The Never-Ending Story: On the Need for Continuous Privacy Impact Assessment

The importance of privacy by design has increased with initiatives such as the General Data Protection Regulation (GDPR). While static, design-level assessment of privacy aspects provides considerable benefits in the creation of privacy-preserving software-intensive systems, operational aspects that are difficult to predict at design-time also play a key role. This is particularly true in the instance of privacy impact or privacy risk: while existing approaches succeed fairly well in assessing the overall risk from a static design context, they are not well suited to capture risk elements that are dynamic and often impossible to foresee.In this position paper, we highlight this problem at the basis of a number of realistic motivational scenarios and outline our vision towards continuous privacy impact assessment and risk management.