A new paper is now available online by Empirical Software Engineering: “Privacy by designers: software developers’ privacy mindset“. The paper was led by Irit Hadar, and co-authored by Tomer Hasson, Oshrat Ayalon, Eran Toch, Michael Birnhack, Sofia Sherman, and Arod Balissa. In the paper, we have interviewed 27 senior software developers and architects and qualitatively analyzed how they perceive privacy in their personal and professional lives, and how privacy is managed in their organization. We see that the participants tend to focus on the security aspects of privacy, and downplay many important aspects of privacy (such as user consent to data collection). We also learn that organizations influence the privacy of the systems mainly through “privacy climate” rather than direct requirements or regulation.

 

The paper is published online and the bibtex citation can be downloaded from here.

Citation: Hadar, I., Hasson, T., Ayalon, O., Toch, E., Birnhack, M., Sherman, S., & Balissa, A. (2017). Privacy by designers: software developers’ privacy mindset. Empirical Software Engineering, 1-31.

Abstract

Privacy by design (PbD) is a policy measure that guides software developers to apply inherent solutions to achieve better privacy protection. For PbD to be a viable option, it is important to understand developers’ perceptions, interpretation and practices as to informational privacy (or data protection). To this end, we conducted in-depth interviews with 27 developers from different domains, who practice software design. Grounded analysis of the data revealed an interplay between several different forces affecting the way in which developers handle privacy concerns. Borrowing the schema of Social Cognitive Theory (SCT), we classified and analyzed the cognitive, organizational and behavioral factors that play a role in developers’ privacy decision making. Our findings indicate that developers use the vocabulary of data security to approach privacy challenges, and that this vocabulary limits their perceptions of privacy mainly to third-party threats coming from outside of the organization; that organizational privacy climate is a powerful means for organizations to guide developers toward particular practices of privacy; and that software architectural patterns frame privacy solutions that are used throughout the development process, possibly explaining developers’ preference of policy-based solutions to architectural solutions. Further, we show, through the use of the SCT schema for framing the findings of this study, how a theoretical model of the factors that influence developers’ privacy practices can be conceptualized and used as a guide for future research toward effective implementation of PbD.