Abstract
This paper describes issues and requirements related to privacy management as an aspect of improved governance in enterprises. Most of the existing related technical work is based on auditing and reporting mechanisms. The focus of this paper is on privacy enforcement for personal data: this is still a green field. To enforce the execution of privacy policies, requests to access personal data need to be checked against data requestors’ rights and intents, data subjects’ consent and the stated data purposes. Being able to automate and simplify the enforcement of privacy and reduce the involved costs is important for enterprises. We describe our approach and compare it against related work. In particular, we discuss our work done to add privacy-aware access control capabilities to HP Select Access – a leading-edge access control solution. A prototype has been implemented as a proof of concept. Current results, open issues and next steps are discussed.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Rotemberg, M., Laurant, C.: Privacy International: Privacy and Human Rights 2004: an International Survey of Privacy Laws and Developments, Electronic Privacy Information Center (EPIC), Privacy International (2004), http://www.privacyinternational.org/survey/phr2004/
OECD: OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980), http://www1.oecd.org/publications/e-book/9302011E.PDF
Online Privacy Alliance: Guidelines for Online Privacy Policies. Online Privacy Alliance (2004), http://www.privacyalliance.org/
Karjoth, G., Schunter, M.: A Privacy Policy Model for Enterprises. IBM Research, Zurich. In: 15th IEEE Computer Foundations Workshop (2002)
IBM: The Enterprise Privacy Authorization Language (EPAL), EPAL 1.1 specification. IBM (2004), http://www.zurich.ibm.com/security/enterprise-privacy/epal/
Agrawal, R., Kiernan, J., Srikant, R., Xu, Y.: Hippocratic Databases IBM Almaden Research Center (2002), http://www.almaden.ibm.com/cs/people/srikant/papers/vldb02.pdf
IBM Tivoli Privacy Manager: online technical documentation, http://publib.boulder.ibm.com/tividd/td/PrivacyManagerfore-business1.1.html
HP: HP Openview Select Access - Overview and Features, http://www.openview.hp.com/products/select/
Casassa Mont, M.: Dealing with privacy obligations: Important aspects and technical approaches. In: Katsikas, S.K., López, J., Pernul, G. (eds.) TrustBus 2004. LNCS, vol. 3184, pp. 120–131. Springer, Heidelberg (2004)
Baldwin, A.: Enhanced accountability for electronic processes. In: Jensen, C., Poslad, S., Dimitrakos, T. (eds.) iTrust 2004. LNCS, vol. 2995, pp. 319–332. Springer, Heidelberg (2004)
Salle, M.: IT Service Management and IT Governance: Review, Comparative Analysis and their impact on Utility Computing, HP Labs (2004), http://www.hpl.hp.com/techreports/2004/HPL-2004-98.html
Casassa Mont, M.: On Adaptive Identity Management: The Next Generation of Identity Management Solutions, HP Labs (2003), http://www.hpl.hp.com/techreports/2003/HPL-2003-149.pdf
Casassa Mont, M., Thyne, R., Bramhall, P.: Privacy Enforcement with HP Select Access for Regulatory Compliance, HP Labs (2005), http://www.hpl.hp.com/techreports/2005/HPL-2005-10.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Mont, M.C., Thyne, R., Bramhall, P. (2005). Privacy Enforcement for IT Governance in Enterprises: Doing It for Real. In: Katsikas, S., López, J., Pernul, G. (eds) Trust, Privacy, and Security in Digital Business. TrustBus 2005. Lecture Notes in Computer Science, vol 3592. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11537878_23
Download citation
DOI: https://doi.org/10.1007/11537878_23
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-28224-2
Online ISBN: 978-3-540-31796-8
eBook Packages: Computer ScienceComputer Science (R0)