Articles in Press

Accepted articles here

Latest Issues

Volume 17 Issue 1

Volume 16 Issue 3
Volume 16 Issue 2
Volume 16 Issue 1

Volume 15 Issue 3
Volume 15 Issue 2
Volume 15 Issue 1

Volume 14 Issue 3
Volume 14 Issue 2
Volume 14 Issue 1

Volume 13 Issue 3
Volume 13 Issue 2
Volume 13 Issue 1

Volume 12 Issue 3
Volume 12 Issue 2
Volume 12 Issue 1

Volume 11 Issue 3
Volume 11 Issue 2
Volume 11 Issue 1

Volume 10 Issue 3
Volume 10 Issue 2
Volume 10 Issue 1

Volume 9 Issue 3
Volume 9 Issue 2
Volume 9 Issue 1

Volume 8 Issue 3
Volume 8 Issue 2
Volume 8 Issue 1

Volume 7 Issue 3
Volume 7 Issue 2
Volume 7 Issue 1

Volume 6 Issue 3
Volume 6 Issue 2
Volume 6 Issue 1

Volume 5 Issue 3
Volume 5 Issue 2
Volume 5 Issue 1

Volume 4 Issue 3
Volume 4 Issue 2
Volume 4 Issue 1

Volume 3 Issue 3
Volume 3 Issue 2
Volume 3 Issue 1

Volume 2 Issue 3
Volume 2 Issue 2
Volume 2 Issue 1

Volume 1 Issue 3
Volume 1 Issue 2
Volume 1 Issue 1

Volume 16 Issue 2

Identifying the Context of Data Usage to Diagnose Privacy Issues through Process Mining

Azadeh Sadat Mozafari Mehr^(a),(*), Renata M. de Carvalho^(a), Boudewijn van Dongen^(a)

Transactions on Data Privacy 16:2 (2023) 123 - 151

Abstract, PDF

(a) Department of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, The Netherlands.

e-mail:a.s.mozafari.mehr @tue.nl; r.carvalho @tue.nl; b.f.v.dongen @tue.nl

Abstract

In recent years, data privacy issues are increasingly concerned by organisations and governments. Organisations often define a set of rules as privacy policies for protecting sensitive data of their business. Regulations like the European General Data Protection Regulation (GDPR) added another layer of importance to data security emphasizing personal data protection, making it not only a business requirement but also a legal requirement. Existing access control mechanisms are not sufficient for data protection. They are only preventive and cannot guarantee that data is accessed for the intended purposes. This paper presents the underlying theory of a novel approach for multi-perspective conformance checking which considers the process control-flow, data and privacy perspectives simultaneously. In addition to detecting deviations in each perspective, the approach is able to detect hidden deviations where non-conformity relates to either a combination of two or all three aspects of a business process. Moreover, by reconciling the process, data and privacy aspects, it can detect spurious data access and identify privacy infringements where data have been processed for unclear or secondary purposes by an authorised role. The approach has been implemented in the open source ProM framework and was evaluated through controlled experiments using synthetic and real logs.

^* Corresponding author.

Follow us

Supports