[Paper Review] Privacy Engineering Meets Software Engineering. On the Challenges of Engineering Privacy ByDesign

Blagovesta Kostova, Seda Gürses+1 more|arXiv (Cornell University)|Jul 16, 2020

Privacy, Security, and Data Protection78 references17 citations

TL;DR

This paper identifies a critical misalignment between academic privacy engineering research and real-world software development practices, particularly agile, service-oriented architectures. It proposes that privacy research must integrate software engineering realities—such as distributed teams, third-party services, and iterative development—to enable practical deployment of privacy-preserving technologies.

ABSTRACT

Current day software development relies heavily on the use of service architectures and on agile iterative development methods to design, implement, and deploy systems. These practices result in systems made up of multiple services that introduce new data flows and evolving designs that escape the control of a single designer. Academic privacy engineering literature typically abstracts away such conditions of software production in order to achieve generalizable results. Yet, through a systematic study of the literature, we show that proposed solutions inevitably make assumptions about software architectures, development methods and scope of designer control that are misaligned with current practices. These misalignments are likely to pose an obstacle to operationalizing privacy engineering solutions in the wild. Specifically, we identify important limitations in the approaches that researchers take to design and evaluate privacy enhancing technologies which ripple to proposals for privacy engineering methodologies. Based on our analysis, we delineate research and actions needed to re-align research with practice, changes that serve a precondition for the operationalization of academic privacy results in common software engineering practices.

Motivation & Objective

• To identify the core misalignments between academic privacy engineering research and current software engineering practices, especially in agile and service-oriented development.
• To analyze how assumptions in privacy research—such as centralized control and static system specifications—undermine the feasibility of deploying privacy solutions in practice.
• To propose a research agenda that reorients privacy engineering toward real-world software engineering constraints, including modularity, evolution, and distributed trust.
• To advocate for standards, regulation, and tooling that align technical privacy solutions with existing engineering workflows and principles like purpose limitation.
• To enable the operationalization of privacy-by-design by addressing challenges in legacy systems, continuous integration, and third-party service composition.

Proposed method

• Conducted a systematic literature review of privacy technologies and privacy engineering methodologies to identify implicit assumptions about software architecture and development processes.
• Mapped the differences between idealized privacy research models (e.g., monolithic, single-developer systems) and real-world software systems (e.g., microservices, third-party components, agile teams).
• Analyzed the impact of agile development and service-oriented architectures on threat modeling, data flows, and privacy guarantees.
• Proposed a research agenda focused on empirical studies of privacy in real engineering contexts, including measurement of data flows and developer practices.
• Explored technical solutions such as composable privacy-enhancing technologies (PETs), privacy-preserving monitoring, and testing frameworks for PET composition.
• Advocated for integrating privacy engineering into existing software engineering practices, including brownfield retrofitting and support for dark launches and continuous integration.

Experimental results

Research questions

• RQ1 How do current privacy engineering methodologies fail to account for the realities of modern software development, such as microservices and agile methodologies?
• RQ2 What are the key technical and organizational challenges that prevent the operationalization of privacy research in real-world systems?
• RQ3 How can privacy-preserving technologies be designed to be composable, updatable, and compatible with service orchestration and choreography?
• RQ4 In what ways can regulatory principles like purpose limitation be technically enforced within agile, distributed software ecosystems?
• RQ5 What role can standards and developer tooling play in aligning privacy engineering with existing software engineering practices?

Key findings

• Privacy research commonly assumes a monolithic, single-developer system with full control, which does not reflect the reality of distributed, service-based, and agile software development.
• The shift to service architectures introduces new data flows and entities outside the control of privacy engineers, fundamentally altering threat models and undermining static privacy guarantees.
• Agile development’s iterative and evolving nature conflicts with privacy engineering frameworks that assume stable, fixed system specifications.
• Existing privacy research often treats software engineering as a black box, neglecting how development practices impact the feasibility and deployment of privacy solutions.
• There is a critical need for empirical research on privacy in real engineering contexts, including measurement of data flows and developer workflows in service ecosystems.
• Future progress depends on integrating privacy engineering with existing software engineering practices—such as continuous integration, dark launches, and legacy system retrofitting—through tooling, standards, and composable PETs.