Towards Scalable Management of Privacy Obligations in Enterprises

Privacy management is important for enterprises that collect, store, access and disclose personal data. Among other things, the management of privacy includes dealing with privacy obligations: privacy obligations dictate duties and expectations an enterprise has to comply with, in terms of data retention, deletion, notice requirements, etc. This is a green area open to research and innovation. This paper provides an overview of the work we have done in this space to explicitly represent, enforce and monitor privacy obligations: this includes an obligation management model and framework, a working prototype and its integration both in the context of PRIME project and with an HP identity management solution. This paper then focuses on an important issue: how to make our approach scalable, in case large amounts of personal data have to be managed. Thanks to our integration work and the feedback we received, we learnt a few lessons on how users and enterprises are likely to deal with privacy obligations. We describe these findings and how to leverage them. Specifically, in the final part of this paper we introduce and discuss the concepts of parametric obligation and hybrid obligation management model and how this could help to make our system both scalable and flexible at the same time. Our work is in progress. Further research and development is going to be done in the context of the PRIME project and an HP Labs project.