CoChat
Sign Up
Cited by 51Blockchain Technology Applications and SecurityCloud Data Security SolutionsDigitalization, Law, and Regulation

Tracking GDPR Compliance in Cloud-Based Service Delivery

Open access
Barati, Masoud, Rana, Omer·2022·IEEE Transactions on Services Computing
DOI 10.1109/tsc.2020.2999559
Open this paper in CoChat — free account

Abstract

The European General Data Protection Regulation (GDPR) has had a far-reaching impact on data privacy and compliance for cloud providers. GDPR influences access to, storage, processing and transmission of personal data, requiring these operations to be verified by a cloud user through explicit consent prior to execution. GDPR rules implemented for such operations can be ambiguous and often open to interpretation, making manual verification a time consuming and error prone process for cloud providers. An encoding of GDPR rules is described, with each operation carried out using these rules recorded into a Blockchain for auditing purposes. Specifically, this work shows how some GDPR rules can appear asopcodesin smart contracts to verify the operations of providers on user data in a transparent and automatic way. An abstract model is designed to demonstrate how cloud providers can access and deploy such smart contracts through a Blockchain-based virtual machine. A case study is used to demonstrate how this approach can be used in practice. The case study uses a collection of design patterns and smart contracts to verify provider operations, includingread,write,executionandtransferon user data. Validation is undertaken by deploying the smart contracts in a Blockchain test network to investigate the execution costs of GDPR compliance checking.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/tsc.2020.2999559

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The UK Data Protection Act defines personal data information as a collection of relevant data of a living natural person through which a natural person can be identified, including the expression of any views of the person concerned and the intention of that person or others.

    “in the Data Protection Act of the United Kingdom, it is clear that personal data information refers to a collection of the relevant data of a living natural person through which a natural person can be identified, including the expression of any views of the person concerned and the intention of that person or others [110].”

    From A Survey of IoT Privacy Security: Architecture, Technology, Challenges, and Trends (2024) · cites this paper as [110]

    The paper’s discussion of GDPR says a data subject can be identified directly or indirectly through a name, location, or IP address, supporting the identifiability aspect. It does not state a definition from the UK Data Protection Act or mention the person’s views or intentions as part of that definition. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 28

  1. [1]Z. Zheng, S. Xie, H. Dai, X. Chen, and H. Wang, An overview of Blockchain technology: Architecture, consensus, and future trends, in Proc. of the IEEE 6th International Congress on Big Data, Honolulu, USA, 2017, pp. 557–564.
  2. [9]T. Salman, M. Zolanvar, A. Erbad, R. Jain, and M. Samaka, Security services using Blockchains: A state of the art survey, IEEE Communications Surveys and Tutorials, 2018.
  3. [10]M. Corrales, P. Jurcys and G. Kousiouris, Smart contracts and smart disclosure: Coding a GDPR compliance framework, SSRN Electronic Journal, 2018.
  4. [11]S. Kirkman and R. Newman, Using smart contracts and Blockchains to support consumer trust across distributed clouds, in Proc. of the 13th International Conference on Grid, Cloud, and Cluster Computing, Las Vegas, NV, 2017, pp. 10–16.
  5. [15]B. Russo, L. Valle, G. Bonzagni, D. Locatello, M. Pancaldi, and D. Tosi, Cloud computing and the new EU general data protection regulation, IEEE Cloud Computing, vol. 5, no. 6, pp. 58–68, 2018.
  6. [16]M. Virvou and E. Mougiakou, Based on GDPR privacy in UML: Case of e-learning program, in Proc. of the 8th International Conference on Information, Intelligence, Systems & Applications, Larnaca, Cyprus, 2017.
  7. [17]R. Neisse, G. Steri, and I. Nai-Fovino, A Blockchain-based ap-proach for data accountability and provenance tracking, in Proc. of the 12th International Conference on Availability, Reliability and Security, Reggio Calabria, Italy, 2017. 14
  8. [18]D. Ulybyshev, M. Villarreal-Vasquez, B. Bhargava, G. Mani, S. Seaberg, P. Conoval, R. Pike, and J. Kobes, (WIP) Blockhub: Blockchain-based software development system for untrusted en-vironments, in Proc. of the 11th International Conference on Cloud Computing, San Francisco, CA, 2018, pp. 582–585.
  9. [19]B. Faber, G. Michelet, N. Weidmann, R. R. Mukkamala, and R. Vatrapu, BPDIMS: A Blockchain-based personal data and identity management system, in Proc. of the 52nd Hawaii In-ternational Conference on System Sciences, Hawaii, USA, 2019, pp. 6855–6864.
  10. [20]N. Al-Zaben, M. M. H. Onik, J. Yang, N-Y. Lee, and C-S. Kim, General data protection regulation complied Blockchain archi-tecture for personally identifiable information management, in Proc. of the International Conference on Computing, Electronics & Communications Engineering, Southend, UK, 2018, pp. 77–82.
  11. [22]G. Zyskind, O. Nathan, and A. S. Pentland, Decentralizing privacy: Using Blockchain to protect personal data, in Proc. of the IEEE Security and Privacy Workshop, CA, USA, 2015, pp. 180– 184.
  12. [23]M. Barati, O. Rana, G. Theodorakopoulos, and P. Burnap, Privacy-aware cloud ecosystems and GDPR compliance, in Proc. of the 7th International Conference on Future Internet of Things and Cloud, Istanbul, Turkey, 2019, pp. 117–124.
  13. [24]T. Al Said, O. F. Rana, and P. Burnap, VMInformant: An instrumented virtual machine to support trustworthy cloud com-puting, International Journal of High Performance Computing & Networking (IJHPCN), vol. 8, no. 3, pp. 222–234, 2015.
  14. [25]S. Hosseinzadeh, S. Laur´ en, and V. Lepp¨ anen, Security in container-based virtualization through vTPM, in Proc. of the 9th International Conference on Utility Cloud Computing, Shanghai, China, 2016, pp. 214–219.
  15. [27]E. Bacis, S. Mutti, S. Capelli, and S. Paraboschi, DockerPolicy-Modules: Mandatory access control for docker containers, in Proc. of the International Conference on Communications and Network Security, Florence, Italy, 2015, pp. 749–750.
  16. [28]Y. Sun, D. Safford, M. Zohar, D. Pendarakis, Z. Gu, and T. Jaeger, Security namespace: making linux security frameworks available to containers, in Proc. of the 27th USENIX Security Symposium, Baltimore, USA, 2018, pp. 1423–1439.
  17. [32]C. Esposito, A. De Santis, G. Tortora, H. Chang, and K-K R. Choo, Blockchain: A panacea for healthcare cloud-based data security and privacy?, IEEE Cloud Computing, vol. 5, no. 1, pp. 31–37, 2018.
  18. [34]Z. Wu, A. B. Williams, and D. Perouli, Dependable public ledger for policy compliance, a Blockchain based approach, in Proc. of the 39th International Conference on Distributed Computing Systems, Dallas, TX, 2019, pp. 1891–1900.
  19. [35]S. Kirkman, A data movement policy framework for improving trust in the cloud using smart contracts and Blockchains, in Proc. of the IEEE International Conference on Cloud Engineering, Orlando, FL, 2018, pp. 270–273.
  20. [36]S. Singh , I-H. Ra, W. Meng, M. Kaur, and G. H. Cho, SH-BlockCC: A secure and efficient Internet of things smart home ar-chitecture based on cloud computing and Blockchain technology, International Journal of Distributed Sensor Networks, vol. 15, no. 4, 2019.
  21. [37]Q. Xia, E. B. Sifah, A. Smahi, S. Amofa, and X. Zhang, BBDS: Blockchain-based data sharing for electronic medical records in cloud environments, Information, vol. 8, no. 2, p. 44, 2017.
  22. [38]H. Desai, K. Liu, M. Kantarcioglu, and L. Kagal, En-forceable data sharing agreements using smart contracts, arXiv:1804.10645v1[cs.CY ], 2018. · arXiv
  23. [39]S. Kirkman and R. Newman, A cloud data movement pol-icy architecture based on smart contracts and the Ethereum Blockchain, in Proc. of the IEEE International Conference on Cloud Engineering, Orlando, FL, 2018, pp. 371–377.
  24. [40]X. Liang, S. Shetty, D. Tosh, C. Kamhoua, K. Kwiat, and L. Njilla, ProvChain: A Blockchain-based data provenance architec-ture in cloud environment with enhanced privacy and availabil-ity, in Proc. of the 17th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing, Madrid, Spain, 2017, pp. 468–477.
  25. [41]X. Zheng, R. R. Mukkamala, R. Vatrapu, and J. Ordieres-Mere, Blockchain-based personal health data sharing system using cloud storage, in Proc. of the 20th International Conference on e-Health Networking, Applications and Services (Healthcom), Ostrava, Czech Republic, 2018.
  26. [42]M. Davari and E. Bertino, Access control model extensions to support data privacy protection based on GDPR, in Proc. of the Int. Conf. on Big Data, Los Angeles, CA, 2019, pp. 4017–4024.
  27. [43]F. Zemler and M. Westner, Blockchain and GDPR: Application scenarios and compliance requirements, in Proc. of the Portland Int. Conf. on Management of Engineering and Technology, Port-land, OR, 2019.
  28. [44]N. B. Truong, K. Sun, G. M. Lee, and Y. Guo, GDPR-compliant personal data management: A Blockchain-based solution, IEEE Trans. on Information Forensics & Security, vol. 15, pp. 1746– 1761, 2020. Masoud Barati received the PhD degree in computer science from Sherbrooke University, Canada, in 2018. He is currently a Research Associate with the School of Computer Science & Informatics, CardiffUniversity. His research in-terests include distributed systems, Blockchain, formal methods, and cybersecurity. Omer Rana received the PhD degree in “neu-ral computing and parallel architectures” from the Imperial College, University of London. He is a professor of performance engineering in the School of Computer Science & Informat-ics, CardiffUniversity & a member of Cardiff University’s “Data Innovation Institute”. His research interests include distributed systems, Blockchain, and scalable data analysis.

Cited by

Sorted by citations

Authors
Barati, M., & Rana, O.
Affiliations
Cardiff University (GB)
ORCID
Venue
IEEE Transactions on Services Computing
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2022-05-01
Volume
15
Issue
3
Pages
1498-1511
ISSN
  • 1939-1374 (ISSN-L)
  • 2372-0204
DOI
10.1109/tsc.2020.2999559
OpenAlex
W3033084289
Cited by
51
References
3
Citations by year
2026: 5 · 2025: 11 · 2024: 9 · 2023: 13 · 2022: 4 · 2021: 8 · 2012: 1
FWCI
5.89
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Transactions on Services Computing (publishedVersion)
  • ORCA Online Research @Cardiff (Cardiff University) (acceptedVersion)
  • ORCA Online Research @Cardiff (Cardiff University) (submittedVersion)
  • Research Output (Edinburgh Napier University) (submittedVersion)
  • Edinburgh Napier Research Repository (Edinburgh Napier University) (submittedVersion)
  • Newcastle University ePrints (Newcastle Univesity)
Funders
Engineering and Physical Sciences Research Council (EP/R033439/1)
Topics
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
  • Social Sciences › Law › Digitalization, Law, and Regulation
Keywords
GDPR compliance, data privacy, cloud service providers, blockchain, smart contracts, personal data processing, compliance audit, data protection regulation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review