Using Static Code Analysis for GDPR Compliance Checks
摘要
Ensuring compliance with the General Data Protection Regulation (GDPR) remains a labor-intensive activity, especially in large applications. Moreover, legal experts often do not have the technical knowledge to assess source code. Privacy threat modeling can be used to systematically guide the assessment of privacy threats in designs and code, but it is time-intensive and needs to be redone for changes. In this paper, we build on an existing approach to automate privacy threat modelling using static code analysis and extend it for GDPR compliance checks. We first derive code properties from individual GDPR articles, implement them in a static code analysis tool, and propose queries for the automated analysis of source code. Finally, we evaluate the results using a novel test suite.