Handling privacy obligations in enterprises: important aspects and technical approaches
This paper explores and analyses the explicit management of privacy obligations in enterprises. Privacy obligations dictate behaviours, tasks and constraints that must be satisfied by enterprises when handling personal and confidential data. it is important for enterprises to satisfy obligations to comply with laws, preserve their reputation and meet data subjects' requirements. This paper focuses on technical aspects even if the problem cannot be solved only by deploying technological solutions. Technical work has already been done for the management of obligations subordinated to authorization aspects and simple data retention constraints: however, dealing with ongoing and long-term aspects of obligations is still a green field and open to research. Mechanisms are required to represent, manage, monitor and enforce obligation policies in complex and heterogeneous environments. Our research is work in progress: we illustrate important aspects, requirements and technical approaches to the problem. An initial prototype has been implemented as a proof of concept. Part of this work is going to be done in the context of the EU PRIME project.
privacy trust privacy management technical solutions