Working with personal data

The processing of personal data should be aligned with a business purpose and a business process. Often, personal data is used as part of a business workflow. This workflow is aligned with the pricacy policy that descibes personal data processing as part of the data subject consent collection.

When handling personal data, two aspects need attention: The control of personal data flows, and the management of identities of data subjects and data processors. Figure 1 below shows on the left side how data flows are composed of collection, storage, processing, transfer and deletion of personal data. On the right side, figure 1 shows how identity managemet is an important aspect of pesonal data processing through identification of authorized access, authentication of involved parties, linkability of data sets (or the absence thereof through anonymization), expression of ownership of data, and delegation of rights to other parties.

Figure 1: Aspects of privacy protection: Data flow and identity management.

The handling of personal data as “business process” therefore includes a number of mechanisms known from business process management systems. Data flow models aligned with the privacy policy and the business models are a precondition for successful privacy compliance. They, in turn, demand role and access control models for staff. Additionally, identity management of the data subjects over the complete data processing and storage period is needed.

Formalizing data flow and privacy constraints

A formalized description of access restrictions is called a "privacy policy", an analog to "security policies". However, the term is ambiguous, since privacy policies for end users that are written in prose are referred to by the same name. For this section, we presume that there are formalized, machine-readable privacy policies that have been specified in harmony with the prose versions written by legal experts.

The binding of data flows to privacy policies and to security and privacy controls is a challenge for software engineers. Two XML-based languages for the description of privacy constraints have been specified:

EPAL - the Enterprise Privacy Authorization Language
XACML - the eXtensible Access Control Markup Language

In (Anderson, 2005), you can read how these two languages compare.

In practice, information systems need to consider the rules laid forth in privacy workflow specifications through security functionality. Hewlett-Packard's research group on privacy specified a hardware-supported system called Sticky Policies for this purpose. It consists of an architecture of trusted hardware that executes data processing only according to policies that are attached to the encrypted personal data. The concept included the management of user consent statements as part of the data flow and access control model. The Sticky Policy concept is a very complex cryptographic system that needs to span over the overall infrastructure of data processing, including all subcontractors. An introduction to the overall architecture with an example application is provided in (Pearson and Casassa Mont, 2011).

Managing personal data

For the sake of completeness and with reference to the data subject intervention rights defined in the EU GDPR, I mention a number of issues of importance when working with a dtaa model for storing and handling personal data. To satisfy data subject rights, data processors will need to be able to provide detailed information about what data they store, how they processed it for what purpose (under what privacy policy/data subject consent version), and which other processors they shared it with.

The ability to answer such inquiries requires a stringend housholding approach to personal data. It may include:

stringent data labelling with metadata (provenance, data subject identity assurance, references to privacy policies and consent statements);
privacy-friendly logging of processing transactions and their purpose;
stringent control over modifications in business models, business practice, change of organizational structure or change of hardware/software that may cause update of privacy policies and renewal of data subject consent;
mechanisms for the archival and reference of past versions of privacy policies personal data was collected under, including links to data subject consent versions for the respective occasion;
identity management for data subject identification and long-term recognition of legitimate data subjects.

The correct and law-abiding management of personal data collections will therefore impose serious housekeeping efforts on the responsible organizations.

References

Anne Anderson: A Comparison of Two Privacy Policy Languages:EPAL and XACML, Sun Microsystems report SMLI TR-2005-147, September 2005 [link]
Siani Pearson, Marco Casassa-Mont: Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer magazine, Issue No. 09 - Sept. 2011, vol. 44, ISSN: 0018-9162, pp: 60-68 [link]

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.