Privacy Requirements: Present & Future
Abstract
Software systems are increasingly more and more
open, handle large amounts of personal or other sensitive data
and are intricately linked with the daily lives of individuals
and communities. This poses a range of privacy requirements.
Such privacy requirements are typically treated as instances of
requirements pertaining to compliance, traceability, access control,
verification or usability. Though important, such approaches
assume that the scope for the privacy requirements can be
established a-priori and that such scope does not vary drastically
once the system is deployed. User data and information, however,
exists in an open, hyper-connected and potentially “unbounded”
environment. Furthermore, “privacy requirements - present” and
“privacy requirements - future” may differ significantly as the
privacy implications are often emergent a-posteriori. Effective
treatment of privacy requirements, therefore, requires techniques
and approaches that fit with the inherent openness and fluidity
of the environment through which user data and information
flows are shared. This paper surveys state of the art and present
some potential directions in the way privacy requirements should
be treated. We reflect on the limitations of existing approaches
with regards to unbounded privacy requirements and highlight a
set of key challenges for requirements engineering research with
regards to managing privacy in such unbounded settings.
Research Areas
