Accountability by Design for Privacy

Size: px

Start display at page:

Download "Accountability by Design for Privacy"

Cory Phelps
10 years ago
Views:

1 Accountability by Design for Privacy Denis Butin, Marcos Chicote and Daniel Le Métayer 1 / 17

2 Introduction ICT growth adds to concern about sensitive data use Individuals share more & more PII Stronger privacy guarantees needed Regulations exist through EU directives, country-specific laws Not enough practical, specific means required 2 / 17

guarantees needed Regulations exist through EU directives,

3 Background The Need for Accountability 3 / 17

4 Background Legal privacy protection EU directives 95/46 (Data Protection), 2002/58 (Privacy & Electronic Communications) Privacy & PII security are subtle, context-dependent Need bridge between broadly-defined concepts & actual ICT systems 4 / 17

Privacy & PII security are subtle, context-dependent Need

5 Privacy Impact Assessment Modern analytic approach to mitigate privacy risks in ICT systems Done before system deployment No guarantees to users about actual running system 5 / 17

6 Motivation (1/2) Runtime / a posteriori verifications needed! Provide proven trust instead of blind trust Data controllers should be accountable to data subjects Practical requirements? 6 / 17

7 Motivation (2/2) Need to provide the means to check that agreements were fulfilled Approach: check PII handling event histories (logs) against agreements with an automatic tool! Duality if PIA done right (implies design choices), accountability possible (depends on design) 7 / 17

against agreements with an automatic tool!

8 What is Accountability? Obligation to accept responsibility for actions Attributability: who did what? Non-repudiable evidence that cannot be falsified Transparent use of information 8 / 17

9 Enabling Accountability (1/2) Accountability does not emerge spontaneously Feasibility of comprehensive a posteriori verification? Depends directly on technical architecture! Example requirements on logs for accountability Timestamps needed in logs if notification to data subject within an hour required when sharing their age with a third party 9 / 17

Example requirements on logs for accountability Timestamps needed in logs if

10 Enabling Accountability (2/2) Need to define: Obligations to be met = Policy language Compliance checking evidence = Log architecture Compliance checking procedure = Log analyzer 10 / 17

11 Usage Policy Languages Usage policy languages allow data handling details to be set On both sides: data subject (preferences), data controller (policies) Example data handling preference Data controller may use data subject s address to send security alerts, but may not share it with third parties. 11 / 17

Example data handling preference Data controller may use data subject s email

12 Primelife Policy Language (PPL) Automated matching of data subject & data controller policies yields Sticky Policies (agreements) Wide range of obligations possible (trigger + action) Only informal specification available until our work Example informal obligation If PII accessed by data controller for purpose marketing, anonymize it within a day 12 / 17

+ action) Only informal specification available until our work Example informal

13 PII Event Logging Data Controller must provide evidence that agreements met Audit possible through inspection of event histories (logs) wrt data handling agreements Structure of logs conditions auditability, hence accountability Deciding what to include in logs not a trivial task 13 / 17

data handling agreements Structure of logs conditions auditability,

14 Formalising PPL Relevant events precisely defined (syntax) Compliance properties described (semantics) Tool built for automated compliance checking (implementation) Reasoning over compliance can be generalised 14 / 17

Tool built for automated compliance checking

15 Importance of explicitness sufficiently detailed event information needed Avoid ambiguity; reflect causal relationships Accountability definitions shape log structure & vice versa Include contextual information if obligation of performance 15 / 17

relationships Accountability definitions shape log structure

16 Implications of audit process role definition (third party, data subject, certificated authority... ) Accountability-oriented, standardised log format (policy language-independent) Detailed case studies illustrating design guidelines 16 / 17

.. ) Accountability-oriented, standardised log format

17 Questions? 17 / 17

Alternative authentication what does it really provide?

Alternative authentication what does it really provide? Steve Pannifer Consult Hyperion Tweed House 12 The Mount Guildford GU2 4HN UK [email protected] Abstract In recent years many new technologies