Approaches to requirements identification and specification

Privacy and data protection requirements emanate from several sources. These include regulatory, industrial and user/stakeholders’ needs. Apart from the GDPR, several other instruments of specific application impose privacy and data protection-related requirements. In addition, industrial standards are relevant for extracting requirements relating to privacy and data protection. System developers are thus expected to analyse the specific environment that their system will operate and identify specific regulations that apply to such environment to extract these requirements. In the smashHit project, for example, part of the tools developed in the project aims to address data subjects’ consent management within the automobile ecosystem, involving stakeholders such as data subjects, auto manufacturers, insurance, and others. Given the involvement of personal data, the project’s legal requirements stem from the GDPR and other relevant sources within this ecosystem.

Identifying privacy and data protection requirements require a systematic and multi-disciplinary approach. Generally, this involves several consultations with the relevant stakeholders to extract the needs of each stakeholder. In cases where there are defined project proposals, such documents provide valuable information and should be consulted during the requirements identification. For example, EU projects Grant Agreements contain various requirements, including privacy and data protection requirements. When the initial requirements are collected, there is also a need to analyse them thoroughly and collaboratively. Depending on the outcome, further consultations could be organised to agree on differences and obtain relevant feedback.

Translating data protection requirements into executable actions: the value of TOMs

Having defined the privacy and data protection requirements from multiple sources, the next step is to ensure that these requirements are executed in the system’s architectural design. Adopting a P/DPbD strategy is vital at this stage of the process. A key instrument in system development according to the principles of P/DPbD is the implementation of “appropriate technical and organisational measures which are designed to implement data-protection principles […] in an effective manner and to integrate the necessary safeguards into the processing in order to […] protect the rights of data subjects” (Art. 25 (1) GDPR).

To translate these privacy and data protection requirements into executable actions, smashHit utilised the Data Protection Management Process according to the Standard Data Protection Model (SDM)[2]. The SDM is a systematic approach to implement GDPR requirements in practice and has been acknowledged by the supervisory authorities. It uses “protection goals” to systematise the data protection requirements. This approach allows the project to identify specific technical and organisational measures (TOMs) or privacy-enhancing technologies (PET) to be implemented to mitigate the identified risks associated with the proposed data processing, or to keep the risks on an acceptable level. Concretely, the SDM first records the legal requirements of the GDPR and then assigns them to the following protection goals:

• Data Minimisation (Art. 5 para. 1 lit. c GDPR);
• Availability;
• Integrity (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Confidentiality (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Transparency (Art. 5 para. 1 lit. a GDPR);
• Unlinkability (Art. 5 para. 1 lit. b GDPR) and
• Intervenability [3].

Each protection goal has its scope and purpose. In addition, there is the protection goal of “Resilience” which aims at sufficient preparation of systems and processes for events that cause disruptions to regular processes. In addition, it is essential to note the impact of the system’s interaction with other external systems and point out the privacy implications and requirements for the external system. This is necessary for maintaining end-to-end protection. Furthermore, the technical and organisational measures to ensure data security must be well planned considering the system’s operational environment.

Finally, it is necessary to trace privacy and data protection requirements during the testing and implementation of the system. Establishing a feedback framework will assist in tracking how these requirements are executed. When the system is finally developed and running, a privacy or data protection audit becomes necessary to check the scope of implementation in operation. In the smashHit project, this is addressed by utilizing the Data Protection Management Cycle (DPM cycle) [4] which covers the whole process of data protection management including the evaluation of measures taken and the implementation of necessary improvements.

Conclusion

Projects like smashHit that involve the processing of personal data must endeavour to extract privacy and data protection requirements systematically and holistically. Data protection by design is a principle, set out in the GDPR, that promotes privacy and data protection compliance from the start. It is an alternative to bolting privacy considerations on as an after-thought or ignoring them altogether [5]. Adopting a P/DPbD approach like the SDM allows to identify all personal data sets and apply data protection principles through the selection of appropriate TOMs alongside the technical development of the system.

References

[1]  A. Cavoukian, “Operationalizing Privacy by Design: A Guide to Implementing Strong Privacy Practices”, Information and Privacy Commissioner, Ontario, 2012. See also, Art. 25 of the GDPR.

[2] The Standard Data Protection Model, “A method for data protection advising and controlling on the basis of uniform protection goals”, Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Länder, April 2020, Available at https://www.datenschutzzentrum.de/uploads/sdm/SDM-Methodology_V2.0b.pdf. 

[3] The Standard Data Protection Model (SDM), p. 25 et seqq. Note: Availability and intervenability are not explicitly named as principles relating to processing of personal data in the GDPR but can be derived from it.

[4] The Standard Data Protection Model (SDM), p. 52 et seq.

[5] ENISA, “Data Protection Engineering”, 2022, Available at https://www.enisa.europa.eu/publications/data-protection-engineering.

The post Transposing Data Protection Requirements into Technical and Organisational Measures: The smashHit Approach appeared first on Smash Hit.

smashHIT & the Data Economy

The EU Data Market is forecasted to reach 85 billion euro with accumulative growth of 7% between 2020 and 2025 as European Enterprises accelerate their Digital Transformation.

What is smashHIT?

The smashHIT project aims to overcome obstacles in the rapidly growing Data Economy which is characterised by all sorts of various diverse technical designs and proprietary implementations. This is not an ideal situation because what this does in turn is it locks down various business opportunities due to all the inconsistent consent and legal rules among all the different data-sharing platforms operators and bodies involved. In turn this restricts innovation and results in lost opportunities. The smashHit project is formed by a consortium of nine organisations drawn from analytics, data security, car manufacturing, smart city infrastructure and academia working collaboratively to deliver the benefits of shared connectivity to millions of consumers.

Objective

The objective of smashHIT is to assure a trusted and secure sharing of data streams from both personal and industrial platforms which are needed to build sectoral and cross-sectoral services. The project will offer a new framework for effective sharing and brokerage of data streaming over diverse platforms, both personal and industrial and allowing for efficient generation of services by combining the data. The main focus in smashHIT will be on platforms with data streams coming from the usage of products embedded within systems in combination with data from personal and industrial platforms such as:

• Insurance Data platforms
• Traffic Data platforms
• Smart City Data

A Smart Data Dispatcher will assure common consent over data shared using semantic models of consent and legal rules.The new tools include traceability of use of data, data fingerprinting and automatic contracting among the data owners, data providers, service providers and volumes on data streaming from the usage of mass products with cyber physical features (e.g. vehicles).These data streams offer new opportunities to build innovative services, but their combination with other personal and industrial data is subject to complex ownership and consent aspects, as the data streaming from these products belong to persons or organizations who are owners or users of the products.The project will strongly use the relation to the Big Data Value Association (www.bdva.eu)

For more information visit smashHIT.eu

Why not subscribe to our Mailing List for the latest updates

The post What is the smashHit Project? appeared first on Smash Hit.