The Community for Technology Leaders
RSS Icon
Subscribe
Chicago, IL, USA USA
Sept. 24, 2012 to Sept. 28, 2012
ISBN: 978-1-4673-2783-1
pp: 91-100
Travis D. Breaux , Institute for Software Research, Carnegie Mellon University, Pittsburgh, United States of America
ABSTRACT
Companies that own, license, or maintain personal information face a daunting number of privacy and security regulations. Companies are subject to new regulations from one or more governing bodies, when companies introduce new or existing products into a jurisdiction, when regulations change, or when data is transferred across political borders. To address this problem, we developed a framework called “requirements water marking” that business analysts can use to align and reconcile requirements from multiple jurisdictions (municipalities, provinces, nations) to produce a single high or low standard of care. We evaluate the framework in an empirical case study conducted over a subset of U.S. data breach notification laws that require companies to secure their data and notify consumers in the event of data loss or theft. In this study, applying our framework reduced the number of requirements a company must comply with by 76% across 8 jurisdictions. We show how the framework surfaces critical requirements trade-offs and potential regulatory conflicts that companies must address during the reconciliation process. We summarize our results, including surveys of information technology law experts to contextualize our empirical results in legal practice.
INDEX TERMS
conflicts, legal requirements, requirements comparison, requirements reconciliation
CITATION
Travis D. Breaux, "Reconciling multi-jurisdictional legal requirements: A case study in requirements water marking", RE, 2012, 2013 21st IEEE International Requirements Engineering Conference (RE), 2013 21st IEEE International Requirements Engineering Conference (RE) 2012, pp. 91-100, doi:10.1109/RE.2012.6345843
53 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool