Towards a Risk-Driven Methodology for Privacy Metrics Development

Large amounts of privacy-critical data are transferred, processed and stored in services like cloud computing. Sufficient and credible evidence of the actual privacy level of these kinds of services is needed to be able meet the increased privacy requirements. In this study, we propose a generic risk-driven methodology for development of privacy metrics. The methodology is based on privacy threat analysis, utilization of taxonomical information, and decomposition of privacy and system requirements. The stages of the methodology are discussed using cloud services as an example. Moreover, feasibility of the proposed approach is discussed.