EAGER: Privacy Compliance by Design: Ideation Techniques to Facilitate System Design Compliant with Privacy Laws and Regulations

数据收集的爆炸性增长大大加剧了计算系统中现有的隐私问题，并由于可用数据的规模和范围的增加以及计算数据分析能力的进步而产生了新的隐私问题。软件专业人员通常没有关于隐私的社会技术方面的正式培训或教育。因此，解决系统引发的隐私问题通常是事后的想法和/或系统开发生命周期后期的合规性检查问题。为了应对这一挑战，本研究旨在弥合政策制定者和监管机构和系统设计者之间的差距，使隐私法律和法规的软件专业人员可以理解和操作。具体而言，本研究设计并开发了一套基于美国隐私法律法规的隐私理念卡。这项研究产生的隐私构思卡可以潜在地改变行业构建的真实世界软件解决方案中如何处理隐私相关方面，并告知学生如何在本科软件课程中教授这些问题。这项研究的一个关键贡献是一副构思卡，以促进设计，开发，在系统构建过程的每一步，都考虑到相关的美国隐私法律法规。这些卡片是根据美国隐私法领域的法律的学者和专家的意见设计的。该设计旨在促进软件专业人员和学生对隐私法规的理解。这项研究涉及应用卡的设计，在工业界以及在大学（在软件项目课程）的现实世界的解决方案。这些应用程序增强了如何隐私相关的构思技术可以有效地用于专业软件开发以及软件教育的知识。研究结果有助于设计和开发符合隐私法律法规并对用户隐私需求敏感的系统，从而促进和扩展设计隐私方法。

The explosion in data gathering has greatly exacerbated existing privacy issues in computing systems and created new ones due to the increase in the scale and the scope of available data as well as the advances in the capabilities of computational data analysis. Software professionals typically have no formal training or education on sociotechnical aspects of privacy. As a result, addressing privacy issues raised by a system is frequently an afterthought and/or a matter of compliance-check during the late phases of the system development lifecycle. To tackle this challenge, this research aims to bridge the gap between policy makers and regulators and system designers by making privacy laws and regulations understandable and actionable by software professionals. Specifically, this research designs and develops a deck of privacy ideation cards based on US privacy laws and regulations. The privacy ideation cards produced by this research can potentially transform how privacy-relevant aspects are handled in real-world software solutions built by industry and inform how students are taught these issues in undergraduate software curricula.A critical contribution of this research is a deck of ideation cards to facilitate the design, development, and deployment of systems that take into account relevant US privacy laws and regulations at every step of the system building process. The cards are designed based on input from legal scholars and experts in the domain of US privacy laws. The design is geared toward promoting an understanding of privacy regulation by software professionals as well as students. This research involves applying the cards to the design of real-world solutions in industry as well as at a university (in a software project course). These applications enhance the knowledge of how privacy-related ideation techniques can be effectively employed in professional software development as well as software education. The findings facilitate the design and development of systems that comply with privacy laws and regulations and are sensitive to the privacy needs of their users, thus promoting and extending the Privacy by Design approach.