Currently, the scienti c communities and private companies are actively working to provide theoretical and practical solutions for enforcing the adoption of the General Data Protection Regulation (GDPR) and its compliance problem. In line with the principle of data protection by design, the paper proposes an approach for the automation and enforcement of GDPR requirements. The idea is to extend the currently adopted access control mechanisms so to leverage them to the enforcement of GDPR compliance during business activities of data management and analysis. From a practical point of view, this means to integrate into the existing business processes speci c facilities for assisting in the design, development, maintenance, and veri cation of the GDPR requirements as well as to modify the language and architecture of the access control systems so as to let the management of GDPR principles and obligations. For this, the basic steps of the proposed approach are provided as well as an example used to clarify the integrated use of access control systems and business process models.
General Data Protection Regulation3, known as GDPR, is the new EU Data Protection Regulation that became enforceable on May 2018. The purpose of the GDPR is to harmonize the regulation of Data Protection across the EU member states and, at the same time, to enhance and to arise business opportunities within the Digital Single Market space. GDPR imposes several limitations of processing personal data and provides several provisions, de ning responsibilities and nes in case of non-compliance. 3 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
In general, implementing GDPR requirements and demonstrating a presumption of compliance, and therefore avoid the related penalties, is not a trivial problem. From a practical point of view, this issue can be reloaded as: making a given Data Management System (DMS) comply with the GDPR legal requirements, and providing the necessary information and evidences so that a supervisor authority could accept this as evidence of the compliance.
Currently, the scienti c communities, as well as private companies, are actively working to provide theoretical and practical solutions for enforcing the adoption of the GDPR and its compliance problem. To facilitate this process and tackle the principle of data protection by design, contained in Article 25.1 of the Regulation, an important step is the automation the enforcement of GDPR requirements. From this the idea of this paper: improving the currently adopted security services and access control procedures so to leverage them to the enforcement of GDPR compliance during business activities of data management and analysis.
Indeed, the current trend of increasing automation and data exchange
promoted by the Industry 4.0 is encouraging many industrial realities to the
adoption of visual models, called Business Processes (BPs), to easily manage the
assignment of tasks, the interactions between the di erent roles, and the changes
in the organization or in the business activities [
From a practical point to view, there are several possible ways to model a BP;
perhaps the most popular and widespread adopted is Business Process Model
and Notation (BPMN) [
Following this idea, the solution presented in this paper relies on two pillars: 1) exploit the BPMN models for assisting in the design, development, maintenance, and veri cation of a system in order to comply with the GDPR requirements, including the detection of possible violations, with the objective to minimize the risk of sanctions being issued by the supervisory authority; 2) leverage the authorization systems, and in particular the access control ones, to tackle the problem of the GDPR compliance.
Integrating in the BPMN the appropriate mechanisms for GDPR de nition and compliance can provide a number of bene ts: i) it can be used by controllers of personal data for having a clearer view of their duties with respect to data protection in the context of their business; ii) it can be used to check if the BPMN is compliant with the requirements imposed by the GDPR; iii) it can automatically suggest and perform the mandatory activities and obligations to be met to achieve GDPR compliance; iv) it can be used to discover when speci c GDPR obligations are not ful lled at runtime; and nally, v) it can supply auditors and supervisory authorities with a complete view of the process and the procedures adopted for data protection.
The paper is organized as follows: 2 presents the background about the BP modeling, a brief summary of GDPR structure and content and the basic concepts of access control systems; 3 introduces the basic steps of the propose approach; an example in 4 shows how the proposed approach can be used; 5 provides a survey of existing literature concerning the integration GDPR principle into BP; nally, 6 gives a set of conclusions and the envisioned future work. 2
The present work aims at use the authorization systems, and in particular the access control, into a business process so as to model and to provide a presumption of GDPR compliance. There are many possible ways in which the two might be integrated, depending on the speci c purpose; however, all the proposals are based on three building blocks: 1) the model of the business process; 2) the representation of the GDPR; and 3) the access control mechanisms for the enforcement of GDPR requirements.
In the following basic concepts about these three topics are provided. 2.1
Business processes usually refer to any structured collection of related activities
or tasks that are carried out to accomplish the intended objectives of an
organization. The main focus is creating an abstract but meaningful representation of
the real business domains and sharing a formalized de nition, so as to improve
expressiveness and to make easier the development of tools [
Usually, BPMN [
In detail, a BPMN has four categories of graphical elements that can be used to build the diagrams: 1. Flow Objects are associated with the actions that can be performed in a business process and make up the behavior of the BP. They consist of Events, Activities, and Gateways; 2. Connecting Objects can be used to connect elements to each other in three di erent ways: Sequence Flows, Message Flows, and Associations; 3. Swimlanes give the capability of grouping the primary modeling elements.
Swimlanes have two elements through which modelers can group other elements: Pools and Lanes; 4. Artifacts are used to provide additional information about the process that does not a ect the ow.
2.2
General Data Protection Regulation, known also as GDPR, is the new European Union Law (Regulation) for the protection of personal data. GDPR de nes personal data as any information related to an identi ed or identi able natural person called also data subject. This means that a data subject is a Natural Person (a living human being), whose data are managed by a Data Controller. The regulation became into e ect on May 2018 and has replaced the previous Data Protection Directive conceived in 1995. The aim of the new regulation is to strengthen the rights of the individual over their own data and at the same time to make organizations more accountable w.r.t. the previous Directive. In addition, GDPR has also the objective to eliminate all the barriers for the services to be delivered in the European Union and, therefore, to enhance business opportunities within the Digital Single Market. GDPR contributes to the harmonization of the previous fragmented data protection laws across the EU, so to ensure equal protection of Human Rights of the European Citizens.
GDPR is divided into two parts: the rst part is composed by 173 Recitals that explain the motivation of the regulation and the intended achievements; the second part is composed by 99 Articles that represent the code. The GDPR regulation is applied to the processing of personal data, whether it is automated (even partially) or not. The new EU regulation de nes the following principles regarding data and processing: { Transparency, i.e., data must be processed fairly, lawfully and transparently; { Purposes, i.e., data should only be collected for determined, explicit and legitimate purposes, and should not be processed later for other purposes; { Minimization, i.e.,the data processed must be relevant, adequate and limited to what is necessary in view of the purposes for which they are processed; { Accuracy, i.e., the data processed must be accurate and up-to-date regularly; { Retention, i.e., the data must be deleted after a limited period; { Subject explicit consent, i.e.,the data may be collected and processed only if the data subject gives his explicit consent.
To introduce the GDPR requirements in software business process modeling,
an important step is to provide mechanisms to extend the existing models so
as to expressed in legal provisions. Among the currently available proposals, in
this paper we refer to [
Access control system is a way to ensure that access to assets is authorized
and restricted based on business and security requirements (ISO/IEC 27000,
20184). Access Control ensures that only the intended people can access
securityclassi ed data and that these intended users are only given the level of access
required to accomplish their tasks. It is also considered as a fundamental building
block for secure information sharing [
Anaccess control mechanism is de ned as an access control system that
provides a decision to an authorization request, typically based on prede ned
policies. Access control mechanisms are embedded in many di erent systems,
ranging from operating systems to database management systems, and standards
have been proposed [
An access control policy is a speci c statement of what is and is not allowed. Brie y, an XACML policy has a tree structure whose main elements are: PolicySet, Policy, Rule, Target and Condition. The PolicySet includes one or more policies. A Policy contains a Target and one or more rules. The Target species a set of constraints on attributes of a given request. The Rule speci es a Target and a Condition containing one or more boolean functions. If the Condition is evaluated to true, then the Rule's E ect (a value of Permit or Deny) is returned, otherwise a NotApplicable decision is formulated (Indeterminate is returned in case of errors). The PolicyCombiningAlgorithm and the RuleCombiningAlgorithm de ne how to combine the results from multiple policies and rules respectively in to derive a single access result. The anatomy of an access control policy and an access control request is sketched in Figure 1(a). While an example of an XACML policy is provided in Figure 6.
Concerning the architecture, the main components of an XACML-based access control system are shown in Figure 1(b). In particular, the Policy Administration Point (PAP) is the system entity in charge of managing the policies; the Policy Enforcement Point (PEP), usually embedded into an application system, receives the access request in its native format from the requester, constructs an XACML request and sends it to the Policy Decision Point (PDP); the Policy Information Point (PIP) provides the PDP with the values of subject, resource, action and environment attributes; the PDP evaluates the policy against the request and returns the response, including the authorization decision to the PEP. 3
There are di erent proposals addressing speci c data protection principles by
leveraging authorization systems (see for instance [
The proposal of this paper is to move a step ahead and provides a comprehensive methodology that combines, merges and integrates the access control system into the BP so as to address di erent aspects of the GDPR compliance problem. For aim of simplicity, here we restrict ourselves to the GDPR provisions directly related to access control mechanisms.
On the bases of the methodology presented in [
De ne the use case: i.e., analyze the business process activities, often expressed through an existing BPMN so as to establish a common basis to discuss with di erent stakeholders. The purpose here is to leverage the business process to be compliant with the GDPR implementation challenges.
Gather authorization requirements: i.e., gather all the authorization requirements and the sources they come from. In this case, authorization requirements will be expressed in terms of statements or natural language authorization policies. Additionally, business requirements (e.g. working hours) and security best practices (e.g. encrypting data) will be de ned.
Identify required attributes: i.e., identify the BP model activities that can be a ected by GDPR requirements. These will be extended/substituded with sub-processes compliant with the GDPR speci cations so as to enforce the GDPR provisions and make easier requirement reviews. To make easier this step, a pre-de ned set of sub-processes will be provided. Depending on the di erent (industrial) environments, the set will include speci c activities necessary to allow the integration with access control systems.
Author the authorization policies: i.e., to transform the natural language statements into machine-interpretable statements, so as to eliminate any ambiguity introduced by natural language. Thus, a list of XACML policies encoding the GDPR principle will be speci ed and the order in which those policies will be evaluated de ned.
Test the policies: i.e., to ensure that the implemented XACML policy meets the GDPR requirements. For this, state-of-the-art testing techniques will be used or adapted according to speci c exigencies.
Deploy the architecture: i.e., the de nition on the contact point with
existing systems (PEP). A speci c PEP will be de ned for each application that
interacts with the authorization system. From the architectural point of view, the
XACML reference architecture, depicted in Figure 1(b), can be easily integrated
within existing Identity and Access Management (IAM) solutions. A common
threat a ecting the traditional IAMs is that they are mainly based on RBAC
model where the user's access rights are directly assigned to the user by means of
roles and permissions. RBAC model also provides coarse-grain access control,
allowing security managers to implement broad changes. Di erently, ABAC model
adopts a more ne-grain access control, allowing to make authorization decisions
that consider speci c or even complex conditions. More precisely, by adopting
ABAC model and in particular its XACML standard implementation, user's
access rights are the result of a runtime authorization request evaluated against a
set of policies [
Deploy the policies: i.e., deploying the authored XACML policies according to the selected (production) environment.
Run access reviews: an access review consists of an analysis of the policies against a set of attributes to determine what these attributes grant.
In the next section more details about the proposed approach will be provided through a simpli ed running example. 4
In this section, we illustrate the proposed approach through a simple example relative to a standard process for service provisions by a specialist/professional. Thus, the use case considered is represented in Figure 2, where the basic activities have been shown by means of a generic Business Process Model (BPM).
{ Service request, in which the Customer and professional (Seller ) establish the rst contact and agree about the provisioning of a service; { Registration, in which, for starting the collaboration, the Seller collects the Customer data (if he/she has not been already registered for the same service); { Service execution, during this activity the requested service is provided; { Billing, in which the collaboration ends with the production of an invoice. As described in Section 3, during the Gathered authorization requirements step, the GDPR requirements relative to the activities of the BP are explicitly listed. It is part of this stage the identi cation of the data types a ected by privacy constraints, the primary purpose of data collection as well as the optional purposes that could involve the data management. Additionally, the activities related to collecting, reading, storing, transmitting, or deleting personal data that have to be compliant with the de nition provided in GDPR Article 4(2) are also identi ed. In Figure 3(a) the simpli ed version of the consent request form is provided. As in the gure optional purposes can be also included, such as the usage of the customer's e-mail of physical address for sending: i) un-target news or advertisements (Newsletters); ii) speci c target marketing based on the customer's history (Target Marketing). Afterward, during the Identify required attributes step, the activities a ected by GDPR provisions are highlighted in the BP model. These will be substituted or extended by speci c activities or sub-processes to guarantee the GDPR compliance. In the considered example, only the Registration activity has been highlighted as critical from the GDPR point of view (see Figure 4), and therefore, improved with a set of compliant GDPR sub-tasks as shown in 5.
In particular, Figure 5 details the new sub-process provided. Here, the Customer has been identi ed with the data subject and the Seller with the data controller.
In this sub-process, the Seller checks if the Customer has already provided consent to the required service. If not, the Seller prepares the Consent request according to the form shown in Figure 3(a) and sends it to the Customer. This last lls the form with required data (see Figure 3(b)) and sends it back to the Seller.
According to the approach proposed in 3, the task Elaborate data and purposes, in Figure 5, implements the steps from Author the authorization policy to Deploy the policy. It is in charge of converting the information collected into XACML policies/attributes encoding the GDPR principles and, setting up the access control mechanism in order to rule the data access though a common database.Figure 3(c) shows an abstraction of attribute considered for policy speci cation. As in the gure, two additional attributes (Duration and StartingDate) are included in order to satisfy Article 17 of GDPR.
Without going deeply into technical details, in order to integrate the GDPR
principles and articles in the authorization systems di erent steps are necessary:
{ Formally express articles of the GDPR by means of formulas : for this we
rely on the Rei ed Input/Output (RIO) logic [
According to the Test the policy step, before deploy the XACML policy on the access control system, an accurate testing activity is also performed so as to avoid possible security or privacy aws.
Figure 6 shows an extract of the policy derived using the data of Figure 3(c). The extended access control architecture will use the policy for ruling the access to the database so as to guarantee the online GDPR compliance.
Fig. 6. An XACML policy using the data of Figure 3(c). 5
Due to the complexity and the importance of the GDPR application, in recent
years a lot of attention has been devoted to the clari cation of data protection
principles, policies and regulations [
Notwithstanding these important contributions, the integration of data
protection rules into the commonly-used business processes is still an emerging
challenge. In literature, a lot of attention has been devoted either to include generic
privacy aspects into the adopted business process [
This highlights the need of a standard methodology to perform an assessment
of IT systems concerning privacy and security aspects especially targeting the
GDPR requirements. In line with this eld, the proposal of this paper attempts
to make easier the assessment of GDPR requirements, by explicitly integrating
speci ed access control systems into the commonly adopted business process.
In particular, the presented approach aims to integrate and extend the
available proposals promoting business processes and access control systems as a key
solution for privacy issues [
For this purpose, an extension of the XACML reference architecture is
promoted. In literature, there are several proposals aiming to satisfy the GDPR
requirements through improvement of the reference XACML architecture. The
main proposals are: [
Since the GDPR was about to be nalized, theoretical research and industry have started addressing the issue of compliance with the new Regulation. The idea of having integrated solutions that supports compliance throughout the various stages of the software development life cycle of data processing applications is in itself very simple, but its realization is far from that. This paper moved a step ahead in the direction of protection by design by improving the currently adopted security services and access control procedures. The target was to leverage them to the enforcement of GDPR requirements across the business activities related to data management and analysis.
From a technical point of view, the BPMN was selected as the target model to integrate in the business process the access control mechanism. Indeed BPMN is a simple yet e ective means of modelling a ow of activities (both man-made and automated). Of course di erent modeling languages could have been considered. However, the proposal of this paper aimed to focus on the underlying idea than on the technical implementation details.
To exemplify the proposal presented herein, the basic steps of a feasible approach are provided. Moreover, an application example has been used to clarify the adoption of access control systems for protection of personal data during the BPMN modeling and execution.
As a future work, we plan to prototype the proposed approach including the features for: extending the BPMN, highlighting inconsistencies, and enforcing the GDPR concepts into the access control systems.