A Privacy Policy Model for Enterprises

Privacy is an increasing concern in the marketplace. Although enterprises promise sound privacy practices to their customers, there is no technical mechanism to enforce them internally. In this paper, we describe a privacy policy model that protects personal data from privacy violations by means of enforcing enterprise-wide privacy policies. By extending Jajodia et al.’s Flexible Authorization Framework (FAF) with grantors and obligations, we create a privacy control language that includes user consent, obligations, and distributed administration. Conditions impose restrictions on the use of the collected data, such as modeling guardian consent and options. Access decisions are extended with obligations, which list a set of activities that must be executed together with the access request. Grantors allow to define a separation of duty between the security officer and the privacy officer. To appear in 15th IEEE Computer Security Foundations Workshop, June 24–26, 2002 c IEEE Comp...

• Type: Conference
• Year: 2002
• Where: CSFW
• Authors: Günter Karjoth, Matthias Schunter
• Keywords: CSFW 2002, Enterprise-wide Privacy Policies, Privacy, Security Privacy, Sound Privacy Practices