Ensuring compliance with the General Data Protection Regulation (GDPR) remains a labor-intensive activity, especially in large applications. Moreover, legal experts often do not have the technical knowledge to assess source code. Privacy threat modeling can be used to systematically guide the assessment of privacy threats in designs and code, but it is time-intensive and needs to be redone for changes. In this paper, we build on an existing approach to automate privacy threat modelling using static code analysis and extend it for GDPR compliance checks. We first derive code properties from individual GDPR articles, implement them in a static code analysis tool, and propose queries for the automated analysis of source code. Finally, we evaluate the results using a novel test suite.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Using Static Code Analysis for GDPR Compliance Checks

  • Andreas M. Binder,
  • Immanuel Kunz

摘要

Ensuring compliance with the General Data Protection Regulation (GDPR) remains a labor-intensive activity, especially in large applications. Moreover, legal experts often do not have the technical knowledge to assess source code. Privacy threat modeling can be used to systematically guide the assessment of privacy threats in designs and code, but it is time-intensive and needs to be redone for changes. In this paper, we build on an existing approach to automate privacy threat modelling using static code analysis and extend it for GDPR compliance checks. We first derive code properties from individual GDPR articles, implement them in a static code analysis tool, and propose queries for the automated analysis of source code. Finally, we evaluate the results using a novel test suite.