Privacy by design: Embedding privacy into the software development life-cycle

Abstract

Introduction: Recent technology advances have led to significantly increased usage of personal devices such as mobile phones and online services. Users of these technologies are vulnerable to a multitude of threats relating to the data found on these devices and services. A common threat to users is privacy. The privacy by design initiative was introduced to ensure systems are embedded with privacy. However, privacy is still commonly seen as an afterthought is systems development. This research aims to introduce privacy into the software development life-cycle by building on previous research to create a privacy perspective and thus, embed privacy into software architectural practice. Method: This research can best be categorised as design science. First, an extensive literature review was conducted on topics related to privacy by design in the software development life-cycle. Second, the privacy perspective was designed by building upon previous research that was identified in the literature review. Third, an ontology was created to demonstrate requirements traceability. This was done to provide assurance for requirement compliance against privacy regulations for the privacy perspective. Finally, expert interviews and a case study were conducted to validate the approach. Solution design: The proposed solution was introduced by first, providing an outline of the privacy perspective and its pertaining concepts. Second, the ontology has been introduced. Additionally, the case study is used as a running example throughout the solution design. Validation: Validation for this research was performed on two fronts. (1) Two experts were consulted to validate the perspective. It was found that the introduction of the privacy perspective would place a more stringent focus on privacy during software development. (2) A case study was performed to which the privacy perspective was applied. This was supplemented by the use of the ontology and finally implemented in a basic web application. Thus demonstrating the practical use of the privacy perspective and the ontology.