Abstract

Privacy-aware processing of personal data on the web of services re-quires managing a number of issues arising both from the technical and the legal domain. Several approaches have been proposed to matching privacy requirements (on the clients side) and privacy guarantees (on the service provider side). Still, the assurance of effective data pro-tection (when possible) relies on substantial human effort and exposes organizations to significant (non-)compliance risks. In this paper we put forward the idea that a privacy certification scheme producing and managing machine-readable artifacts in the form of privacy certificates can play an important role towards the solution of this problem. Dig-ital privacy certificates represent the reasons why a privacy property holds for a service and describe the privacy measures supporting it. Also, privacy certificates can be used to automatically select services whose certificates match the client policies (privacy requirements). Our proposal relies on an evolution of the conceptual model devel-oped in the Assert4Soa project and on a certificate format specif-ically tailored to represent privacy properties. To validate our ap-proach, we present a worked-out instance showing how privacy prop-erty Retention-based unlinkability can be certified for a banking finan-cial service. ∗A revised version of this manuscript will appear in the Proceedings of the International Conference on Secure Virtual Infrastructures (DOA Trusted Cloud ’13) to be held on 9-10 September 2013, in Graz, Austria. If you wish to refer to this work, please cite [2] instead. ar