Assessing Software Privacy using the Privacy Flow-Graph

TL;DR

This paper introduces an automatic static analysis method that generates understandable privacy flow-graphs from software, aiding both technical and non-technical stakeholders in documenting privacy compliance for regulations like GDPR.

Contribution

The work presents a novel static analysis technique that produces privacy flow-graphs to facilitate privacy documentation and collaboration across technical and legal teams.

Findings

Applied to Signal and NextCloud, producing detailed privacy flow-graphs.

Demonstrated how flow-graphs assist in writing DPIAs.

Facilitated understanding of privacy data flows for non-technical users.

Abstract

We increasingly rely on digital services and the conveniences they provide. Processing of personal data is integral to such services and thus privacy and data protection are a growing concern, and governments have responded with regulations such as the EU's GDPR. Following this, organisations that make software have legal obligations to document the privacy and data protection of their software. This work must involve both software developers that understand the code and the organisation's data protection officer or legal department that understands privacy and the requirements of a Data Protection and Impact Assessment (DPIA). To help developers and non-technical people such as lawyers document the privacy and data protection behaviour of software, we have developed an automatic software analysis technique. This technique is based on static program analysis to characterise the flow of privacy-related data. The results of the analysis can be presented as a graph of privacy flows and operations - that is understandable also for non-technical people. We argue that our technique facilitates collaboration between technical and non-technical people in documenting the privacy behaviour of the software. We explain how to use the results produced by our technique to answer a series of privacy-relevant questions needed for a DPIA. To illustrate our work, we show both detailed and abstract analysis results from applying our analysis technique to the secure messaging service Signal and to the client of the cloud service NextCloud and show how their privacy flow-graphs inform the writing of a DPIA.