Transparent Personal Data Processing: The Road Ahead. Bonatti, P., Kirrane, S., Polleres, A., & Wenning, R. In TELERISE: 3rd International Workshop on TEchnical and LEgal aspects of data pRIvacy and SEcurity @ SAFECOMP2017, volume 10489, of Lecture Notes in Computer Science (LNCS), pages 337-349, Trento, Italy, September, 2017. springer.
Transparent Personal Data Processing: The Road Ahead [pdf]Paper  abstract   bibtex   
The European General Data Protection Regulation defines a set of obligations for personal data controllers and processors. Primary obligations include: obtaining explicit consent from the data subject for the processing of personal data, providing full transparency with respect to the processing, and enabling data rectification and erasure (albeit only in certain circumstances). At the core of any transparency architecture is the logging of events in relation to the processing and sharing of personal data. The logs should enable verification that data processors abide by the access and usage control policies that have been associated with the data based on the data subject’s consent and the applicable regulations. In this position paper, we: (i) identify the requirements that need to be satisfied by such a transparency architecture, (ii) examine the suitability of existing logging mechanisms in light of said requirements, and (iii) present a number of open challenges and opportunities.

Downloads: 0