# Delegation-Based Personal Data Processing Request
## 3 Delegation-Based Personal Data Processing Request Notarization Framework
### GDPR Compliance Audit Process
meet the requirements in Figure 5.

From the analysis results shown in Table 6, it is evident that the functions and properties of the framework proposed by [PERSON] et al. did not meet requirements, which are as follows:

* Record of DS's request and of DC's response to [PERSON]'s request (A3): For an end user to request data processing to a resource server with personal data, the SP's system is the only means to achieve it. However, this has the potential to allow the SP in the middle to ignore or manipulate the end user's request. In addition, the proposed framework was designed around access control, such that although the access request for personal data processing is stored in the block chain before processing, the personal data processing is not stored until the resource server processes it. Furthermore, it is not designed to store the request contents of the DS because the scenario wherein the DS requests the SP to process it is not considered. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**A1** & **A2** & **A3** & **A4** & **B1** & **B2** & **B3** & **B4** & **B5** & **C1** & **D1** \\ \hline Y & Y & \(N\) & Y & \(N\) & Y & \(N\) & Y & Y & \(N\) & \(N\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Analysis result of meeting the requirements of the platform proposed by [PERSON] et al. Figure 14: Performance of write in BC of proposed framework under different workloads and different number of peers. * Sealing of data (B1): It is possible for an end user to request data processing to a resource server with personal data only through the SP's system. However, this has the potential to allow the SP in the middle to manipulate the end user's request. Furthermore, as the proposed framework has been designed around access control, thus, the sealing and notarization process for end-user requests is not clearly presented. * Trusted or certifiable (B3): It was assumed that a DS is \"honest-but-curious\", whereas SPs follow a malicious model. This indicates that the DS executes the required protocols, even though it might be curious about the results it receives after the operations. Most of the records of the processing of personal data are stored in the proposal framework by the resource server; however, if the resource server is not trusted, the data also cannot be trusted. * Data minimization (C1): The proposed framework stores all personal data processing history of the SP. When the DS subscribes to the service of the SP, it delegates the processing of personal data to the SP. Therefore, owing to the excessive nature amount, all personal data processing of the SP delegated by DS for GDPR compliance audit and personal data related to personal data processing is also stored. Furthermore, considering the characteristics of the BC where data are replicated, distributed, and stored, and deletion is not easy, the more personal data are stored, the greater the risk of exposure and the greater the possibility of violating the principle of data minimization. * Feasibility in real environment (D1): To apply the proposed framework, SPs must modify the legacy personal data processing system or install a separate third-party module. However, the application of the proposed framework to the real environment is difficult because enforcing it on all SPs in the real environment is a challenge. The solution of [PERSON] et al. is insufficient compared to the proposed framework when considering that there is no guarantee of an objective view on the credibility of the DS's request for the processing of personal data, it does not comply with the GDPR principle, and it could not directly apply to a real environment situation. The framework proposed by [PERSON] et al. was not designed to store the personal data processing request of the DS without going through the SP. Moreover, if the SP does not add functions to the legacy personal data processing system to interface with the platform proposed by [PERSON] et al., the problem for GDPR compliance audits remains unsolved.