Transparent Personal Data Processing: The Road Ahead

Piero Bonatti, Sabrina Kirrane, Axel Polleres, Rigo Wenning

Publication: Chapter in book/Conference proceedingContribution to conference proceedings


The European General Data Protection Regulation defines a set of obligations for personal data controllers and processors. Primary obligations include: obtaining explicit consent from the data subject for the processing of personal data, providing full transparency with respect to the processing, and enabling data rectification and erasure (albeit only in certain circumstances). At the core of any transparency architecture is the logging of events in relation to the processing and sharing of personal data. The logs should enable verification that data processors abide by the access and usage control policies that have been associated with the data based on the data subject's consent and the applicable regulations. In this position paper, we: (i) identify the requirements that need to be satisfied by such a transparency architecture, (ii) examine the suitability of existing logging mechanisms in light of said requirements, and (iii) present a number of open challenges and opportunities.
Original languageEnglish
Title of host publication3rd International Workshop on TEchnical and LEgal Aspects of Data pRIvacy and SEcurity (TELERISE 2017)
Editors Stefano Tonetta, Erwin Schoitsch, Friedemann Bitsch
Place of PublicationItalien
Pages337 - 349
Publication statusPublished - 2017

Cite this