An Ontology for Privacy Requirements via a Systematic Literature Review

Privacy has emerged as a key concern for business and social computing as security breaches have compromised personal data for millions. Despite this, much of existing work on privacy requirements deal with them as a special case of security requirements, thereby missing essential traits of such requirements. In this context, wrong design decisions may be made due to an insufficient understanding of privacy. The main contribution of this paper is an ontology for privacy requirements that subsumes whatever proposals exist in the literature. The ontology was obtained through a systematic literature review concerning the literature on privacy, conducted in two phases, and followed by a consolidation phase where similar concepts were combined. The proposed ontology has been developed to be used by software engineers when dealing with privacy requirements, and since it is based on a systematic literature review, it is more comprehensive in coverage than all ontologies included in our systematic review. This constitutes a preliminary validity check for the comprehensiveness of our proposal, which needs to be complemented in the future with empirical validation through controlled studies.