Supporting privacy impact assessment by model-based privacy analysis

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2018, Pages 1467-1474

  Ahmadian, Amir Shayan ^a   Strüber, Daniel ^a   Riediger, Volker ^a   Jürjens, Jan ^a,b  

^a Rheinland Pfälzische Technische Universität Kaiserslautern Landau   (Germany)

^b Fraunhofer ISST   (Germany)

Author keywords

GDPR; Model based engineering; Privacy; Privacy by design; Privacy impact assessment

Indexed keywords

ABSTRACTING; DATA PRIVACY;

GDPR; GENERAL DATA PROTECTION REGULATIONS; IMPACT ASSESSMENTS; INDUSTRIAL CASE STUDY; MODEL-BASED ENGINEERING; PRIVACY AND SECURITY; SECURITY AND PRIVACY; SYSTEM DEVELOPMENT;

QUALITY CONTROL;

EID: 85048861251     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/3167132.3167288     Document Type: Conference Paper

References (34)

1. A. S. Ahmadian and J. Jürjens. 2016. Supporting Model-Based Privacy Analysis by Exploiting Privacy Level Agreements. In 2016 IEEE International Conference on Cloud Computing Technology and Science (CloudCom)
2. Amir Shayan Ahmadian, Jan Jürjens, and Daniel Strüber. 2018. Extending Model-Based Privacy Analysis for the Industrial Data Space by Exploiting Privacy Level Agreements. In Proceedings of ACM SAC Conference (SAC 18). ACM, New York, NY, USA. accepted
3. Amir Shayan Ahmadian, Sven Peldszus, Qusai Ramadan, and Jan Jürjens. 2017. Model-based privacy and security analysis with CARiSMA. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, Paderborn, Germany, September 4-8, 2017. 989-993. https://doi.org/10.1145/ 3106237.3122823
4. Amir Shayan Ahmadian, Daniel Strüber, Volker Riediger, and Jan Jürjens. 2017. Model-Based Privacy Analysis in Industrial Ecosystems. In Modelling Foundations and Applications. Springer International Publishing
5. Cloud Security Alliance. 2013. Privacy Level Agreement [V2]: A Compliance Tool for Providing Cloud Services in the European Union. (2013)
6. F. Bieker, M. Friedewald, M. Hansen, H. Obersteller, and M. Rost. 2016. A Process for Data Protection Impact Assessment Under the European General Data Protection Regulation. 21-37
7. Bundesamt für Sicherheit in der Informationstechnik. 2016. BSI-Grundschutz Katalog. (2016)
8. Commission nationale de l'informatique et des libertes. 2015. Privacy Impact Assessment-Tools. (2015)
9. G. Danezis, J.D. Ferrer, M. Hansen, J.H. Hoepman, D. Le Metayer, R. Tirtea, and S. Schiffner. 2015. Privacy and Data Protection by Design-from policy to engineering. (2015)
10. Data Protection Act. 2014. Conducting privacy impact assessments code of practice. Technical Report. Information Commissioners Office (ICO)
11. Data Protection Authorities of Greece and Germany, Clara Galan Manso, and Slawomir Gorniak. 2013. Recommendations for a methodology of the assessment of severity of personal data breaches. Technical Report. The European Union Agency for Network and Information Security
12. Mina Deng, Kim Wuyts, Riccardo Scandariato, Bart Preneel, and Wouter Joosen. 2011. A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements. Requirements Engineering 16 (2011)
13. ENISA. 2016. ENISA Threat Landscape Report 2016. Technical Report. The European Union Agency for Network and Information Security
14. R. France and B. Rumpe. 2007. Model-driven Development of Complex Software: A Research Roadmap. In 2007 Future of Software Engineering (FOSE 07)
15. J. Hoepman. 2014. Privacy Design Strategies. Springer, 446-459
16. S. H. Houmb, G. Georg, J. Jürjens, and R. B. France. 2006. An Integrated Security Verification and Security Solution Design Trade-off Analysis Approach. In Integrating Security and Software Engineering: Advances and Future Vision. Idea Group, 190-219
17. International Organization for Standardization. 2009. ISO/IEC 31000 Risk management-Principles and guidelines. Technical Report
18. International Organization for Standardization. 2013. ISO/IEC 27001 Information technology-Security techniques-Information security risk management. Technical Report
19. Jan Jürjens. 2005. Secure systems development with UML. Springer
20. J. Jürjens and G. Wimmel. 2001. Formally Testing Fail-safety of Electronic Purse Protocols. In 16th International Conference on Automated Software Engineering (ASE 2001). IEEE, 408-411
21. National Institute of Standards and Technology. 2013. Security and Privacy Controls for Federal Information Systems and Organization. (2013)
22. M.C. Oetzel, S. Spiekermann, I. Grüning, H. Kelter, and S. Mull. 2011. Privacy Impact Assessment Guideline. Technical Report. Bundesamt für Sicherheit in der Informationstechnik
23. Marie Caroline Oetzel and Sarah Spiekermann. 2014. A systematic methodology for privacy impact assessments: a design science approach. European Journal of Information Systems (2014), 126-150
24. Martin Rost. 2011. Datenschutz in 3D-Daten, Prozesse und Schutzziele in einem Modell. Datenschutz und Datensicherheit 35, 5 (2011), 351-354
25. Martin Rost and Andreas Pfitzmann. 2009. Datenschutz Schutzziele revisited. Datenschutz und Datensicherheit 33, 6 (2009), 353-358
26. Monica Scannapieco, Paolo Missier, and Carlo Batini. 2005. Data Quality at a Glance. Datenbank-Spektrum 14 (2005), 6-14
27. K. Schneider, E. Knauss, S. Houmb, S. Islam, and J. Jürjens. 2012. Enhancing Security Requirements Engineering by Organisational Learning. Requirements Engineering Journal (REJ) 17, 1 (2012), 35-56
28. Daniel J. Solove. 2006. A Taxonomy of Privacy. University of Pennsylvania Law Review 154 (2006)
29. Harald Storrle. 2017. How Are Conceptual Models Used in Industrial Software Development? A Descriptive Survey. In Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering (EASE'17)
30. The European Parliament and the Council of the Europeam Union. 1995. Directive 95/46/EC. Official Journal of the European Union (1995)
31. The European Parliament and the Council of the Europeam Union. 2016. Regulation (EU) 2016/679. Official Journal of the European Union (2016)
32. David Wright and Paul De Hert. 2012. Privacy Impact Assessment. Springer Netherlands
33. David Wright and Kush Wadhwa. 2013. Introducing a privacy impact assessment policy in the EU member states. International Data Privacy Law 3 (2013), 13
34. David Wright, Kush Wadhwa, Paul De Hert, and Dariusz Kloza. 2011. A Privacy Impact Assessment Framework for Data Protection and Privacy Rights. Technical Report