Privacy Risk Assessment in Privacy Requirements Engineering

Abstract

In spite of the overlap between privacy requirements engineering and security requirements engineering, each addresses a different set of problems. As a result, security risk assessment techniques used in security requirements engineering may be unsuitable to assess privacy risks. This paper proposes considering security risk assessment along with privacy impact and risk assessment approaches using the Security Quality Requirements Engineering (SQUARE) method. The study focuses on PIA and HIPAA as privacy risk assessment techniques.