Fuzzy-based approach to assess and prioritize privacy risks
- 14 Downloads
The new general data protection regulation requires organizations to conduct a data protection impact assessment (DPIA) when the processing of personal information may result in high risk to individual rights and freedoms. DPIA allows organizations to identify, assess and prioritize the risks related to the processing of personal information and select suitable mitigations to reduce the severity of the risks. The existing DPIA methodologies measure the severity of privacy risks according to analysts’ opinions about the likelihood and the impact factors of the threats. The assessment is therefore subjective to the expertise of the analysts. To reduce subjectivity, we propose a set of well-defined criteria that analysts can use to measure the likelihood and the impact of a privacy risk. Then, we adopt the fuzzy multi-criteria decision-making approach to systematically measure the severity of privacy risks while modeling the imprecision and vagueness inherent in linguistic assessment. Our approach is illustrated for a realistic scenario with respect to LINDDUN threat categories.
KeywordsPrivacy risks Privacy risk assessment Fuzzy set theory
Compliance with ethical standards
Conflict of interest
The authors declare that they have no conflict of interest.
This article does not contain any studies with human participants or animals performed by any of the authors.
- AEPD (2017) Guia Practica de Anlisis de riesgos en los tratamientos de datos personales sujetos al RGPD). https://www.aepd.es/media/guias/guia-analisis-de-riesgos-rgpd.pdf. Accessed 10 Nov 2018
- Camarinha-Matos LM, Falcão AJ, Vafaei N, Najdi S (eds) (2016) Technological innovation for cyber-physical systems—proceedings of 7th IFIP WG 5.5/SOCOLNET advanced doctoral conference on computing, electrical and industrial systems, DoCEIS 2016, Costa de Caparica, Portugal, 11–13 April 2016. IFIP advances in information and communication technology, vol 470. SpringerGoogle Scholar
- Caralli R, Stevens J, Young L, Wilson W (2007) Introducing octave allegro: improving the information security risk assessment process. Technical reportGoogle Scholar
- CNIL (2018) Privacy impact assessment methodology. https://www.cnil.fr/sites/default/files/atoms/files/cnil-pia-1-en-methodology.pdf. Accessed 15 Nov 2018
- ENISA (2013) Recommendations for a methodology of the assessment and severity of personal data breaches. https://www.enisa.europa.eu/publications/dbn-severity. Accessed 10 Nov 2018
- ICO (2017) Data protection impact assessment (DPIA). https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/. Accessed 13 Nov 2018
- Lund MS, Solhaug B, Stlen K (2010) Model-driven risk analysis: the CORAS approach. Springer, BerlinGoogle Scholar
- OWASP (2014) OWASP top 10 privacy risks. https://www.owasp.org/index.php/OWASP_Top_10_Privacy_Risks_Project. Accessed 17 Nov 2018
- OWASP (2018) OWASP risk rating methodology. https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology. Accessed 17 Nov 2018
- SDM (2017) North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information: The Standard Data Protection Model (SDM) (2017)Google Scholar
- Stoneburner G, Goguen AY, Feringa A (2002) Sp 800-30. Risk management guide for information technology systems. Technical report, Gaithersburg, MD, USAGoogle Scholar
- Wagner I, Boiten E (2018) Privacy risk assessment: from art to science, by metrics, pp 225–241Google Scholar
- WP29 (2017) Guidelines on data protection impact assessment (DPIA) (wp248rev.01). https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236. Accessed 15 Nov 2018