A natural language-based method to specify privacy requirements: an evaluation with practitioners

IF 2.1 3区计算机科学 Q3 COMPUTER SCIENCE, INFORMATION SYSTEMS

Requirements Engineering Pub Date : 2024-07-19 DOI:10.1007/s00766-024-00428-z

Mariana Peixoto, Tony Gorschek, Daniel Mendez, Davide Fucci, Carla Silva

{"title":"A natural language-based method to specify privacy requirements: an evaluation with practitioners","authors":"Mariana Peixoto, Tony Gorschek, Daniel Mendez, Davide Fucci, Carla Silva","doi":"10.1007/s00766-024-00428-z","DOIUrl":null,"url":null,"abstract":"Organisations are becoming concerned with effectively dealing with privacy-related requirements. Existing Requirements Engineering methods based on structured natural language suffer from several limitations both in eliciting and specifying privacy requirements. In our previous study, we proposed a structured natural-language approach called the “Privacy Criteria Method” (PCM), which demonstrates potential advantages over user stories. Our goal is to present a PCM evaluation that focused on the opinions of software practitioners from different companies on PCM’s ability to support the specification of privacy requirements and the quality of the privacy requirements specifications produced by these software practitioners. We conducted a multiple case study to evaluate PCM in four different industrial contexts. We gathered and analysed the opinions of 21 practitioners on PCM usage regarding Coverage, Applicability, Usefulness, and Scalability. Moreover, we assessed the syntactic and semantic quality of the PCM artifacts produced by these practitioners. PCM can aid developers in elaborating requirements specifications focused on privacy with good quality. The practitioners found PCM to be useful for their companies’ development processes. PCM is considered a promising method for specifying privacy requirements. Some slight extensions of PCM may be required to tailor the method to the characteristics of the company.","PeriodicalId":20912,"journal":{"name":"Requirements Engineering","volume":"25 1","pages":""},"PeriodicalIF":2.1000,"publicationDate":"2024-07-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Requirements Engineering","FirstCategoryId":"94","ListUrlMain":"https://doi.org/10.1007/s00766-024-00428-z","RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}

引用次数: 0

Abstract

Organisations are becoming concerned with effectively dealing with privacy-related requirements. Existing Requirements Engineering methods based on structured natural language suffer from several limitations both in eliciting and specifying privacy requirements. In our previous study, we proposed a structured natural-language approach called the “Privacy Criteria Method” (PCM), which demonstrates potential advantages over user stories. Our goal is to present a PCM evaluation that focused on the opinions of software practitioners from different companies on PCM’s ability to support the specification of privacy requirements and the quality of the privacy requirements specifications produced by these software practitioners. We conducted a multiple case study to evaluate PCM in four different industrial contexts. We gathered and analysed the opinions of 21 practitioners on PCM usage regarding Coverage, Applicability, Usefulness, and Scalability. Moreover, we assessed the syntactic and semantic quality of the PCM artifacts produced by these practitioners. PCM can aid developers in elaborating requirements specifications focused on privacy with good quality. The practitioners found PCM to be useful for their companies’ development processes. PCM is considered a promising method for specifying privacy requirements. Some slight extensions of PCM may be required to tailor the method to the characteristics of the company.

Abstract Image

查看原文本刊更多论文

基于自然语言的隐私要求指定方法：对从业人员的评估

企业开始关注如何有效处理与隐私相关的需求。现有的基于结构化自然语言的需求工程方法在激发和指定隐私需求方面都存在一些局限性。在我们之前的研究中，我们提出了一种名为 "隐私标准法"（PCM）的结构化自然语言方法，它展示了与用户故事相比的潜在优势。我们的目标是对 PCM 进行评估，重点关注来自不同公司的软件从业人员对 PCM 支持隐私要求规范的能力以及这些软件从业人员所编写的隐私要求规范的质量的看法。我们开展了一项多案例研究，在四个不同的行业环境中对 PCM 进行评估。我们收集并分析了 21 位从业人员对 PCM 的使用在覆盖性、适用性、实用性和可扩展性方面的意见。此外，我们还评估了这些从业人员制作的 PCM 工具的语法和语义质量。PCM 可以帮助开发人员高质量地制定以隐私为重点的需求规格。实践者发现，PCM 对他们公司的开发流程非常有用。PCM 被认为是一种很有前途的隐私需求说明方法。可能需要对 PCM 稍作扩展，使该方法适合公司的特点。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

Requirements Engineering 工程技术-计算机：软件工程

CiteScore

7.10

自引率

10.70%

发文量

审稿时长

>12 weeks

期刊介绍： The journal provides a focus for the dissemination of new results about the elicitation, representation and validation of requirements of software intensive information systems or applications. Theoretical and applied submissions are welcome, but all papers must explicitly address: -the practical consequences of the ideas for the design of complex systems -how the ideas should be evaluated by the reflective practitioner The journal is motivated by a multi-disciplinary view that considers requirements not only in terms of software components specification but also in terms of activities for their elicitation, representation and agreement, carried out within an organisational and social context. To this end, contributions are sought from fields such as software engineering, information systems, occupational sociology, cognitive and organisational psychology, human-computer interaction, computer-supported cooperative work, linguistics and philosophy for work addressing specifically requirements engineering issues.