Abstract:Transparency is one of the most important principles of modern privacy regulations, such as the GDPR or CCPA. To be compliant with such regulatory frameworks, data controllers must provide data subjects with precise information about the collection, processing, storage, and transfer of personal data. To do so, respective facts and details must be compiled and always kept up to date. In traditional, rather static system environments, this inventory (including details such as the purposes of processing or the storage duration for each system component) could be done manually. In current circumstances of agile, DevOps-driven, and cloud-native information systems engineering, however, such manual practices do not suit anymore, making it increasingly hard for data controllers to achieve regulatory compliance. To allow for proper collection and maintenance of always up-to-date transparency information smoothly integrating into DevOps practices, we herein propose a set of novel approaches explicitly tailored to specific phases of the DevOps lifecycle most relevant in matters of privacy-related transparency and accountability at runtime: Release, Operation, and Monitoring. For each of these phases, we examine the specific challenges arising in determining the details of personal data processing, develop a distinct approach and provide respective proof of concept implementations that can easily be applied in cloud native systems. We also demonstrate how these components can be integrated with each other to establish transparency information comprising design- and runtime-elements. Furthermore, our experimental evaluation indicates reasonable overheads. On this basis, data controllers can fulfill their regulatory transparency obligations in line with actual engineering practices.

Extending Business Process Management for Regulatory Transparency

Enhancing privacy awareness through a novel BPMN based methodology

Hawk: DevOps-driven Transparency and Accountability in Cloud Native Systems

Enabling Versatile Privacy Interfaces Using Machine-Readable Transparency Information

Towards Cross-Provider Analysis of Transparency Information for Data Protection

BPDMN: A Conservative Extension of BPMN with Enhanced Data Representation Capabilities

Process Modeling Leveraged by Workflow Structure and Running Logs Analysis

Business Process Compliance Using Reference Models of Law

The SPECIAL-K Personal Data Processing Transparency and Compliance Platform

Unlocking Sustainability Compliance: Characterizing the EU Taxonomy for Business Process Management

BPM for the masses: empowering participants of Cognitive Business Processes

Empowering End-users with Object-aware Processes

Evaluating BPMN Extensions for Continuous Processes Based on Use Cases and Expert Interviews

Elastic Business Process Management: State of the art and open challenges for BPM in the cloud

Navigating the Landscape of Organizational Process Mining Setups

Trustworthy Transparency by Design

A Taxonomy of Compliance Processes for Business Process Compliance

On the Composition of the Long Tail of Business Processes: Implications from a Process Mining Study

Recent Advances in Data-Driven Business Process Management

From Data-centric Business Processes to Enterprise Process Frameworks

An Approach to Business Process Registration for Enterprise Collaboration: Using BPEL As an Example.