Reference : Using Models to Enable Compliance Checking against the GDPR: An Experience Report

	Document type :	Scientific congresses, symposiums and conference proceedings : Paper published in a book
	Discipline(s) :	Engineering, computing & technology : Computer science
	Focus Areas :	Security, Reliability and Trust; Law / European Law
	To cite this reference:	http://hdl.handle.net/10993/39701

Title :	Using Models to Enable Compliance Checking against the GDPR: An Experience Report
Language :	English
Author, co-author :	Torre, Damiano [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Soltana, Ghanem [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Sabetzadeh, Mehrdad [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Briand, Lionel [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Auffinger, Yuri [Linklaters LLP]
	Goes, Peter [Linklaters LLP]
Publication date :	Sep-2019
Main document title :	Proceedings of the IEEE / ACM 22nd International Conference on Model Driven Engineering Languages and Systems (MODELS 19)
Publisher :	ACM/IEEE
Pages :	1-11
Peer reviewed :	Yes
On invitation :	No
Audience :	International
Event name :	ACM/IEEE INTERNATIONAL CONFERENCE ON MODEL-DRIVEN ENGINEERING LANGUAGES AND SYSTEMS
Event date :	from 15-09-2019 to 20-09-2019
Event place (city) :	Munich
Event country :	Germany
Keywords :	[en] General Data Protection Regulation ; Regulatory Compliance ; UML ; OCL
Abstract :	[en] The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to citizens, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR’s expanding body of case laws and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.
Research centres :	Interdisciplinary Centre for Security, Reliability and Trust (SnT) > Software Verification and Validation Lab (SVV Lab)
Funders :	University of Luxembourg - UL ; Linklaters LLP
Target :	Researchers ; Professionals
Permalink :	http://hdl.handle.net/10993/39701

	File(s) associated to this reference
	Fulltext file(s): File Commentary Version Size Access Open access PID6018521.pdf Author postprint 922.12 kB View/Open

All documents in ORBi^lu are protected by a user license.

 

University of Luxembourg Library |  Feedback |  Legal notices Site Map