Privacy is essential in today’s digital world. To this end, the General Data Protection Regulation (GDPR) was introduced and applied in the EU to help users protect their personal data. An important principle of the regulation is ‘Purpose Limitation’, stating that personal data should be processed only in ways (purposes) clearly stated and agreed upon between the system and the user. One major challenge in Software Engineering, is the integration of processing purposes of personal data into the system design. Aiming to address this challenge, we present a software design methodology allowing to formulate the processing purposes of a system and integrate them with the functional requirements. Towards practical applicability, we present a purpose-aware version of the UML use case and sequence diagrams to assists engineers in visualising the purpose-aware requirements, and a prototype tool to automate this process. We furthermore present an evaluation of our work, gathering overall positive results, especially regarding users’ confidence, simplicity, and ease of use.
Yi Peng University of Gothenburg and Chalmers University of Technology, Hans-Martin Heyn University of Gothenburg & Chalmers University of Technology, Jennifer Horkoff Chalmers and the University of Gothenburg
Anne Hess Technical University of Applied Sciences Würzburg-Schweinfurt, Gerald Heller Consultant and Trainer, Hartmut Schmitt HK Business Solutions GmbH, Cornelia Seraphin msg systems AG, Ismaning, Oliver Karras TIB - Leibniz Information Centre for Science and Technology
