Scholarlink

Capability Hardware Enhanced RISC (reduced instruction set computer) Instruction-set (CHERI) is a hardware-software model that potentially offers greater security capabilities through fine-grained memory protection and scalable compartmentalization. CHERI has received significant support from the UK Government as part of the Digital Security by Design program and has been implemented as a development board (Morello), by chip manufacturer, ARM. A core component of CHERI is its use of CHERI Concentrate, a new fat pointer compression scheme to enforce security properties across networked computer systems. The use of CHERI fat pointers gives rise to an important legal question about whether CHERI use involving personal data systems could be classed as data processing under the General Data Protection Regulation (GDPR). Data processing is construed broadly under the GDPR, as confirmed by multiple Council of Justice for the European Union (CJEU) decisions. However, the CJEU decisions demonstrate differences in how data processing is constructed. Some decisions focus on a singular operation that clearly corresponds to the GDPR’s definition and entail data processing techniques on personal data. We argue other CJEU decisions have a broader construct of processing that entails the facilitation of data processing through a plural set of operations. Whether and how these different constructs apply to the use of CHERI fat pointers is a novel and important question. We show the limitations of the traditional approach to data processing when applied to CHERI fat pointers. We then identify three types of displacement caused by CHERI – technical, intentionality and compliance – and show how a facilitation approach to data processing is better equipped to meet displacement issues. In conclusion, rethinking CJEU jurisprudence about the nature of data processing along facilitation lines ensures that displacements caused by technological innovations, such as CHERI’s fat pointer uses, are still within realistic reach of data protection law.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Data Processing Displacements: The Use of CHERI Fat Pointers and the GDPR

  • 章节

  • 发表日期：

    2025年

查看全文
  • Mark Burdon,
  • Lizzie Coles-Kemp,
  • Laura Shipp,
  • Lydia Blunt

摘要

Capability Hardware Enhanced RISC (reduced instruction set computer) Instruction-set (CHERI) is a hardware-software model that potentially offers greater security capabilities through fine-grained memory protection and scalable compartmentalization. CHERI has received significant support from the UK Government as part of the Digital Security by Design program and has been implemented as a development board (Morello), by chip manufacturer, ARM. A core component of CHERI is its use of CHERI Concentrate, a new fat pointer compression scheme to enforce security properties across networked computer systems. The use of CHERI fat pointers gives rise to an important legal question about whether CHERI use involving personal data systems could be classed as data processing under the General Data Protection Regulation (GDPR). Data processing is construed broadly under the GDPR, as confirmed by multiple Council of Justice for the European Union (CJEU) decisions. However, the CJEU decisions demonstrate differences in how data processing is constructed. Some decisions focus on a singular operation that clearly corresponds to the GDPR’s definition and entail data processing techniques on personal data. We argue other CJEU decisions have a broader construct of processing that entails the facilitation of data processing through a plural set of operations. Whether and how these different constructs apply to the use of CHERI fat pointers is a novel and important question. We show the limitations of the traditional approach to data processing when applied to CHERI fat pointers. We then identify three types of displacement caused by CHERI – technical, intentionality and compliance – and show how a facilitation approach to data processing is better equipped to meet displacement issues. In conclusion, rethinking CJEU jurisprudence about the nature of data processing along facilitation lines ensures that displacements caused by technological innovations, such as CHERI’s fat pointer uses, are still within realistic reach of data protection law.