Identifying Practical Challenges in the Implementation of Technical Measures for Data Privacy Compliance

Recent years have seen the adoption of several data privacy protection laws, most notably the General Data Protection Regulation (GDPR) in the EU, the California Consumer Privacy Act (CCPA) in the United States, or even the lesser known Bundesdatenschutzgesetz in Germany. Legislation like the GDPR and CCPA shed light on an increasing worldwide awareness of the potential dangers and complications brought about by the ever-growing popularity of data collection, processing, and analysis. Furthermore, they represent an attempt to enforce the responsible handling of data through legal means, ultimately at its core protecting the consumer, or rather the individual. From these laws stems the concept of data privacy compliance, essentially meaning how a corporation or other organization must comply with the guidelines defined in such laws. At the same time, and in most cases actually predating these recent privacy laws, the research and development of Privacy-Enhancing Technologies (PETs) has also sharply risen, yielding many novel and effective methods for processing sensitive data in a private matter.

With two distinct sectors approaching the issue of data privacy in inherently different ways, one can reasonably expect challenges. Privacy in the legal sense, by nature, is more of a guideline rather than a specification. Advances in the technical realm, however, work towards developing processes that do indeed preserve privacy in some manner, yet this may or may not be directly translatable to given legislation. In other words, one can read through the entire text of the GDPR, yet still be unsure as to how this exactly could be implemented in a PET. By the same token, the developers of a PET might face challenges when evaluating how their framework conforms to GDPR guidelines. Thus, the goal of this thesis is not only to explore the dynamic existing between privacy compliance in the legal and technical sectors, but also to investigate the other challenges pervading the implementation of technical measures for privacy compliance. This goal will be accomplished by first exploring the challenges existing within privacy compliance programs today, and subsequently analyzing the findings to develop useful solutions.