Compliance-by-Construction ? Privacy Compliance via Model - PowerPoint PPT Presentation

Compliance-by-Construction ? Privacy Compliance via Model Transformations T. Antignac, R. Scandariato, G. Schneider Riccardo Scandariato Software Engineering Division Chalmers | University of Gothenburg riccardo.scandariato@cse.gu.se Holistic Security of www.scandariato.org Connected Vehicles

GDPR challenges… …that we often discuss with industrial parners • What does it mean? vs (for technical ppl) – How do find we are not in compliance? – How do we fix a non-compliance issue? • Lack of privacy experts • Large-scale systems (micro-services, IoT…) 2

Technical compliance to GDPR At the level of design models • Model-based ( PA-DFD ), automated T. Antignac, R. Scandariato, G. Schneider, A Privacy-Aware • Recipe Conceptual Model for Handling Personal Data , ISoLA 2016 – Where : Identify hotspots This – What : Apply model transformations paper – Why : Proven privacy properties Next paper ;) 3

Privacy principles • Purpose limitation • Retention time • Accountability of data controller • Right to erasure

Hotspots in a PA-DFD A.k.a. interactions usage collection disclosure Entity Entity Proc. (Data Subject) personal data r e retrieval c o r d i n g Data Data Store e r u subject s a X r Purpose e Retention

Constructive approach to GDPR compliance Towards proven model transformations Transformations (what) Hotspots (where) Privacy-sensitive part d,pol d Process of the design model Limit Log d d,pol r e g External External i s t pol Log r entity a Entity Customer t i i n o f n o pol pol Request P collection WiP Registration 1. Transformed model is well-formed Proof 2. Functionality is preserved 3. Privacy properties hold: ü Purpose limitation ü Accountability of data controller ü Data subject’s right to change 6

TLDR ;) Technical definition of (GDPR) compliance @ design (I know, I know… it’s not the entire GDPR) Automation for compliance-by-construction (yes, yes… the model might become a mess) 7

Questions ? riccardo.scandariato@cse.gu.se www.scandariato.org 8