Using Models to Enable Compliance Checking against the GDPR: An Experience Report

Damiano Torre; Ghanem Soltana; Mehrdad Sabetzadeh; Lionel C. Briand; Yuri Auffinger; Peter Goes

doi:10.1109/MODELS.2019.00-20

Using Models to Enable Compliance Checking against the GDPR: An Experience Report

Damiano Torre
, Ghanem Soltana
, Mehrdad Sabetzadeh
, Lionel C. Briand
, Yuri Auffinger
, Peter Goes

University of Luxembourg
University of Ottawa
Linklaters LLP

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to individuals, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR's expanding body of case law and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.

Original language	English
Title of host publication	Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019
Editors	Marouane Kessentini, Tao Yue, Tao Yue, Alexander Pretschner, Sebastian Voss, Loli Burgueno, Loli Burgueno
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1-11
Number of pages	11
ISBN (Electronic)	9781728125350
DOIs	https://doi.org/10.1109/MODELS.2019.00-20
Publication status	Published - Sep 2019
Externally published	Yes
Event	22nd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2019 - Munich, Germany Duration: 15 Sep 2019 → 20 Sep 2019

Publication series

Name	Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019

Conference

Conference	22nd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2019
Country/Territory	Germany
City	Munich
Period	15/09/19 → 20/09/19

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 9 Industry, Innovation, and Infrastructure

Keywords

General Data Protection Regulation
OCL
Regulatory Compliance
UML

Access to Document

10.1109/MODELS.2019.00-20

Cite this

Torre, D., Soltana, G., Sabetzadeh, M., Briand, L. C., Auffinger, Y., & Goes, P. (2019). Using Models to Enable Compliance Checking against the GDPR: An Experience Report. In M. Kessentini, T. Yue, T. Yue, A. Pretschner, S. Voss, L. Burgueno, & L. Burgueno (Eds.), Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019 (pp. 1-11). Article 8906896 (Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/MODELS.2019.00-20

Torre, Damiano ; Soltana, Ghanem ; Sabetzadeh, Mehrdad et al. / Using Models to Enable Compliance Checking against the GDPR : An Experience Report. Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019. editor / Marouane Kessentini ; Tao Yue ; Tao Yue ; Alexander Pretschner ; Sebastian Voss ; Loli Burgueno ; Loli Burgueno. Institute of Electrical and Electronics Engineers Inc., 2019. pp. 1-11 (Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019).

@inproceedings{bf9c5ee5b2e54f0eb9b41d5e3be0b73e,

title = "Using Models to Enable Compliance Checking against the GDPR: An Experience Report",

abstract = "The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to individuals, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR's expanding body of case law and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.",

keywords = "General Data Protection Regulation, OCL, Regulatory Compliance, UML",

author = "Damiano Torre and Ghanem Soltana and Mehrdad Sabetzadeh and Briand, \{Lionel C.\} and Yuri Auffinger and Peter Goes",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 22nd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2019 ; Conference date: 15-09-2019 Through 20-09-2019",

year = "2019",

month = sep,

doi = "10.1109/MODELS.2019.00-20",

language = "English",

series = "Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1--11",

editor = "Marouane Kessentini and Tao Yue and Tao Yue and Alexander Pretschner and Sebastian Voss and Loli Burgueno and Loli Burgueno",

booktitle = "Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019",

}

Torre, D, Soltana, G, Sabetzadeh, M, Briand, LC, Auffinger, Y & Goes, P 2019, Using Models to Enable Compliance Checking against the GDPR: An Experience Report. in M Kessentini, T Yue, T Yue, A Pretschner, S Voss, L Burgueno & L Burgueno (eds), Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019., 8906896, Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019, Institute of Electrical and Electronics Engineers Inc., pp. 1-11, 22nd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2019, Munich, Germany, 15/09/19. https://doi.org/10.1109/MODELS.2019.00-20

Using Models to Enable Compliance Checking against the GDPR: An Experience Report. / Torre, Damiano; Soltana, Ghanem; Sabetzadeh, Mehrdad et al.
Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019. ed. / Marouane Kessentini; Tao Yue; Tao Yue; Alexander Pretschner; Sebastian Voss; Loli Burgueno; Loli Burgueno. Institute of Electrical and Electronics Engineers Inc., 2019. p. 1-11 8906896 (Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Using Models to Enable Compliance Checking against the GDPR

T2 - 22nd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems, MODELS 2019

AU - Torre, Damiano

AU - Soltana, Ghanem

AU - Sabetzadeh, Mehrdad

AU - Briand, Lionel C.

AU - Auffinger, Yuri

AU - Goes, Peter

PY - 2019/9

Y1 - 2019/9

N2 - The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to individuals, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR's expanding body of case law and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.

AB - The General Data Protection Regulation (GDPR) harmonizes data privacy laws and regulations across Europe. Through the GDPR, individuals are able to better control their personal data in the face of new technological developments. While the GDPR is highly advantageous to individuals, complying with it poses major challenges for organizations that control or process personal data. Since no automated solution with broad industrial applicability currently exists for GDPR compliance checking, organizations have no choice but to perform costly manual audits to ensure compliance. In this paper, we share our experience building a UML representation of the GDPR as a first step towards the development of future automated methods for assessing compliance with the GDPR. Given that a concrete implementation of the GDPR is affected by the national laws of the EU member states, GDPR's expanding body of case law and other contextual information, we propose a two-tiered representation of the GDPR: a generic tier and a specialized tier. The generic tier captures the concepts and principles of the GDPR that apply to all contexts, whereas the specialized tier describes a specific tailoring of the generic tier to a given context, including the contextual variations that may impact the interpretation and application of the GDPR. We further present the challenges we faced in our modeling endeavor, the lessons we learned from it, and future directions for research.

KW - General Data Protection Regulation

KW - OCL

KW - Regulatory Compliance

KW - UML

UR - https://www.scopus.com/pages/publications/85076107479

U2 - 10.1109/MODELS.2019.00-20

DO - 10.1109/MODELS.2019.00-20

M3 - Conference contribution

AN - SCOPUS:85076107479

T3 - Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019

SP - 1

EP - 11

BT - Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019

A2 - Kessentini, Marouane

A2 - Yue, Tao

A2 - Pretschner, Alexander

A2 - Voss, Sebastian

A2 - Burgueno, Loli

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 15 September 2019 through 20 September 2019

ER -

Torre D, Soltana G, Sabetzadeh M, Briand LC, Auffinger Y, Goes P. Using Models to Enable Compliance Checking against the GDPR: An Experience Report. In Kessentini M, Yue T, Yue T, Pretschner A, Voss S, Burgueno L, Burgueno L, editors, Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019. Institute of Electrical and Electronics Engineers Inc. 2019. p. 1-11. 8906896. (Proceedings - 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems, MODELS 2019). doi: 10.1109/MODELS.2019.00-20

Using Models to Enable Compliance Checking against the GDPR: An Experience Report

Abstract

Publication series

Conference

UN SDGs

Keywords

Access to Document

Other files and links

Fingerprint

Cite this