Privacy by Design and Software Engineering: a Systematic Literature Review

Vinícius Camargo Andrade; Rhodrigo Deda Gomes; Sheila Reinehr; Cinthia Obladen De Almendra Freitas; Andreia Malucelli

Vinícius Camargo Andrade Pontifícia Universidade Católica do Paraná https://orcid.org/0000-0001-9827-1332
Rhodrigo Deda Gomes Pontifícia Universidade Católica do Paraná https://orcid.org/0000-0002-5671-2694
Sheila Reinehr Pontifícia Universidade Católica do Paraná https://orcid.org/0000-0001-9430-7713
Cinthia Obladen De Almendra Freitas Pontifícia Universidade Católica do Paraná https://orcid.org/0000-0002-7015-094X
Andreia Malucelli Pontifícia Universidade Católica do Paraná https://orcid.org/0000-0002-0929-1874

Resumo

Service providers increasingly collect, process, store, and share data from their users to understand their preferences to make better decisions and make accurate estimates for the delivery of advertisements, products, and services. However, the misuse of personal data puts the privacy of the data subjects at risk. In addition, privacy can directly affect the quality of the software product. In an attempt to minimize these problems, the Privacy by Design approach has been proposed to ensure that privacy requirements are incorporated from the early stages of system development and applied to the entire data lifecycles. Meanwhile, Privacy by Design is often criticized due to its lack of specific methodology and tools capable of translating its principles into practical Software Engineering activities. Therefore, this research aims to investigate, through a systematic literature review, how Privacy by Design principles have been applied in the Software Engineering area. The search retrieved 6046 primary articles, published up to May 2022. After applying the inclusion and exclusion criteria, 75 primary studies were selected for analysis. The results show that there is a lack of models, processes, and tools to support Privacy by Design throughout the software development lifecycle and that it has become more relevant considering the requirements of the General Data Protection Regulation (GDPR).

Palavras-chave: Privacy by Design, Software Engineering, Privacy, Personal Data Protection