Abstract: The number of privacy violations increased by about 70% in 2022, with 45% of companies experiencing such harmful and costly data breaches. These breaches can range from non-compliance with privacy regulations, and mismatches between the actual data practices and their privacy policies, to using malicious or unsuitable third-party libraries. Despite recent advances in privacy engineering research, developers still face several critical challenges in implementing privacy-preserving applications. Most research focuses on detecting violations and non-compliance after deployment rather than mitigating and resolving them prior to or during development.

In this keynote talk, I will first discuss our findings regarding analysts' and developers' degrees of privacy expertise, their challenges, and the tools and solutions they use for developing privacy-preserving applications. Next, I will provide a brief history of privacy engineering solutions that address some of these challenges and questions, as well as their strengths and shortcomings in achieving their objectives. I will then present an overview of the work my team and I conduct to address some of the current shortcomings and obstacles with a particular focus on detecting, classifying, and localizing privacy behaviors during applications' development. Finally, I will discuss key future research directions for the Emerging Security & Privacy Requirements Engineering community.

Sepideh Ghanavati is an assistant professor in computer science at the University of Maine and the director of the Privacy Engineering - Regulatory Compliance Lab (PERC_Lab). Her research is at the intersection of information privacy and security, software engineering, programming comprehension, and natural language processing. Together with her team, they leverage requirements engineering, deep learning, and privacy by design techniques to develop frameworks, methods, and tools to solve some of the problems software analysts, designers, and developers face when protecting users’ privacy, complying with existing laws and regulations, and mitigating and resolving privacy violations. She is a recipient of an NSF CAREER award in 2023 as well as a Google Faculty Research Award and Google's Privacy-related Faculty Award in 2018 and 2021, respectively.

She has more than 18 years of academic and industry experience in privacy, regulatory compliance, and requirements engineering and has published more than 60 peer-reviewed publications. She has been the co-organizer of the Privacy in Natural Language Processing Workshop (PrivateNLP) for the last four years and a reviewer, program committee member, and part of the organizing committee of several journals and conferences such as PoPETS, ICSE, FSE, RE, and TSE.

We received a total of 9 submissions (accepted 4 full papers, 2 short papers, from 6 countries, 5 universities and 2 industries).

Short Papers (20 minutes, including Q's & A's)

Analysis of information security measures embedded in the GDPR, Jan Willemson. (Cybernetica, Estonia)

Towards a Basic Security Framework for SMEs – Results From an Investigation of Cybersecurity Challenges in Denmark, Camilla Nadja Fleron, Jonas Kofod Jørgensen, Oksana Kulyk and Elda Paja. (IT University of Copenhagen, Denmark)

See the schedule below for other details