Chicago, IL, USA USA
Sept. 24, 2012 to Sept. 28, 2012
David G. Gordon , Engineering and Public Policy, Carnegie Mellon University, Pittsburgh, United States of America
Travis D. Breaux , Institute for Software Research, Carnegie Mellon University, Pittsburgh, United States of America
Companies that own, license, or maintain personal information face a daunting number of privacy and security regulations. Companies are subject to new regulations from one or more governing bodies, when companies introduce new or existing products into a jurisdiction, when regulations change, or when data is transferred across political borders. To address this problem, we developed a framework called “requirements water marking” that business analysts can use to align and reconcile requirements from multiple jurisdictions (municipalities, provinces, nations) to produce a single high or low standard of care. We evaluate the framework in an empirical case study conducted over a subset of U.S. data breach notification laws that require companies to secure their data and notify consumers in the event of data loss or theft. In this study, applying our framework reduced the number of requirements a company must comply with by 76% across 8 jurisdictions. We show how the framework surfaces critical requirements trade-offs and potential regulatory conflicts that companies must address during the reconciliation process. We summarize our results, including surveys of information technology law experts to contextualize our empirical results in legal practice.
conflicts, legal requirements, requirements comparison, requirements reconciliation
David G. Gordon, Travis D. Breaux, "Reconciling multi-jurisdictional legal requirements: A case study in requirements water marking", RE, 2012, 2013 21st IEEE International Requirements Engineering Conference (RE), 2013 21st IEEE International Requirements Engineering Conference (RE) 2012, pp. 91-100, doi:10.1109/RE.2012.6345843