1.
Methods and tools for
privacy and data protection engineering
Internet Privacy Engineering Network 2018
Barcelona (Spain), June 15, 2018
José M. del Álamo, Yod-Samuel Martín,
Julio C. Caiza, Juan C. Yelmo
Departamento de Ingeniería de Sistemas Telemáticos
Universidad Politécnica de Madrid

2.
What engineers get
GDPR PbD
PETs PPM/PEM
Source: https://doi.org/10.1109/MSPEC.2018.8352566

3.
What engineers want
Justin de la Ornellas (avex2) https://www.flickr.com/photos/ornellas/2835160463/
Licensed under Creative Commons Attribution 2.0 Generic license

4.
What researchers deliver

5.
What researchers deliver (eng. viewpoint)
Christian Lopez (the garage) https://www.flickr.com/photos/andidigress/4471100232
Licencia cc https://creativecommons.org/licenses/by-nc-sa/2.0/

6.
Challenge: what engineers should have
• Engineers are not privacy experts,
yet they will face privacy issues
(even though they may get expert advice)
• Privacy adoption entails for methods and tools
integrated within the large heritage
of software and systems engineering
– Seamlessly include privacy into software and system engineering tools
– Integrate privacy activities into the SDLC stages
– Provide a readily available body of knowledge with existent wisdom
Ø Endow engineers with privacy and data protection tools
aligned to their mindset

7.
Our approach to Privacy Engineering
Scope
Privacy Engineering contributions
define Method(ologie)s or
Methodological elements (Fragments)
to systematically capture and address privacy issues
in the development of information systems
Martín, Yod-Samuel, and José M. del Álamo.
A Metamodel for Privacy Engineering Methods.
IWPE17 - http://ceur-ws.org/Vol-1873/IWPE17_paper_24.pdf

8.
Privacy engineering elements (design)
Source: Coming soon… stay tuned!

9.
PDP4E
• Methods and Tools for GDPR Compliance through Privacy
and Data Protection Engineering
• H2020 Innovation Action: https://www.pdp4e-project.eu/
• Partners
– Trialog – Coordination (FR)
– UPM – S&T Leadership (ES)
– Eclipse foundation (FR)
– CEA (FR)
– CA (ES)
– Tecnalia (ES)
– KU Leuven (BE)
– U.Duisburg-Essen (DE)

10.
PDP4E: objectives
Software and
Systems
Engineering
Disciplines
Existent Privacy
& Data
Protection
Methods
Privacy and
Data
Protection
Engineering
Methods and
Tools
1. Introduce features to support privacy by
design and data protection into existent mainstream
software and system engineering tools.
2. Integrate privacy by design and data protection
activities within existent mainstream software and
system engineering methods.
3. Empower engineers overall to leverage the
existent knowhow on data protection; even if they
are not savvy in the field.
4. Spread the adoption of data protection
practice in time and space, by promoting the
adaptation of the tools and methods to the
mainstream needs of engineers.
5. Foster the broadest practice of privacy and
data protection engineering, by advancing the existent
communities of practice of privacy engineering
(IPEN) and bridging them to mainstream development
communities.
6. Demonstrate readiness for mainstream
practice of the methods and tools produced, by having
engineers apply them for GDPR compliance in pilot
developments for the fintech and smart grid domains.

11.
Contribution from PDP4E
Software and
Systems
Engineering
Disciplines
Existent Privacy
& Data
Protection
Methods
Privacy and
Data
Protection
Engineering
Methods and
Tools
Metamodels
Knowledge
Bases
Smart grid
demonstrator
Fintech
demonstrator
Requirements
engineering
Risk management
Model-driven
design
Assurance
and
certification
TRL6 TRL7Byproducts

12.
The road ahead
Alliance for
Privacy and
Data
Protection
Engineering
Requirements capture and
validation
•Developers
•End-users
•Legal
Demonstration pilots
•Fintech pilot
•Smart-grid pilot
Legal
End-users
Developers
Legal
End-users
Developers

13.
Design patterns
• Design patterns gives reusable solutions to recurrent
problems in given contexts
• Identified by experts à Applied by engineers
• Some (research) catalogues available:
– https://privacypatterns.org/ (2011)
– https://doi.org/10.1145/3147704.3147739 (2017)
– https://doi.org/10.1145/3167132.3167257 (2018)
• Need to foster applicability
– Catalogue à System à Language
– Develop supporting tools to hide the complex details

14.
https://www.pdp4e-project.eu/
To foster privacy engineering by
supporting engineers in dealing with privacy
by means of methods, tools and knowledge bases
they can apply

15.
Thank you
jm.delalamo@upm.es
Slide 2: ArtsyBee https://pixabay.com/en/project-management-project-1131852/
Truessec has received funding
from the European Union’s
Horizon 2020 Coordination and
Support Action under Grant
Agreement No 731711