Document Open Access Logo

Global Miscommunication in Privacy Requirements Engineering: Legal Experts’ Experiences Collaborating with Software Engineers

Authors Claudia Negri-Ribalta , Ioana Visescu , Muriel-Larissa Frank , Anastasia Sergeeva , Alberto García Simon , Rene Noel , Lorena Sánchez Chamorro

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.14.pdf
  • Filesize: 0.81 MB
  • 22 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Security and privacy → Social aspects of security and privacy
  • Software and its engineering → Requirements analysis
  • Human-centered computing → User studies
Keywords
  • data protection
  • mental models
  • privacy
  • collaboration

Metrics

Abstract

Background. Regulatory data protection requirements (RDPRs) impose requirements on organizations, which translate into technical and organizational measures for their information systems (IS). Meeting these requirements necessitates the collaboration between interdisciplinary teams of lawyers and software engineers. Previous studies indicate that engineers often struggle to interpret and translate RDPRs. Conversely, little is known about the experiences of lawyers when working on RDPRs in interdisciplinary teams, even though their legal interpretations shape the requirements imposed on IS.

Aim. Therefore, this paper seeks to unpack the challenges that lawyers face when collaborating with software engineers to implement data protection requirements and to put them in motion in case of privacy breaches.

Method. Through a deductive qualitative analysis, this paper analyzes semi-structured interviews with 70 data protection lawyers from 25 countries.

Results. Our findings highlight that lawyers throughout regions and regardless of their cultural background describe similar challenges when collaborating with engineers: a lack of shared language and mental models. Lawyers also point out that engineers misunderstand RDPRs for various reasons, not just a lack of education. Furthermore, we identify the key elements that hinder or facilitate collaboration and their implications for privacy engineering. Conclusions: This study is a large qualitative research with participants from multiple countries. Our results suggest that lawyers perceive different challenges when collaborating with software engineers, regardless of their culture. These results suggest these challenges are structural rather than cultural. Organizations should prioritize developing methods and artifacts to overcome these challenges.

Cite As Get BibTex

Claudia Negri-Ribalta, Ioana Visescu, Muriel-Larissa Frank, Anastasia Sergeeva, Alberto García Simon, Rene Noel, and Lorena Sánchez Chamorro. Global Miscommunication in Privacy Requirements Engineering: Legal Experts’ Experiences Collaborating with Software Engineers. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 14:1-14:22, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.14

Author Details

Claudia Negri-Ribalta
  • ULIDE, University of Luxembourg, Luxembourg
Ioana Visescu
  • ULIDE, University of Luxembourg, Luxembourg
Muriel-Larissa Frank
  • FINATRAX, SnT, University of Luxembourg, Luxembourg
Anastasia Sergeeva
  • IRiSC, SnT, University of Luxembourg, Luxembourg
Alberto García Simon
  • Polytechnic University of Valencia, Spain
Rene Noel
  • Escuela de Ingeniería Informática, Universidad de Valparaíso, Chile
Lorena Sánchez Chamorro
  • Human-Media Interaction Research Group, University of Twente, The Netherlands

Funding

  • Negri-Ribalta, Claudia: This project has received funding from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie Actions grant agreement 101081455
  • Frank, Muriel-Larissa: This research was funded in part by the Luxembourg National Research Fund (FNR) and PayPal, PEARL grant ref. 13342933/Gilbert Fridgen.
  • Chamorro, Lorena Sánchez: This work has been conducted under the realm of the RESOCIAL project, funded by the Dutch Research Council NWO under the Synergy Theme: Vulnerability and resilience in an online society (grant number NWA.1540.21.001)

Acknowledgements

The authors would like to thank Dr. Marius Lombard-Platet for his support.

Supplementary Materials

References

  1. Simone Agostinelli, Fabrizio Maria Maggi, Andrea Marrella, and Francesco Sapio. Achieving gdpr compliance of bpmn process models. In Information Systems Engineering in Responsible Information Systems: CAiSE Forum 2019, Rome, Italy, Proceedings 31. Springer, 2019. Google Scholar
  2. Vanessa Ayala-Rivera and Liliana Pasquale. The grace period has ended: An approach to operationalize gdpr requirements. In 2018 IEEE 26th International Requirements Engineering Conference (RE), pages 136-146, 2018. URL: https://doi.org/10.1109/RE.2018.00023.
  3. Earl R Babbie. The practice of social research. Cengage learning, 2020. Google Scholar
  4. Kathrin Bednar, Sarah Spiekermann, and Marc Langheinrich. Engineering privacy by design: Are engineers ready to live up to the challenge? The Information Society, 35(3):122-142, 2019. URL: https://doi.org/10.1080/01972243.2019.1583296.
  5. Andrea J Bingham. From data management to actionable findings: A five-phase process of qualitative data analysis. International journal of qualitative methods, 22:16094069231183620, 2023. Google Scholar
  6. Anu Bradford. The Brussels effect: How the European Union rules the world. Oxford University Press, 2020. Google Scholar
  7. Travis Breaux and Annie Antón. Analyzing regulatory rules for privacy and security requirements. IEEE transactions on software engineering, 34(1):5-20, 2008. URL: https://doi.org/10.1109/TSE.2007.70746.
  8. Travis Breaux and Thomas Norton. Legal accountability as software quality: A u.s. data processing perspective. In International Requirements Engineering Conference (RE). IEEE, 2022. Google Scholar
  9. Travis D Breaux and Annie I Antón. A systematic method for acquiring regulatory requirements: A frame-based approach. RHAS-6, Delhi, India, 2007. Google Scholar
  10. Daniela Damian and James Chisan. An empirical study of the complex relationships between requirements engineering processes and other processes that lead to payoffs in productivity, quality, and risk management. IEEE Trans. Software Eng., 32:433-453, July 2006. URL: https://doi.org/10.1109/TSE.2006.61.
  11. Kezia Devathasan, Nowshin Nawar Arony, Emerson Murphy-Hill, and Daniela Damian. Empathy, self-determination and motivation: moderating diversity for enhanced performance in software development teams. Empirical Software Engineering, 30(3):82, 2025. URL: https://doi.org/10.1007/S10664-025-10632-2.
  12. Luce Drouet, Froukje Sleeswijk Visser, Brian Pagán, and Carine Lallemand. Towards a mapping of empathic design methods. In DRS Conference Proceedings. Design Research Society, 2024. Google Scholar
  13. Eduarda Elger and Victor Araya Santander. A engenharia de requisitos e a lei geral de proteção de dados (lgpd): Uma revisão sistemática da literatura. In Congresso Latino-Americano de Software Livre e Tecnologias Abertas (Latinoware), pages 1-10. SBC, 2024. Google Scholar
  14. European Union. Regulation (EU) 2016/678 of the european parliament and of the council - general data protection regulation. Google Scholar
  15. Stephen T Fife and Jacob D Gossner. Deductive qualitative analysis: Evaluating, expanding, and refining theory. International Journal of Qualitative Methods, 23:16094069241244856, 2024. Google Scholar
  16. Adebola Folorunso, Viqaruddin Mohammed, Ifeoluwa Wada, and Bunmi Samuel. The impact of iso security standards on enhancing cybersecurity posture in organizations. World Journal of Advanced Research and Reviews, 24(1):2582-2595, 2024. Google Scholar
  17. Raphaël Gellert and Serge Gutwirth. The legal construction of privacy and data protection. Computer Law & Security Review, 29(5):522-530, 2013. URL: https://doi.org/10.1016/J.CLSR.2013.07.005.
  18. Mohamad Gharib, Paolo Giorgini, and John Mylopoulos. Ontologies for privacy requirements engineering: A systematic literature review. arXiv preprint arXiv:1611.10097, 2016. URL: https://arxiv.org/abs/1611.10097.
  19. Martin Glinz and Samuel A Fricker. On shared understanding in software engineering: an essay. Computer Science-Research and Development, 30:363-376, 2015. URL: https://doi.org/10.1007/S00450-014-0256-X.
  20. Geetika Gopi, Aadyaa Maddi, Omkhar Arasaratnam, and Giulia Fanti. Privacy requirements and realities of digital public goods. In Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), pages 159-177, 2024. URL: https://www.usenix.org/conference/soups2024/presentation/gopi.
  21. Giancarlo Guizzardi and Nicola Guarino. Explanation, semantics, and ontology. Data & Knowledge Engineering, page 102325, 2024. URL: https://doi.org/10.1016/J.DATAK.2024.102325.
  22. Giancarlo Guizzardi, Gerd Wagner, João Paulo Andrade Almeida, and Renata SS Guizzardi. Towards ontological foundations for conceptual modeling: The unified foundational ontology (ufo) story. Applied ontology, 10(3-4):259-271, 2015. URL: https://doi.org/10.3233/AO-150157.
  23. Irit Hadar, Tomer Hasson, Oshrat Ayalon, Eran Toch, Michael Birnhack, Sofia Sherman, and Arod Balissa. Privacy by designers: software developers’ privacy mindset. Empirical Software Engineering, 23(1):259-289, 2018. URL: https://doi.org/10.1007/S10664-017-9517-1.
  24. Kalle Hjerppe, Jukka Ruohonen, and Ville Leppanen. The general data protection regulation: Requirements, architectures, and constraints. In 2019 IEEE 27th International Requirements Engineering Conference (RE), pages 265-275. IEEE, September 2019. URL: https://doi.org/10.1109/RE.2019.00036.
  25. Oleksandra Klymenko, Oleksandr Kosenkov, Stephen Meisenbacher, Parisa Elahidoost, Daniel Mendez, and Florian Matthes. Understanding the implementation of technical measures in the process of data privacy compliance: A qualitative study. In Proceedings of the 16th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement, ESEM '22, pages 261-271, New York, NY, USA, 2022. Association for Computing Machinery. URL: https://doi.org/10.1145/3544902.3546234.
  26. Meira Levy and Irit Hadar. The importance of empathy for analyzing privacy requirements. In 2018 IEEE 5th International Workshop on Evolving Security & Privacy Requirements Engineering (ESPRE), pages 9-13, August 2018. URL: https://doi.org/10.1109/ESPRE.2018.00008.
  27. Katja Mruck and Franz Breuer. Subjectivity and reflexivity in qualitative research - a new fqs issue. Historical Social Research, 28(3):189-212, 2003. URL: https://doi.org/10.12759/hsr.28.2003.3.189-212.
  28. Claudia Negri-Ribalta, Marius Lombard-Platet, and Camille Salinesi. Understanding the gdpr from a requirements engineering perspective—a systematic mapping study on regulatory data protection requirements. Requirements Engineering, pages 1-27, 2024. Google Scholar
  29. Claudia Negri-Ribalta, Rene Noel, Oscar Pastor, and Camille Salinesi. An empirical study on socio-technical modeling for interdisciplinary privacy requirements. In CooppIS. Springer, 2023. Google Scholar
  30. Leysan Nurgalieva, Alisa Frik, and Gavin Doherty. A narrative review of factors affecting the implementation of privacy and security practices in software development. ACM Comput. Surv., 55(14s):320:1-320:27, July 2023. URL: https://doi.org/10.1145/3589951.
  31. Klaus Pohl. Requirements engineering: fundamentals, principles, and techniques. Springer Publishing Company, Incorporated, 2010. Google Scholar
  32. Maxwell Prybylo, Sara Haghighi, Sai Teja Peddinti, and Sepideh Ghanavati. Evaluating privacy perceptions, experience, and behavior of software development teams. In Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), pages 101-120, 2024. URL: https://www.usenix.org/conference/soups2024/presentation/prybylo.
  33. Rivka Ribak. Translating privacy: developer cultures in the global world of practice. Information, Communication & Society, 22(6):838-853, May 2019. URL: https://doi.org/10.1080/1369118X.2019.1577475.
  34. Marco Robol, Mattia Salnitri, and Paolo Giorgini. Toward gdpr-compliant socio-technical systems: modeling language and reasoning framework. In IFIP Working Conference on The Practice of Enterprise Modeling, pages 236-250. Springer, 2017. URL: https://doi.org/10.1007/978-3-319-70241-4_16.
  35. Awanthika Senarath and Nalin A. G. Arachchilage. Why developers cannot embed privacy into software systems? an empirical investigation. In Proceedings of the 22nd International Conference on Evaluation and Assessment in Software Engineering 2018, EASE’18, pages 211-216, New York, NY, USA, 2018. Association for Computing Machinery. URL: https://doi.org/10.1145/3210459.3210484.
  36. Swapneel Sheth, Gail Kaiser, and Walid Maalej. Us and them: A study of privacy requirements across north america, asia, and europe. In Proceedings of the 36th International Conference on Software Engineering, ICSE 2014, pages 859-870, New York, NY, USA, 2014. Association for Computing Machinery. URL: https://doi.org/10.1145/2568225.2568244.
  37. Martina Siclari, Sylvain Lannier, Olivier Voordeckers, Stanislaw Tosza, Sallam Abualhaija, Michele Ceci, Nicolas Sannier, and Domenico Bianculli. Beyond silos: Bridging the gap between law and software engineering – challenges, successes, and lesson drawing. Internet Policy Review, 14(4), 2025. URL: https://doi.org/10.14763/2025.4.2042.
  38. Hardial Singh. The importance of cybersecurity frameworks and constant audits for identifying gaps, meeting regulatory and compliance standards. In Meeting Regulatory and Compliance Standards (November 10, 2022), 2022. Google Scholar
  39. Daniel J Solove. A taxonomy of privacy. University of Pennsylvania law review, 2006. Google Scholar
  40. Sarah Spiekermann, Jana Korunovska, and Marc Langheinrich. Inside the organization: Why privacy and security engineering is a challenge for engineers. Proceedings of the IEEE, 107(3):600-615, March 2019. URL: https://doi.org/10.1109/JPROC.2018.2866769.
  41. Per Erik Strandberg. Ethical interviews in software engineering. In 2019 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), pages 1-11. IEEE, 2019. URL: https://doi.org/10.1109/ESEM.2019.8870192.
  42. Alistair Sutcliffe. Collaborative requirements engineering: bridging the gulfs between worlds. In Intentional Perspectives on Information Systems Engineering, pages 355-376. Springer, 2010. URL: https://doi.org/10.1007/978-3-642-12544-7_20.
  43. Mohammad Tahaei, Alisa Frik, and Kami Vaniea. Privacy champions in software teams: Understanding their motivations, strategies, and challenges. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, CHI ’21, pages 1-15, New York, NY, USA, May 2021. Association for Computing Machinery. URL: https://doi.org/10.1145/3411764.3445768.
  44. Damiano Torre, Mauricio Alferez, Ghanem Soltana, Mehrdad Sabetzadeh, and Lionel Briand. Modeling data protection and privacy: application and experience with gdpr. Software and Systems Modeling, 20:2071-2087, 2021. URL: https://doi.org/10.1007/S10270-021-00935-5.
  45. Ibo Van de Poel. Investigating ethical issues in engineering design. Science and engineering ethics, 7(3):429-446, 2001. Google Scholar
  46. Colin Werner, Laura Okpara, Klaas-Jan Stol, and Daniela Damian. Maintaining shared understanding of non-functional requirements in small companies using continuous software engineering. Empirical Software Engineering, 31(2):40, 2026. URL: https://doi.org/10.1007/S10664-025-10765-4.
  47. A.F. Westin and D.J. Solove. Privacy and Freedom. Ig Publishing, 2015. Google Scholar
  48. Roel J Wieringa. Design science methodology for information systems and software engineering. Springer, Berlin, Heidelberg, 2014. URL: https://doi.org/10.1007/978-3-662-43839-8.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact