IEEE Technology and Society Magazine - December 2020 - 70

Privacy by Design and Default
Based on the conducted research, the main research
question has been answered; the requirements ensuring GDPR-compliance have been mentioned above. To
summarize, if a malware/stegomalware detection solution is to be GDPR-compliant, its administrator has to
first run a DPIA. What information is being collected and
how it is treated must be checked. If remediation or
some re-design is needed, it is advisable to work closely
with DPOs and legal counsel to decide upon the most
favorable course of action. Then, a crucial decision has
to be made whether the solution is to collect personal
data. It can be done under users' consent (if so, a special, clear data protection statement/license agreement,
etc., must be applied) or justified properly according to
the lawful basis defined by the GDPR. Alternatively, the
malware detection solution may be designed in such a
way that it does not process any personal data. Lastly,
the administrators may decide to process personal data
but employ technical solutions like encryption, pseudonymization, and the like, in order to ensure the data is
safe and will prove useless in case any breach occurs.
All in all, although ensuring GDPR compliance when
creating intrusion detections tools may seem to be an
arduous task, it is achievable. In order to do it, one has to
bear in mind a number of recommendations and, from
initial concept to the final product, develop the system
that will protect privacy " by design and by default. "

Acknowledgment
This work is funded under SIMARGL project, which has
received funding from the European Union's Horizon
2020 research and innovation programme under grant
agreement No. 833042.

Author Information
Aleksandra Pawlicka is with iTTi, Rubiez˙ 46, Poznan´ 61-612,
Poland. Email: apawlicka@itti.com.pl.
Dagmara Jaroszewska-Choras´ is with Kazimierz Wielki
University, Institute of Law and Economics, Bydgoszcz, Poland.
Michał Choras´ is with FernUniversität, Hagen, Germany
and UTP University of Science and Technology, Bydgoszcz,
Poland.
Marek Pawlicki is with ITTI, Poznan´, Poland and UTP University of Science and Technology, Bydgoszcz, Poland.

References
[1] A. T. Tunggal, " Why is cybersecurity important?, " 2019. [Online].
Available: https://www.upguard.com/blog/cybersecurity-important.
[2] A. Button English, " Five reasons cyber security is more important
than ever, " 2018. [Online]. Available: https://www.consultancy.uk/
news/18435/five-reasons-cyber-security-is-more-important-than-ever.
[3] Official Journal of the European Union, L 319.
[4] D. Taurino, " Compliance GPDR for regional airports, " 2018. [Online].
Available: https://dblue.it/consultings/consulting-compliance-gpdr
-regional-airports/.

70

[5] M. F. A. Razak, N. B. Anuar, R. Salleh, and A. Firdaus, " The rise of
'malware': Bibliometric analysis of malware study, " J. Netw. Comput.
Appl., vol. 75, pp. 58-76, Nov. 2016.
[6] G. Suarez-Tangil, J. E. Tapiador, and P. Peris-Lopez, " Stegomalware: Playing hide and seek with malicious components in smartphone apps, " 2015, pp. 496-515.
[7] J. Jansen and L. Rutger, " Phishing and malware attacks on online
banking customers in the Netherlands: A qualitative analysis of factors
leading to victimization, " Int. J. Cyber Criminol., vol. 10, no. 1, 2016.
[8] D. Manky, " Malware payloads hide in images: Steganography gets
a reboot, " ThreatPost, 2019.
[9] E. Boucas, " A guide to the must-have security tools for GDPR compliance, " CPO Mag., 2018.
[10] C. F. Mondschein and C. Monda, " The EU " s General Data Protection Regulation (GDPR) in a research context, " in Fundamentals of
Clinical Data Science, P. Kubben, M. Dumontier, and A. Dekker, Eds.
Springer, 2019, p. 56.
[11] Charter of Fundamental Rights of the European Union, Official
Journal of the European Union, C 202, 7.06.2016. 2016, pp. 389-405.
[12] Consolidated version of the Treaty on the Functioning of
the European Union, Official Journal of the European Union, C
202, 7.6.2016. pp. 1-351.
[13] M. Foulsham, " Living with the New General Data Protection Regulation (GDPR), " in Financial Compliance, Issues, Concerns and
Future Directions, M. Krambia-Kapardis, Ed. Springer Nature Switzerland AG, 2019, p. 115.
[14] A. Kosatka, " General Data Protection Regulation (GDPR): It " s
A European thing. Or not., " 2018. [Online]. Available: https://www
.aviationpros.com/airports/blog/12437083/general-data-protection
-regulation-gdpr-its-a-european-thing-or-not.
[15] G. Malgieri, " Automated decision-making in the EU Member
States: The right to explanation and other 'suitable safeguards' in the
national legislations, " Comput. Law Secur. Rev., vol. 35, no. 5, p.
105327, Oct. 2019.
[16] A. Lifely and W. Robertson, " Blog: Smart airports and the importance of data, " Airport World, 2017.
[17] European Data Protection Board, Guidelines 4/2019 on
Article 25 Data Protection by Design and by Default.
[18] Council Directive 93/13/EEC of 5 April 1993 on unfair
terms in consumer contracts (OJ L 95, 21.4.1993). 1993, p. 29.
[19] B. Wolford, " What is GDPR, the EU " s new data protection law?, "
2019. [Online]. Available: https://gdpr.eu/what-is-gdpr/.
[20] Article 29 Data Protection Working Party Guidelines on Data Pro-
tection Impact Assessment (DPIA) and determining whether process-
ing is " likely to result in a high risk " for the purposes of Regulation
2016/679, Adopted on 4 April 2017, As last Revised and A. p. 4.
[21] Osterman Research Inc., " GDPR compliance and its impact on
security and data protection programs, " 2017.
[22] T. Greene, " Rethinking toxic data in light of GDPR, " Security
Week, 2017.
[23] " An Introduction to EU GDPR Email Requirements, " Titan HQ
Spam Titan, 2019. [Online]. Available: https://www.spamtitan.com/
gdpr-email-requirements/.
[24] J. Tolbert, " Will your security solutions violate GDPR?, " Kupping-
ercole Analysis, 2018. [Online]. Available: https://www.kuppingercole
.com/blog/tolbert/will-your-security-solutions-violate-gdpr. [Accessed:
22-Oct-2019].
[25] E. Politou, E. Alepis, and C. Patsakis, " Forgetting personal data
and revoking consent under the GDPR: Challenges and proposed
solutions, " J. Cybersecurity, vol. 4, no. 1, Jan. 2018.
[26] Y. Atmaça, " Importance of " The General Data Protection Regulation " in Cyber Security World, " 2019. [Online]. Available: https://
www.cyberdefensemagazine.com/importance-of-the-general-data
-protection-regulation-in-cyber-security-world/.
[27] Sandvine, " The Global Internet Phenomena Report, " 2018.
[28] Panda Mediacenter, " Encrypted malware: a threat facilitated by
the GDPR?, " 2019. [Online]. Available: https://www.pandasecurity
.com/mediacenter/malware/encrypted-malware-facilitated-gdpr/.
[29] O. Yaacoubi, " The hidden threat in GDPR " s encryption push, "
PrivSecReport, 2019. [Online]. Available: https://gdpr.report/
news/2019/01/08/the-hidden-threat-in-gdprs-encryption-push/.

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

∕

DECEMBER 2020

https://www.aviationpros.com/airports/blog/12437083/general-data-protection-regulation-gdpr-its-a-european-thing-or-not https://www.aviationpros.com/airports/blog/12437083/general-data-protection-regulation-gdpr-its-a-european-thing-or-not https://www.aviationpros.com/airports/blog/12437083/general-data-protection-regulation-gdpr-its-a-european-thing-or-not https://www.gdpr.eu/what-is-gdpr/ https://www.spamtitan.com/gdpr-email-requirements/ https://www.spamtitan.com/gdpr-email-requirements/ https://www.kuppingercole.com/blog/tolbert/will-your-security-solutions-violate-gdpr https://www.kuppingercole.com/blog/tolbert/will-your-security-solutions-violate-gdpr https://www.cyberdefensemagazine.com/importance-of-the-general-data-protection-regulation-in-cyber-security-world/ https://www.cyberdefensemagazine.com/importance-of-the-general-data-protection-regulation-in-cyber-security-world/ https://www.cyberdefensemagazine.com/importance-of-the-general-data-protection-regulation-in-cyber-security-world/ https://www.upguard.com/blog/cybersecurity-important https://www.consultancy.uk/news/18435/five-reasons-cyber-security-is-more-important-than-ever https://www.pandasecurity.com/mediacenter/malware/encrypted-malware-facilitated-gdpr/ https://www.consultancy.uk/news/18435/five-reasons-cyber-security-is-more-important-than-ever https://www.pandasecurity.com/mediacenter/malware/encrypted-malware-facilitated-gdpr/ https://www.gdpr.report/news/2019/01/08/the-hidden-threat-in-gdprs-encryption-push/ https://www.dblue.it/consultings/consulting-compliance-gpdr-regional-airports/ https://www.gdpr.report/news/2019/01/08/the-hidden-threat-in-gdprs-encryption-push/ https://www.dblue.it/consultings/consulting-compliance-gpdr-regional-airports/

IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020