More Like this

1. Compliance Requirements in Research

   https://doi.org/10.1145/3704286  

   Deumens, Erik; Ellis, Carolyn (December 2024, Communications of the ACM)

   Cyberinfrastructure for research needs to meet growing lists of requirements. 

   more » « less
2. Position: GDPR Compliance by Construction

   https://doi.org/10.1007/978-3-030-33752-0_3  

   Schwarzkopf, M Kohler (October 2019, Gadepally V. et al. (eds) Heterogeneous Data Management, Polystores, and Analytics for Healthcare. DMAH 2019, Poly 2019. Lecture Notes in Computer Science, vol 11721.)

   New laws such as the European Union’s General Data Protection Regulation (GDPR) grant users unprecedented control over personal data stored and processed by businesses. Compliance can require expensive manual labor or retrofitting of existing systems, e.g., to handle data retrieval and removal requests. We argue for treating these new requirements as an opportunity for new system designs. These designs should make data ownership a first-class concern and achieve compliance with privacy legislation by construction. A compliant-by-construction system could build a shared database, with similar performance as current systems, from personal databases that let users contribute, audit, retrieve, and remove their personal data through easy-to-understand APIs. Realizing compliant-by-construction systems requires new cross-cutting abstractions that make data dependencies explicit and that augment classic data processing pipelines with ownership information. We suggest what such abstractions might look like, and highlight existing technologies that we believe make compliant-by-construction systems feasible today. We believe that progress towards such systems is at hand, and highlight challenges for researchers to address to make them a reality. 

   more » « less
3. Retrofitting GDPR compliance onto legacy databases

   https://doi.org/10.14778/3503585.3503603  

   Agarwal, Archita; George, Marilyn; Jeyaraj, Aaron; Schwarzkopf, Malte (December 2021, Proceedings of the VLDB Endowment)

   New privacy laws like the European Union's General Data Protection Regulation (GDPR) require database administrators (DBAs) to identify all information related to an individual on request, e.g. , to return or delete it. This requires time-consuming manual labor today, particularly for legacy schemas and applications. In this paper, we investigate what it takes to provide mostly-automated tools that assist DBAs in GDPR-compliant data extraction for legacy databases. We find that a combination of techniques is needed to realize a tool that works for the databases of real-world applications, such as web applications, which may violate strict normal forms or encode data relationships in bespoke ways. Our tool, GDPRizer, relies on foreign keys, query logs that identify implied relationships, data-driven methods, and coarse-grained annotations provided by the DBA to extract an individual's data. In a case study with three popular web applications, GDPRizer achieves 100% precision and 96--100% recall. GDPRizer saves work compared to hand-written queries, and while manual verification of its outputs is required, GDPRizer simplifies privacy compliance. 

   more » « less
4. Automating Privacy Compliance Using Policy Integrated Blockchain

   https://doi.org/10.3390/cryptography3010007  

   Joshi, Karuna Pande; Banerjee, Agniva (March 2019, Cryptography)

   An essential requirement of any information management system is to protect data and resources against breach or improper modifications, while at the same time ensuring data access to legitimate users. Systems handling personal data are mandated to track its flow to comply with data protection regulations. We have built a novel framework that integrates semantically rich data privacy knowledge graph with Hyperledger Fabric blockchain technology, to develop an automated access-control and audit mechanism that enforces users' data privacy policies while sharing their data with third parties. Our blockchain based data-sharing solution addresses two of the most critical challenges: transaction verification and permissioned data obfuscation. Our solution ensures accountability for data sharing in the cloud by incorporating a secure and efficient system for End-to-End provenance. In this paper, we describe this framework along with the comprehensive semantically rich knowledge graph that we have developed to capture rules embedded in data privacy policy documents. Our framework can be used by organizations to automate compliance of their Cloud datasets. 

   more » « less
5. Analyzing GDPR compliance of named data networking

   https://doi.org/10.1145/3460417.3482979  

   Tran, Casey; Tourani, Reza; Misra, Satyajayant; Machacek, Travis; Panwar, Gaurav (September 2021, Proceedings of the 8th ACM Conference on Information-Centric Networking)