A systematic literature review of security and privacy by design principles, norms, and strategies for digital technologies

A systematic literature review of security and privacy by design principles, norms, and strategies for digital technologies external link

Del-Real, C., Busser, E. de & Berg, B. van den

International Review of Law, Computers & Technology, vol. 39, iss. : 3, pp: 374-405, 2025

Abstract

This paper offers a comparative systematic literature review of the key principles, norms, and strategies associated with Security by Design (SbD) and Privacy by Design (PbD). Both frameworks are grounded in the idea that security and privacy should be integral components of digital technologies from the very beginning of the design process. Following PRISMA guidelines, we reviewed 82 documents sourced from databases such as the ACM Digital Library, EBSCO Library, IEEE Xplore, ProQuest, Scopus, and Web of Science. Our analysis reveals that SbD and PbD share four fundamental principles: prevention/proactiveness, embeddedness, user-centricity, and transparency. The review also highlights the solid regulatory foundation of PbD, particularly under the General Data Protection Regulation (GDPR), compared to the emerging regulatory context for SbD. Additionally, we explore a range of strategies, from organizational cultural changes to technical interventions, that illustrate the nuanced approaches taken to implement these paradigms. We conclude by discussing the broader implications of these findings and suggesting directions for future research, aiming to contribute to the development of technologies that are both secure and respectful of privacy, while also advocating for integrated frameworks that enhance digital trust.

Links

Privacy, Software design

RIS

TY  - JOUR
AU  - Del-Real, C.
AU  - Busser, E. de
AU  - Berg, B. van den
PY  - 2025
DA  - 2025-01-31
T1  - A systematic literature review of security and privacy by design principles, norms, and strategies for digital technologies
JO  - International Review of Law, Computers & Technology
VL  - 39
IS  - 3
SP  - 374-405
UR  - https://www.tandfonline.com/doi/full/10.1080/13600869.2025.2457227
DO  - https://doi.org/10.1080/13600869.2025.2457227
AB  - This paper offers a comparative systematic literature review of the key principles, norms, and strategies associated with Security by Design (SbD) and Privacy by Design (PbD). Both frameworks are grounded in the idea that security and privacy should be integral components of digital technologies from the very beginning of the design process. Following PRISMA guidelines, we reviewed 82 documents sourced from databases such as the ACM Digital Library, EBSCO Library, IEEE Xplore, ProQuest, Scopus, and Web of Science. Our analysis reveals that SbD and PbD share four fundamental principles: prevention/proactiveness, embeddedness, user-centricity, and transparency. The review also highlights the solid regulatory foundation of PbD, particularly under the General Data Protection Regulation (GDPR), compared to the emerging regulatory context for SbD. Additionally, we explore a range of strategies, from organizational cultural changes to technical interventions, that illustrate the nuanced approaches taken to implement these paradigms. We conclude by discussing the broader implications of these findings and suggesting directions for future research, aiming to contribute to the development of technologies that are both secure and respectful of privacy, while also advocating for integrated frameworks that enhance digital trust.
K1  - Privacy
K1  - Software design
ER  -

Save .RIS

Bibtex

Article{nokey,
	title = {A systematic literature review of security and privacy by design principles, norms, and strategies for digital technologies},
	author = {Del-Real, C. and Busser, E. de and Berg, B. van den},
	doi = {https://doi.org/10.1080/13600869.2025.2457227},
	year = {2025},
	date = {2025-01-31},
	journal = {International Review of Law, Computers & Technology},
	volume = {39},
	issue = {3},
	pages = {374-405},
	abstract = {This paper offers a comparative systematic literature review of the key principles, norms, and strategies associated with Security by Design (SbD) and Privacy by Design (PbD). Both frameworks are grounded in the idea that security and privacy should be integral components of digital technologies from the very beginning of the design process. Following PRISMA guidelines, we reviewed 82 documents sourced from databases such as the ACM Digital Library, EBSCO Library, IEEE Xplore, ProQuest, Scopus, and Web of Science. Our analysis reveals that SbD and PbD share four fundamental principles: prevention/proactiveness, embeddedness, user-centricity, and transparency. The review also highlights the solid regulatory foundation of PbD, particularly under the General Data Protection Regulation (GDPR), compared to the emerging regulatory context for SbD. Additionally, we explore a range of strategies, from organizational cultural changes to technical interventions, that illustrate the nuanced approaches taken to implement these paradigms. We conclude by discussing the broader implications of these findings and suggesting directions for future research, aiming to contribute to the development of technologies that are both secure and respectful of privacy, while also advocating for integrated frameworks that enhance digital trust.},
	keywords = {Privacy, Software design},
}

Save .bib

Dun & Bradstreet: A Pyrrhic Victory for the Contestation of AI under the GDPR external link

Metikoš, L.

The Law, Ethics & Policy of AI Blog, 2025

Abstract

The CJEU’s ruling in Dun & Bradstreet clarifies how the GDPR’s ‘right to an explanation’ should enable individuals to contest AI-based decision-making. It states that explanations need to be understandable while also respecting trade secrets and privacy concerns in a balanced manner. However, the Court excludes the disclosure of in-depth technical information and also introduces a burdensome balancing procedure. These requirements both strengthen and weaken the ability of individuals to independently assess impactful AI systems, leading to a pyrrhic victory for contestation.

Links

https://www.law.kuleuven.be/ai-summer-school/blogpost/Blogposts/dun-bradstreet-a-pyrrhic-victory-for-the-contestation-of-ai-under-the-gdpr

Artificial intelligence, GDPR, Privacy

RIS

Save .RIS

Bibtex

Save .bib

De Commissie Persoonsgegevens Amsterdam: adviesmodel voor complexe gegevensverwerkingen door overheden? download

Janssen, H.

Privacy & Informatie, iss. : 1, pp: 1-2, 2025

Links

Privacy&Informatie_2025_1

Personal data, Privacy

RIS

Save .RIS

Bibtex

Save .bib

The Right to an Explanation in Practice: Insights from Case Law for the GDPR and the AI Act external link

Metikoš, L. & Ausloos, J.

Law, Innovation, and Technology , pp: 1-36, 2025

Abstract

The right to an explanation under the GDPR has been much discussed in legal-doctrinal scholarship. This paper expands upon this academic discourse, by providing insights into what questions the application of the right to an explanation has raised in legal practice. By looking at cases brought before various judicial bodies and data protection authorities across the European Union, we discuss questions regarding the scope, content, and balancing exercise of the right to an explanation. We argue, moreover, that these questions also raise important interpretative issues regarding the right to an explanation under the AI Act. Similar to the GDPR, the AI Act's right to an explanation leaves many legal questions unanswered. Therefore, the insights from the already established case law under the GDPR, can help us to understand better how the AI Act's right to an explanation should be understood in practice.

Links

AI Act, case law, GDPR, Privacy

RIS

TY  - JOUR
AU  - Metikoš, L.
AU  - Ausloos, J.
PY  - 2025
DA  - 2025-03-13
T1  - The Right to an Explanation in Practice: Insights from Case Law for the GDPR and the AI Act
JO  - Law, Innovation, and Technology 
SP  - 1-36
UR  - https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4996173
DO  - https://doi.org/10.1080/17579961.2025.2469349
AB  - The right to an explanation under the GDPR has been much discussed in legal-doctrinal scholarship. This paper expands upon this academic discourse, by providing insights into what questions the application of the right to an explanation has raised in legal practice. By looking at cases brought before various judicial bodies and data protection authorities across the European Union, we discuss questions regarding the scope, content, and balancing exercise of the right to an explanation. We argue, moreover, that these questions also raise important interpretative issues regarding the right to an explanation under the AI Act. Similar to the GDPR, the AI Act\'s right to an explanation leaves many legal questions unanswered. Therefore, the insights from the already established case law under the GDPR, can help us to understand better how the AI Act\'s right to an explanation should be understood in practice.
K1  - AI Act
K1  - case law
K1  - GDPR
K1  - Privacy
ER  -

Save .RIS

Bibtex

Article{nokey,
	title = {The Right to an Explanation in Practice: Insights from Case Law for the GDPR and the AI Act},
	author = {Metikoš, L. and Ausloos, J.},
	url = {https://www.tandfonline.com/doi/full/10.1080/17579961.2025.2469349},
	doi = {https://doi.org/10.1080/17579961.2025.2469349},
	year = {2025},
	date = {2025-03-13},
	journal = {Law, Innovation, and Technology },
	pages = {1-36},
	abstract = {The right to an explanation under the GDPR has been much discussed in legal-doctrinal scholarship. This paper expands upon this academic discourse, by providing insights into what questions the application of the right to an explanation has raised in legal practice. By looking at cases brought before various judicial bodies and data protection authorities across the European Union, we discuss questions regarding the scope, content, and balancing exercise of the right to an explanation. We argue, moreover, that these questions also raise important interpretative issues regarding the right to an explanation under the AI Act. Similar to the GDPR, the AI Act\'s right to an explanation leaves many legal questions unanswered. Therefore, the insights from the already established case law under the GDPR, can help us to understand better how the AI Act\'s right to an explanation should be understood in practice.},
	keywords = {AI Act, case law, GDPR, Privacy},
}

Save .bib

Annotatie bij EHRM 9 maart 2023 (LB / Hongarije) download

Dommering, E.

Nederlandse Jurisprudentie, iss. : 15, num: 144, pp: 3352-3354, 2024

Abstract

Openbaar maken persoonsgegevens wegens belastingschuld. Bescherming persoonlijke data. Belang van toetsing in individuele gevallen. Margin of appreciation. Schending van art. 8 EVRM. Grote Kamer.

Links

Annotatie_NJ_2024_144

Human rights, Privacy

RIS

Save .RIS

Bibtex

Save .bib

The Right to Root: Constructing a Claim to Control Devices from the Right to Privacy download

van Daalen, O.

JIPITEC, vol. 14, iss. : 4, pp: 580-593, 2023

Abstract

Empowering people with digital tools has been an enduring ideal throughout the history of computing. In some of the earlier visions, this was not only a matter of making life easier, it was also a matter of people gaining control over their digital tools. One solution to this problem which has been suggested is to provide users with a manual override to gain full control over a device, something called gaining 'root' - hence the 'Right to Root'. Yet, there are no policymakers who have seriously treated this as a possibility. For people pushing this right at a policy level, it would therefore be helpful to know whether this Right to Root can be constructed from human rights. In this article, I explore the European human rights-based arguments for a Right to Root, focusing on the right to privacy under the European Convention for Human Rights and the Charter of Fundamental Rights. I first discuss the origins of this ideal of gaining control over your own devices. I then show how users over the years have gained less control and how the RIght to Root could enable them to regain control. I then explore how the Right to Root could be constructed from the right to privacy under the Convention and the Charter, by understanding it as a way to protect the values of autonomy, self-determination and seclusion. I conclude that a Right to Root can be grounded in the human right to privacy, but that further research is necessary to balance it with other interests, such as cybersecurity, traffic safety, health and intellectual property.

Links

JIPITEC_2023_4

Privacy

RIS

TY  - JOUR
AU  - van Daalen, O.
PY  - 2023
DA  - 2023-12-12
T1  - The Right to Root: Constructing a Claim to Control Devices from the Right to Privacy
JO  - JIPITEC
VL  - 14
IS  - 4
SP  - 580-593
UR  - https://www.ivir.nl/publications/the-right-to-root-constructing-a-claim-to-control-devices-from-the-right-to-privacy/jipitec_2023_4/
AB  - Empowering people with digital tools has been an enduring ideal throughout the history of computing. In some of the earlier visions, this was not only a matter of making life easier, it was also a matter of people gaining control over their digital tools. One solution to this problem which has been suggested is to provide users with a manual override to gain full control over a device, something called gaining \'root\' - hence the \'Right to Root\'. Yet, there are no policymakers who have seriously treated this as a possibility. For people pushing this right at a policy level, it would therefore be helpful to know whether this Right to Root can be constructed from human rights. In this article, I explore the European human rights-based arguments for a Right to Root, focusing on the right to privacy under the European Convention for Human Rights and the Charter of Fundamental Rights. I first discuss the origins of this ideal of gaining control over your own devices. I then show how users over the years have gained less control and how the RIght to Root could enable them to regain control. I then explore how the Right to Root could be constructed from the right to privacy under the Convention and the Charter, by understanding it as a way to protect the values of autonomy, self-determination and seclusion. I conclude that a Right to Root can be grounded in the human right to privacy, but that further research is necessary to balance it with other interests, such as cybersecurity, traffic safety, health and intellectual property.
K1  - Privacy
ER  -

Save .RIS

Bibtex

Article{nokey,
	title = {The Right to Root: Constructing a Claim to Control Devices from the Right to Privacy},
	author = {van Daalen, O.},
	year = {2023},
	date = {2023-12-12},
	journal = {JIPITEC},
	volume = {14},
	issue = {4},
	pages = {580-593},
	abstract = {Empowering people with digital tools has been an enduring ideal throughout the history of computing. In some of the earlier visions, this was not only a matter of making life easier, it was also a matter of people gaining control over their digital tools. One solution to this problem which has been suggested is to provide users with a manual override to gain full control over a device, something called gaining \'root\' - hence the \'Right to Root\'. Yet, there are no policymakers who have seriously treated this as a possibility. For people pushing this right at a policy level, it would therefore be helpful to know whether this Right to Root can be constructed from human rights. In this article, I explore the European human rights-based arguments for a Right to Root, focusing on the right to privacy under the European Convention for Human Rights and the Charter of Fundamental Rights. I first discuss the origins of this ideal of gaining control over your own devices. I then show how users over the years have gained less control and how the RIght to Root could enable them to regain control. I then explore how the Right to Root could be constructed from the right to privacy under the Convention and the Charter, by understanding it as a way to protect the values of autonomy, self-determination and seclusion. I conclude that a Right to Root can be grounded in the human right to privacy, but that further research is necessary to balance it with other interests, such as cybersecurity, traffic safety, health and intellectual property.},
	keywords = {Privacy},
}

Save .bib