Analysis and Enforcement of GDPR-related Privacy Principles in Object-Oriented Distributed Systems

Abstract

Privacy is recognized as a fundamental human right in the European Union, giving the right to a private life and associated freedom. In the midst of digital disruption, to have a meaningful balance between the fundamental privacy rights, innovation, and economic growth, it is therefore important to consider privacy as a primary requirement in system engineering. This thesis provides fundamental computing concepts for privacy, in order to facilitate construction of privacy-compliant systems. By making privacy as an intrinsic component in design and development of systems, contributions of this thesis provide a way to turn privacy needs into tangible controls and a way to verify if the system is privacy compliant. In particular, the thesis focus on GDPR’s specific privacy requirements: data protection by design and data subject access request. There is a growing demand for verifiable privacy compliance in order to produce evidence for regulatory requirements such as accountability, transparency, etc. And this research work is at the intersection of GDPR-related privacy requirements and formal methods to facilitate a formal specification and verification of privacy compliance.