Data protection and privacy
a model for evidence management
DOI:
https://doi.org/10.1590/1808-5245.29.128009Keywords:
data protection; data privacy; evidence management; information securityAbstract
The legislation and regulations related to data protection and privacy present the requirements that organizations, processes, products, and environments need to meet to be considered secure. Among the recommended requirements, the “Accountability” and “Privacy Compliance” requirements stand out, which define that organizations must be responsible and able to demonstrate compliance with current laws and regulations. In addition to the challenge of implementing such requirements, it is necessary to adopt systematized processes that prove how and on what evidence these requirements are validated. This article presents a model called COM.PRIVACY to manage evidence of data protection and privacy to demonstrate diligence and compliance with good practice regulations. Design Science Research (DSR) was used as a research method for proposing the model. For its validation, COM.PRIVACY was applied in an organization that made it possible to observe and identify improvements during its use, in addition to submitting a questionnaire to specialists to evaluate the model. It was concluded that the model supports the validation and proof of compliance with data protection and privacy requirements in all data processing operations, and can be adopted both in the activity of adequacy and implementation of regulations, in the process of measurement and verification compliance with them, as well as to promote transparency in the processing of data to their holders.
Downloads
References
ASSOCIAÇÃO BRASILEIRA DE NORMAS TÉCNICAS. NBR ISO/IEC 29100: tecnologia da informação: técnicas de segurança: estrutura de privacidade. Rio de Janeiro, ABNT, 2020.
BRASIL. Lei n. 13.709, de 14 de agosto de 2018. Lei Geral de Proteção de Dados Pessoais (LGPD). Diário Oficial da União: seção 1, Brasília, n. 157, p. 59, 15 ago. 2018.
CAVOUKIAN, Ann. Privacy by design: the 7 foundational principles. Information and Privacy Commissioner of Ontario, Toronto, 2009.
EUROPEAN UNION. General data protection regulation. EUR-Lex, Luxemburgo, 2016.
FACCHINI NETO, Eugênio; DEMOLINER, Karina Silva. Direito à privacidade e novas tecnologias: breves considerações acerca da proteção de dados pessoais no Brasil e na Europa. Revista Internacional Consinter de Direito, Porto, ano 6, n. 7, p. 19-40, 2018. Disponível em: https://doi.org/10.19135/revista.consinter.0007.01. Acesso em: 7 maio 2023.
HEVNER, Alan; CHATTERJEE, Samir. Design research in information systems: theory and practice. Berlin: Springer, 2010.
ISAAK, Jim; HANNA, Mina J. User data privacy: Facebook, Cambridge analytica, and privacy protection. Computer, New York, v. 51, n. 8, p. 56-59, 2018. Disponível em: http://doi.org/ 10.1109/MC.2018.3191268. Acesso em: 10 mar. 2022.
KOKALY, Sahar. Managing assurance cases in model based software systems. In: INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING COMPANION, 39., 2017, Buenos Aires. Anais […]. Buenos Aires: IEE, 2017. p. 453-456.
LIMA, Paulo Ricardo Silva; PRESSER, Nadi Helena. A Lei Geral de Proteção de Dados e os desafios para a gestão nas organizações brasileiras na era do big data. Revista P2P & Inovação, Brasília, v. 8, n. 2, p. 109-120, 2022. Disponível em: https://doi.org/10.21721/p2p.2022v8n2.p109-120. Acesso em: 2 maio 2023.
MENDES, Laura Schertel. Privacidade, proteção de dados e defesa do consumidor: linhas gerais de um novo direito fundamental. São Paulo: Saraiva, 2014.
OBJECT MANAGEMENT GROUP (OMG). Structured Assurance Case Metamodel (SACM): version 2.1., Milford, Apr. 2020.
ROCHA, Junia M.; HONORATO, Mauro Jacob; COSTA, Eduardo. Assessment of expert panels. IEEE Latin America Transactions, New York, v. 14, n. 1, p. 303-308, 2016. Disponível em: http://doi.org/10.1109/TLA.2016.7430093. Acesso em: 30 ago. 2022.
SCHAAR, Peter. Privacy by Design. Identity in the Information Society, Estados Unidos, v. 3, n. 2, p. 267-274, 2010. Disponível em: http://doi.org/ 10.1007/s12394-010-0055-x. Acesso em: 5 maio 2022.
SOUSA, Rosilene Paiva Marinho de; BARRANCOS, Jacqueline Echeverría; MAIA, Manuela Eugênio. Acesso à informação e ao tratamento de dados pessoais pelo poder público. Informação & Sociedade: Estudos, João Pessoa, v. 29, n. 1, p. 237-251, 2019.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2022 Gislaine Parra Freund, Douglas Dyllon Jeronimo de Macedo, Priscila Basto Fagundes
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
Authors will keep their copyright and grant the journal with the right of first publication, the work licensed under License Creative Commons Attribution (CC BY 4.0), which allows for the sharing of work and the recognition of authorship.
Authors can take on additional contracts separately for non-exclusive distribution of the version of the work published in this journal, such as publishing in an institutional repository, acknowledging its initial publication in this journal.
The articles are open access and free. In accordance with the license, you must give appropriate credit, provide a link to the license, and indicate if changes were made. You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
