Compliance-by-Construction ? Privacy Compliance via Model - - PowerPoint PPT Presentation

Compliance-by-Construction ?

Riccardo Scandariato

Software Engineering Division Chalmers | University of Gothenburg

riccardo.scandariato@cse.gu.se www.scandariato.org

Privacy Compliance via Model Transformations

• T. Antignac, R. Scandariato, G. Schneider

Holistic Security of Connected Vehicles

GDPR challenges…

• What does it mean?

(for technical ppl)

– How do find we are not in compliance? – How do we fix a non-compliance issue?

• Lack of privacy experts
• Large-scale systems (micro-services, IoT…)

2

…that we often discuss with industrial parners

vs

Technical compliance to GDPR

• Model-based (PA-DFD), automated
• Recipe

– Where: Identify hotspots – What: Apply model transformations – Why: Proven privacy properties

3

At the level of design models

• T. Antignac, R. Scandariato, G.

Schneider, A Privacy-Aware Conceptual Model for Handling Personal Data, ISoLA 2016 This paper Next paper ;)

Privacy principles

• Purpose limitation
• Retention time
• Accountability of data controller
• Right to erasure

Hotspots in a PA-DFD

A.k.a. interactions

Proc. Entity (Data Subject) Entity Data Store usage collection disclosure r e c

• r

d i n g retrieval e r a s u r e X personal data Data subject Purpose Retention

Constructive approach to GDPR compliance Towards proven model transformations

Privacy-sensitive part

• f the design model

Transformations (what)

6

1. Transformed model is well-formed 2. Functionality is preserved 3. Privacy properties hold: ü Purpose limitation ü Accountability of data controller ü Data subject’s right to change

Proof Hotspots (where)

Customer Registration

collection

r e g i s t r a t i

• n

i n f

• External

entity

d

Limit Request

pol

Log Log

pol d,pol d,pol d pol

P

External Entity Process

WiP

TLDR ;)

Technical definition of (GDPR) compliance @ design

(I know, I know… it’s not the entire GDPR)

Automation for compliance-by-construction

(yes, yes… the model might become a mess)

7

Questions ?

8

riccardo.scandariato@cse.gu.se www.scandariato.org