A model-based approach to support privacy compliance
Information and Computer Security
ISSN: 2056-4961
Article publication date: 8 October 2018
Issue publication date: 8 October 2018
Abstract
Purpose
Concerns over data-processing activities that may lead to privacy violations or harms have motivated the development of legal frameworks and standards. Further, software engineers are increasingly expected to develop and maintain privacy-aware systems that both comply with such frameworks and standards and meet reasonable expectations of privacy. This paper aims to facilitate reasoning about privacy compliance, from legal frameworks and standards, with a view to providing necessary technical assurances.
Design/methodology/approach
The authors show how the standard extension mechanisms of the UML meta-model might be used to specify and represent data-processing activities in a way that is amenable to privacy compliance checking and assurance.
Findings
The authors demonstrate the usefulness and applicability of the extension mechanisms in specifying key aspects of privacy principles as assumptions and requirements, as well as in providing criteria for the evaluation of these aspects to assess whether the model meets these requirements.
Originality/value
First, the authors show how key aspects of abstract privacy principles can be modelled using stereotypes and tagged values as privacy assumptions and requirements. Second, the authors show how compliance with these principles can be assured via constraints that establish rules for the evaluation of these requirements.
Keywords
Acknowledgements
The authors would like to thank the anonymous reviewers for their helpful comments.
Citation
Alshammari, M. and Simpson, A. (2018), "A model-based approach to support privacy compliance", Information and Computer Security, Vol. 26 No. 4, pp. 437-453. https://doi.org/10.1108/ICS-11-2017-0084
Publisher
:Emerald Publishing Limited
Copyright © 2018, Emerald Publishing Limited