# Privacy-Aware Access Protocols for MEC Applications in 5G +
## 3 Statement of the Problem
### Privacy Requirements
#### 3.3.2 Privacy Requirements for Dependent Parties
In particular, they can form a one-to-one mapping between messages on the UE-MNO interface and messages on the MEC-APPIFY interface. The requirements R1 and R4 are not applicable because MNO-MEC knows which MEC application [PERSON] uses. Regarding the requirements on MEC, R7 and R9 are not applicable because MNO can provide the identities mentioned in those requirements to MNO-MEC. The rest of the requirements on MNO and MEC are still applicable. Since APPIFY is independent of these parties, all the requirements on APPIFY are applicable. The effect of this combination on privacy requirements is shown in Table 1, in the column 'MNO and MEC'. MEC and APPIFY Are Dependent  
A company deploys MEC to the mobile network and develops an application MEC-APPIFY. While MEC and MEC-APPIFY share information related to users with each other, MNO does not share information with them. The requirements associated with MNO are not affected since MNO does not learn any additional information from the other parties. However, MEC might learn some information relevant to the user from MEC-APPIFY. The requirements R8 and R10 are about the identity of the user for the MEC-APPIFY, which MEC-APPIFY can share with MEC. Therefore, these requirements are not applicable. The rest of the requirements for MEC and APPIFY are applicable. This combination is summarized in Table 1, in the column 'MEC and APPIFY'. MNO and APPIFY Are Dependent  
This combination occurs when MNO develops an application, which we shall call MNO-APPIFY, for MNO subscribers; an independent MEC host is deployed to the mobile network; MNO-APPIFY is one of the applications in the MEC host. All the privacy requirements are applicable for this combination. Even though MNO and APPIFY both have sensitive information about [PERSON], there is an independent party between them, which is the MEC host. This independent party could prevent automatic correlation between the messages that MNO sends to MEC and MEC sends to MNO-APPIFY. Therefore, MNO cannot be sure if [PERSON] is using APPIFY, and APPIFY cannot be sure if [PERSON] is the user. The applicability of the requirements is presented in Table 1 in the column 'MNO and APPIFY'. We assume that [PERSON] is independent of other parties. A possible exception for the independence of [PERSON] can occur when she is an insider in MNO, MEC, or even APPIFY. Now, some of the requirements are not applicable, while others should still be applicable. However, we do not discuss this exceptional case any further. Please note that privacy requirements could still be valid even when some of the parties providing the service to [PERSON] are in the same company if that company has an appropriate privacy-preserving policy. Such a policy would be putting barriers between MNO, MEC, and APPIFY and preventing them from sharing information with each other even though they are part of the same company. For instance, the policy could state that \"_subjects are only granted access to the data that is not in conflict with other data they possess_\" [50].