gaps, this paper proposes the Auditability-First Privacy Engineering Framework (APEF), a product-level architecture, which transforms regulatory requirements into enforceable controls and managed audit evidence pipelines. The framework consists of regulatory semantic modelling, enforcement instrumentation, canonical audit evidence schema and version sensitive compliance ledger to facilitate longitudinal auditability. The results show that auditability should be regarded as a quantifiable system attribute but not a by-product of compliance procedures. Evidence-generation mechanism-based systems demonstrate much better audit preparedness, lower compliance latency, and resiliency to regulatory review. This work provides a single architectural framework, quantitative auditability parameters, and a reference architecture of the implementation of auditable privacy controls in contemporary software products.
References
[1] European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88.
[2] Greenleaf, G. (2018). Global data privacy laws 2017: 120 national data privacy laws, including Indonesia and Turkey. Privacy Laws & Business International Report, 145, 10–13.
[3] Gellert, R. (2018). Understanding the notion of risk in the General Data Protection Regulation. Computer Law & Security Review, 34(2), 279–288.
[4] Weitzner, D. J., Abelson, H., Berners-Lee, T., Feigenbaum, J., Hendler, J., & Sussman, G. J. (2008). Information accountability. Communications of the ACM, 51(6), 82–87.
[5] Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer.
[6] Barth, A., Datta, A., Mitchell, J. C., & Nissenbaum, H. (2006). Privacy and contextual integrity: Framework and applications. IEEE Symposium on Security and Privacy, 184–198.
[7] DeYoung, H., Garg, D., Jia, L., Kaynar, D., & Datta, A. (2010). Experiences in the logical specification of the HIPAA and GLBA privacy laws. ACM Conference on Computer and Communications Security, 73–82.
[8] Bamberger, K. A., & Mulligan, D. K. (2015). Privacy on the Ground: Driving Corporate Behavior in the United States and Europe. MIT Press.
[9] Jagadish, H. V., et al. (2014). Big data and its technical challenges. Communications of the ACM, 57(7), 86–94.
[10] Antignac, T., et al. (2018). Designing privacy-aware systems: A formal approach. Journal of Computer Security, 26(2), 259–300.
[11] DeYoung, H., Garg, D., Jia, L., Kaynar, D., & Datta, A. (2010). Experiences in the logical specification of the HIPAA and GLBA privacy laws. Proceedings of the ACM Conference on Computer and Communications Security, 73–82.
[12] Ni, Q., Trombetta, A., Bertino, E., & Lobo, J. (2010). Privacy-aware role-based access control. ACM Transactions on Information and System Security, 13(3), 1–31.
[13] Cranor, L. F. (2002). Web privacy with P3P. IEEE Internet Computing, 6(6), 40–47.
[14] Gürses, S., Troncoso, C., & Diaz, C. (2011). Engineering privacy by design. Computers, Privacy & Data Protection, 1–25.
[15] Basin, D., Debois, S., & Hildebrandt, T. (2016). On purpose and by necessity: Compliance under the GDPR. Financial Cryptography and Data Security, 20–37.
[16] Pearson, S., Casassa Mont, M., & Kounga, G. (2012). Accountability for cloud and other future internet services. Journal of Cloud Computing, 1(1), 1–17.
[17] Koops, B. J. (2014). The trouble with European data protection law. International Data Privacy Law, 4(4), 250–261.
[18] Antignac, T., Scandariato, R., Schneider, G., & Matthijs, K. (2018). A formal approach to privacy engineering. Journal of Computer Security, 26(2), 259–300.
[19] Jagadish, H. V., et al. (2014). Big data and its technical challenges. Communications of the ACM, 57(7), 86–94.
[20] Moreau, L., et al. (2013). The PROV data model. W3C Recommendation, 1–68.
[21] Cheney, J., Chiticariu, L., & Tan, W. C. (2009). Provenance in databases. Foundations and Trends in Databases, 1(4), 379–474.
[22] Ziegeldorf, J. H., Morchon, O. G., & Wehrle, K. (2014). Privacy in the Internet of Things. IEEE Security & Privacy, 12(2), 43–51.
[23] Tschantz, M. C., et al. (2016). Towards usable privacy policies. Proceedings on Privacy Enhancing Technologies, 2016(3), 151–169.
[24] Becker, C., et al. (2021). Data protection engineering in practice. IEEE Software, 38(2), 78–85.
[25] Pulls, T., et al. (2022). Integrating privacy into DevOps. IEEE Security & Privacy, 20(1), 36–45.
[26] Bieker, F., et al. (2016). A process for data protection impact assessment. IEEE Security & Privacy Workshops, 1–8.
[27] Edwards, L., & Veale, M. (2017). Slave to the algorithm? Duke Law & Technology Review, 16, 18–43.
[28] Breaux, T. D., & Antón, A. I. (2008). Analyzing regulatory rules for privacy and security requirements. IEEE Transactions on Software Engineering, 34(1), 5–20.
[29] Maxwell, J. C., Antón, A. I., Swire, P. P., & Riaz, M. (2014). A legal cross-references taxonomy for identifying conflicting software requirements. Requirements Engineering, 19(2), 95–114.
[30] Pardo, R., & Siemens, G. (2014). Ethical and privacy principles for learning analytics. British Journal of Educational Technology, 45(3), 438–450.
[31] Hasan, R., Sion, R., & Winslett, M. (2009). Preventing history forgery with secure provenance. ACM Transactions on Storage, 5(4), 1–43.
[32] Cavoukian, A. (2010). Privacy by design: The 7 foundational principles. Identity in the Information Society, 3(2), 211–221.
[33] Becker, C., Küppers, F., & Pohl, K. (2019). Runtime verification of data protection requirements. Information and Software Technology, 110, 1–18.
[34] Kerschbaum, F., et al. (2018). Privacy-preserving data processing with secure audit. IEEE Transactions on Dependable and Secure Computing, 15(4), 678–691.
[35] Becker, C., et al. (2020). Engineering auditability for data protection compliance. IEEE Software, 37(6), 56–63.
[36] Thomborson, C., et al. (2019). Linking legal requirements to software artifacts. Requirements Engineering, 24(4), 455–472.
[37] Butin, D., Chicote, J., & Oesch, S. (2017). Log management and compliance. Computers & Security, 70, 287–302.
[38] Zimmermann, O., et al. (2020). Microservices tenets. IEEE Software, 37(1), 56–63.
[39] Accorsi, R. (2014). Automated privacy audits to complement the accountability principle. Journal of Computer Security, 22(6), 873–918.
[40] Ghanavati, S., Amyot, D., & Peyton, L. (2011). Compliance analysis based on a goal-oriented requirement language. Requirements Engineering, 16(1), 17–37.
[41] Macko, P., & Seltzer, M. (2012). A general-purpose provenance library. USENIX Conference on File and Storage Technologies, 43–56.
[42] Gürses, S., & Del Alamo, J. M. (2016). Privacy engineering: Shaping an emerging field of research and practice. IEEE Security & Privacy, 14(2), 40–46.
[43] Veale, M., & Edwards, L. (2018). Clarity, surprises, and further questions in the GDPR. Computer Law & Security Review, 34(2), 225–236.
[44] Colombo, M., Ferrari, E., & Carminati, B. (2016). Privacy-aware access control for big data. IEEE Transactions on Knowledge and Data Engineering, 28(5), 1311–1324.
[45] Bennett, C. J., & Raab, C. D. (2018). The Governance of Privacy: Policy Instruments in Global Perspective (2nd ed.). MIT Press.
[46] Weitzner, D. J., Hendler, J., Berners-Lee, T., & Sussman, G. J. (2006). Creating a policy-aware web: Discretionary, rule-based access for the World Wide Web. IEEE Web Intelligence, 1–8.
[47] Koops, B. J., & Leenes, R. (2014). Privacy regulation cannot be hardcoded. International Review of Law, Computers & Technology, 28(2), 159–171.
[48] Spiekermann, S., & Cranor, L. F. (2009). Engineering privacy. IEEE Transactions on Software Engineering, 35(1), 67–82.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
