Transforming Data Flow Diagrams for Privacy Compliance (Long Version)
Hanaa Alshareef, Sandro Stucki, Gerardo Schneider
备注：
This is an extended version of a paper to be presented at MODELSWARD 2021. It contains a more detailed description of our transformation algorithm and an additional case study, which were not included in the conference paper
Recent regulations, such as the European General Data Protection Regulation (GDPR), put stringent constraints on the handling of personal data. Privacy, like security, is a non-functional property, yet most software design tools are focused on functional aspects, using for instance Data Flow Diagrams (DFDs). In previous work, a conceptual model was introduced where DFDs could be extended into so-called Privacy-Aware Data Flow Diagrams (PA-DFDs) with the aim of adding specific privacy checks to existing DFDs. In this paper, we provide an explicit algorithm and a proof-of-concept implementation to transform DFDs into PA-DFDs. Our tool assists software engineers in the critical but error-prone task of systematically inserting privacy checks during design (they are automatically added by our tool) while still allowing them to inspect and edit the. PA-DFD if necessary. We have also identified and addressed ambiguities and inaccuracies in the high-level transformation proposed in previous work. We apply our approach to two realistic applications from the construction and online retail sectors.
Comparing and Conceptualizing Data Protection Requirements Worldwide for Privacy Regulatory Compliance
University of Luxembourg（卢森堡大学）；University of Twente（特温特大学）；FINATRAX, SnT, University of Luxembourg（卢森堡大学科学和技术学院 FINATRAX）；Polytechnic University of Valencia（瓦伦西亚理工大学）；Escuela de Ingeniería Informática, Universidad de Valparaíso（瓦尔帕莱索大学计算机工程学院）
Experimental Evaluation of a Checklist-Based Inspection Technique to Verify the Compliance of Software Systems with the Brazilian General Data Protection Law
AI-enabled Automation for Completeness Checking of Privacy Policies
SnT Centre for Security, Reliability, and Trust, University of Luxembourg（卢森堡大学SnT安全、可靠性与信任中心）；University of Ottawa（渥太华大学）；Texas A&M University – Central Texas（得克萨斯农工大学中央得克萨斯分校）
