Abstract
The new general data protection regulation requires organizations to conduct a data protection impact assessment (DPIA) when the processing of personal information may result in high risk to individual rights and freedoms. DPIA allows organizations to identify, assess and prioritize the risks related to the processing of personal information and select suitable mitigations to reduce the severity of the risks. The existing DPIA methodologies measure the severity of privacy risks according to analysts’ opinions about the likelihood and the impact factors of the threats. The assessment is therefore subjective to the expertise of the analysts. To reduce subjectivity, we propose a set of well-defined criteria that analysts can use to measure the likelihood and the impact of a privacy risk. Then, we adopt the fuzzy multi-criteria decision-making approach to systematically measure the severity of privacy risks while modeling the imprecision and vagueness inherent in linguistic assessment. Our approach is illustrated for a realistic scenario with respect to LINDDUN threat categories.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
AEPD (2017) Guia Practica de Anlisis de riesgos en los tratamientos de datos personales sujetos al RGPD). https://www.aepd.es/media/guias/guia-analisis-de-riesgos-rgpd.pdf. Accessed 10 Nov 2018
Awasthi A, Chauhan SS, Goyal SK (2011) A multi-criteria decision making approach for location planning for urban distribution centers under uncertainty. Math Comput Model 53(1–2):98–109
Camarinha-Matos LM, Falcão AJ, Vafaei N, Najdi S (eds) (2016) Technological innovation for cyber-physical systems—proceedings of 7th IFIP WG 5.5/SOCOLNET advanced doctoral conference on computing, electrical and industrial systems, DoCEIS 2016, Costa de Caparica, Portugal, 11–13 April 2016. IFIP advances in information and communication technology, vol 470. Springer
Caralli R, Stevens J, Young L, Wilson W (2007) Introducing octave allegro: improving the information security risk assessment process. Technical report
CNIL (2018) Privacy impact assessment methodology. https://www.cnil.fr/sites/default/files/atoms/files/cnil-pia-1-en-methodology.pdf. Accessed 15 Nov 2018
De Gusmao A, Camara L, Silva M, Poleto T, Costa A (2016) Information security risk analysis model using fuzzy decision theory. Int J Inf Manag 36:25–34
Deng M, Wuyts K, Scandariato R, Preneel B, Joosen W (2011) A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements. Requir Eng 16(1):3–32
ENISA (2013) Recommendations for a methodology of the assessment and severity of personal data breaches. https://www.enisa.europa.eu/publications/dbn-severity. Accessed 10 Nov 2018
ICO (2017) Data protection impact assessment (DPIA). https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/. Accessed 13 Nov 2018
Kahraman C, Onar SÇ, Öztaysi B (2015) Fuzzy multicriteria decision-making: a literature review. Int J Comput Intell Syst 8(4):637–666. https://doi.org/10.1080/18756891.2015.1046325
Lund MS, Solhaug B, Stlen K (2010) Model-driven risk analysis: the CORAS approach. Springer, Berlin
Moore T (2017) On the harms arising from the equifax data breach of 2017. Int J Crit Infrastruct Prot 19(C):47–48. https://doi.org/10.1016/j.ijcip.2017.10.004
OWASP (2014) OWASP top 10 privacy risks. https://www.owasp.org/index.php/OWASP_Top_10_Privacy_Risks_Project. Accessed 17 Nov 2018
OWASP (2018) OWASP risk rating methodology. https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology. Accessed 17 Nov 2018
SDM (2017) North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information: The Standard Data Protection Model (SDM) (2017)
Shameli-Sendi A, Shajari M, Hassanabadi M, Jabbarifar M, Dagenais M (2012) Fuzzy multi-criteria decision making for information security risk assessment. Open Cybern Syst J 6:26–37
Stoneburner G, Goguen AY, Feringa A (2002) Sp 800-30. Risk management guide for information technology systems. Technical report, Gaithersburg, MD, USA
Wagner I, Boiten E (2018) Privacy risk assessment: from art to science, by metrics, pp 225–241
WP29 (2017) Guidelines on data protection impact assessment (DPIA) (wp248rev.01). https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236. Accessed 15 Nov 2018
Wuyts K, Scandariato R, Joosen W (2014) Empirical evaluation of a privacy-focused threat modeling methodology. J Syst Softw 96:122–138
Zadeh LA (1965) Fuzzy sets. Inf Control 8(3):338–353
Author information
Authors and Affiliations
Corresponding author
Ethics declarations
Conflict of interest
The authors declare that they have no conflict of interest.
Ethical approval
This article does not contain any studies with human participants or animals performed by any of the authors.
Additional information
Communicated by V. Loia.
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Hart, S., Ferrara, A.L. & Paci, F. Fuzzy-based approach to assess and prioritize privacy risks. Soft Comput 24, 1553–1563 (2020). https://doi.org/10.1007/s00500-019-03986-5
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00500-019-03986-5