Technical Reports
HPL-2010-82
Click here for full text:
Towards A Conceptual Model For Privacy Policies
Casassa Mont, Marco; Pearson, Siani; Creese, Sadie; Goldsmith, Michael; Papanikolaou, Nick
HP Laboratories
HPL-2010-82
Keyword(s): privacy policies, policy hierarchy, policy refinement, conceptual model
Abstract: This paper presents a conceptual model for privacy policies that takes into account privacy requirements arising from different stakeholders, with legal, business and technical backgrounds. Current approaches to privacy management are either high-level, enforcing privacy of personal data using legal compliance, risk and impact assessments, or low-level, focusing on the technical implementation of access controls to personal data held by an enterprise. High-level approaches tend to address privacy as an afterthought in ordinary business practice, and involve ad hoc enforcement practices; low-level approaches often leave out important legal and business considerations focusing solely on technical management of privacy policies. Hence, neither is a panacea and the low level approaches are often not adopted in real environments. Our conceptual model provides a means to express privacy policy requirements as well as users' privacy preferences. It enables structured reasoning regarding containment and implementation between various policies at the high level, and enables easy traceability into the low-level policy implementations. Thus it offers a means to reason about correctness that links low-level privacy management mechanisms to stakeholder requirements, thereby encouraging exploitation of the low-level methods.
8 Pages
External Posting Date: July 21, 2010 [Fulltext]. Approved for External Publication
Internal Posting Date: July 21, 2010 [Fulltext]