In recent decades, privacy-enhancing technologies (PETs) have been recognized as a means of meeting regulatory and user privacy requirements in software systems that process personal data. Despite substantial research efforts, support from regulators, contributions by large technology companies such as Google and Microsoft, and growing interest among software practitioners, the practical adoption of PETs remains limited. Existing research consistently identifies recurring challenges to PETs adoption in SE, such as technical complexity and insufficient training. Despite ongoing research efforts, these challenges largely remain unresolved in practice. In this industrial challenge paper, we apply a practical, requirements engineering (RE)-driven perspective to examine challenges to PET adoption across multiple stakeholder groups (PET developers, integrators, and adopters) as well as across different disciplinary perspectives (engineering, law, and business). We argue that RE can facilitate the adoption of PETs by systematically addressing each of the complementary engineering, business, and legal viewpoints on privacy. Neglecting challenges in any of these viewpoints (e.g., the impact of PETs on software architecture, their business implications, and their contribution to regulatory compliance) can increase the impediments or even lead to implementation failure. In practice, explicit specification of these viewpoints within RE can enable meaningful coordination among stakeholders to more effectively realize the benefits of PETs in software engineering.
翻译:近几十年来,隐私增强技术(PETs)被视为在软件系统中处理个人数据时满足法规和用户隐私需求的一种手段。尽管已有大量研究努力、监管机构的支持、谷歌和微软等大型科技公司的贡献,以及软件从业者日益增长的兴趣,PETs的实际采纳仍十分有限。现有研究一致指出软件工程中PETs采纳面临的反复出现的挑战,例如技术复杂性和培训不足。尽管研究努力持续进行,这些挑战在实践中的大部分仍未解决。在这篇工业挑战论文中,我们采用一种实用的、需求工程(RE)驱动的视角,考察多个利益相关者群体(PET开发者、集成者和采纳者)以及不同学科视角(工程、法律和商业)下PET采纳所面临的挑战。我们认为,RE能够通过系统性地处理隐私的互补工程、商业和法律观点,促进PETs的采纳。忽略其中任一观点中的挑战(例如,PETs对软件架构的影响、其商业含义以及对法规遵从的贡献)可能增加障碍,甚至导致实施失败。在实践中,在RE中明确指定这些观点能够促进利益相关者之间进行有意义的协调,从而更有效地在软件工程中实现PETs的益处。