General Interest

Enterprise API
Security and GDPR
Compliance: Design
and Implementation
Perspective
Fatima Hussain Brett Noye
Royal Bank of Canada Royal Bank of Canada
Rasheed Hussain Salah Sharieh
Innopolis University Royal Bank of Canada

Abstract—With the advancements in enterprise-level business development, the demand

for new applications and services is overwhelming. For the development and delivery of
such applications and services, enterprise businesses rely on Application Programming
Interfaces (APIs). APIs provide interface to enable the communication among different
applications. In essence, API is a double-edged sword; on one hand, API helps in
expanding the business through sharing value and utility, but on the other hand, it raises
security and privacy issues. Since the applications usually use APIs to retrieve important
and critical data, it is extremely important to make sure that effective access control and
security mechanisms are in place so that the data do not fall into wrong hands. In this
context, in this article, we discuss the current state of the enterprise API security and the
role of Machine Learning (ML) in an API security. We also discuss the General Data
Protection Regulation (GDPR) Compliance and its effect on the API security.

& WITH THE ADVANCEMENTS in communication of applications and services that target consumers
and computation technologies, there is a plethora in different sectors, ranging from finance, health,
agriculture, smart industries, smart environment,
Digital Object Identifier 10.1109/MITP.2020.2973852 and human well being.1 Internet of Things (IoT) is
Date of current version 11 September 2020. the best example of such applications and services

September/October 2020 Published by the IEEE Computer Society 1520-9202 ß 2020 IEEE
81
Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
 General Interest

realized through the interconnection of smart (AI)-driven solutions in almost every industry,
objects for different purposes such as, but not lim- API security is no exception, and in this article,
ited to, controlling home appliances remotely, we focus on AI and Machine Learning (ML)-driven
monitoring a patient’s health, monitoring agricul- API security solutions. Furthermore, with the
tural land, operating in hostile environments, and enforcement of new data regulation and privacy
so on. These services are shared across different law known as the General Data Protection Regula-
platforms with different consumers, vendors, and tion (GDPR), ML-driven security solutions seem
other related entities. Therefore, for the manage- jeopardized. We discuss AI/ML-driven API secu-
ment of these services and applications, and rity in relation to GDPR, as well as related chal-
expanding them across different domains and con- lenges in this regard. More precisely, we discuss
sumers, traditional off-the-shelf software develop- the API security in detail and the current tradi-
ment solutions will not gracefully scale. In this tional approaches for API security. Then, we dis-
context, we need a unified mechanism to make the cuss the limitations and inadequacy of the
applications and services (both macro- and micro- current API security solutions and discuss the
services depending on the application) easy to AI-/ML-driven API security. We also discuss the
access, secure, able to export, and meet the het- importance of user data privacy and security and
erogeneous consumer demands. To this end, how the evolution of GDPR has changed the para-
Application Programming Interface (API) is a digm of user privacy. Finally, we discuss the
mechanism that makes it easy, affordable, and effect of GDPR compliance on the AI-/ML-driven
scalable for the services to distribute across differ- API security and identify the challenges faced in
ent domains. API is a set of protocols, functions, terms of design, customer satisfaction, and data
mechanisms, tools, definitions, and attributes to transparency by the existing solutions with
share and develop new services across different GDPR compliance.
domains and expand the existing services. APIs
enable service integration, application develop- API SECURITY
ment, and communication among different serv- In this section, we focus on the vulnerabilities
ices and products without the need for developing of API, traditional API security model, and the
new infrastructure for each service and product. role of ML in API security.
For instance, in case of a financial institution, bank-
ing chatbots reduce the operational as well as APIs and Their Vulnerabilities
management cost through decoupling of the plat- APIs are functionally classified into two catego-
forms and rejoining through APIs. Furthermore, ries, i.e., APIs that are “used to perform an action”
agility, enhanced operational efficiency, and avail- and APIs that “provide access to any object”. In
ability of new distribution channels are few of the the former APIs, an application invokes the API
benefits of using APIs for banking. Also, banks use and requests the original software to perform an
APIs internally to improve the information flow action (which is made available through the
between various legacy systems.
invoked API). In the latter type of APIs, an applica-
With the inception of IoT networks, APIs have tion wants to get access to an object through the
emerged as integral business strategy across var- API. From the organizational standpoint, APIs can
ious industries. APIhound reported that more be divided into following three types.
than 50 000 APIs are registered to date. Also, the
 Private APIs:
number of private APIs is more than public APIs.
This leads to security and privacy challenges Private APIs are usually intended to be used solely
because sensitive data are usually passed over by the firm developing the software. Companies
the web through APIs. Hence, it is essential to develop private APIs for internal software devel-
discuss the API security and the current solu- opment and for enhancing scalability, modularity,
tions. With new wave of Artificial Intelligence security, and access to expand various services.
 Partner APIs:

APIs developed for usage among partners are
https://hackernoon.com/how-to-make-your-product-gdpr-compliant-
396a6c0336c2 known as partner APIs. For instance, a firm

82 IT Professional

Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
develops a software package for sales and mar-
keting functions, where another partner firm has
a software for accounting. These two softwares
can be connected, and this integration is bridged
through APIs. However, it requires efficient
access control and authorization mechanisms
along with rules and policies of the firms involved
in software development and service delivery.
 Public APIs: Figure 1. API security model.
Public APIs are intended to be used by anyone
who wants to access the software. These APIs or range, leads to system crash, and offers
have limited capabilities and can be a potential access to memory spaces.
security threat to the back-end systems. More
In the same spirit, there are few access
precisely, the attackers could launch attacks
related attacks specific to APIs listed below. Con-
camouflaged into the functions and services pro-
ventional access control mechanisms such as
vided by the public APIs.
user name and passwords, openID, JWT tokens,
etc., are powerful but leave security gaps in the
API vulnerabilities APIs give access to the cli-
API deployment. These techniques require com-
ents (through access control) and also lure
plementary security capabilities to address
potential attackers to the back-end systems. The
threats such as the following:
potential attack surface is significantly increased
by using APIs as granularity boundary is moved  API-specific Distributed Denial of Service
from secure internal tiers to the user devices (DDoS) attacks: These attacks overload criti-
(through client application). Therefore, we need cal API services (login and session manage-
security and protection mechanisms against the ment) and disrupt access to these services
new classes of risks as a result of using APIs. Fur- by sending large amounts of traffic from mul-
thermore, in a typical web page request, a small tiple sources.
amount of information is shared (i.e., in HTTP  Login attacks: These attacks include creden-
address and forms), whereas in case of API calls, tial stuffing (testing lists of previously
HTTP URLs as well as HTTP header, queries, and breached credentials against a target API to
parameters are exposed to the outside world. try to gain access), use of stolen credentials
As a result, the data sent to APIs may increase or tokens, and fuzzing (feeding large amounts
the potential risk and attack surface through of random data into a program to discover
parameter attacks such as URL-based attacks, vulnerabilities).
query parameters attacks, HTTP header, and/or  Application and data attacks: These attacks
post content-based attacks. In the following, we include data theft, data deletion or manipula-
outline some potential parameters attacks on APIs. tion, code injection, and application disruption.
 Script insertions: This refers to the family of
attacks that exploit the systems that inter- Traditional API Security Model
pret the submitted parameter content as a The traditional API security model incorpo-
script (e.g., when a snippet of JavaScript is rates tasks related to authentication, throttling,
submitted into a posting on a web forum). and communication security, as shown in Fig. 1.
 SQL injections: This refers to an attack These are powerful tools but are not considered
through query languages, where parameters as a comprehensive solution for addressing the
that are designed to load a certain input into specialized API threats such as API-specific DoS,
a database query are manipulated to change application, and log-in attacks.2 Therefore, a com-
the intent of an underlying SQL template. prehensive API security solution requires anom-
 Bounds or buffer overflow attacks: These attacks aly detection as well as basic security capabilities.
are caused by data beyond the expected types On the contrary, AI-enabled API security keeps

September/October 2020
83
Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
 General Interest

track of a historical trend in the traffic, along with easily manageable than the SOAP APIs. SOAP APIs
securing the existing foundational security fea- use built-in protocols such as web services secu-
tures, and detects malicious behavior as the first rity (WS Security) and use a combination of XML
line of defense. Traditional security measures pro- encryption, XML signatures, and SAML tokens to
vided by the content distribution networks, Web verify authentication and authorization.
Application Firewall, and API Gateways can be
easily bypassed by fine-tuned attacks on APIs. Client throttling Client throttling enables the
API implementations are based on either REp- access limits for APIs, i.e., how often an API can
resentational State Transfer (REST) or Simple be called and also track its usage over a certain
Object Access Protocol (SOAP) and are secured time period. Carefully crafted throttling rules
in different ways as discussed in the following can protect APIs from spikes and (D)DoS attacks.
sections. Generally speaking, SOAP APIs have For instance, more calls to an API indicate that it
more comprehensive security measures and are might be abused, or it might be a programming
recommended for handling sensitive data. mistake, and API is being called in an endless
loop. This information is very useful for identify-
Access control management Granting or ing and preventing various access related issues.
rejecting an access to APIs is the first line of
defence for the internal resources in an enter- API gateways security The API gateway is
prise. Similarly, controlling the amount of data considered as the core infrastructure unit that
released to the cyber-world is possible by limit- enforces and manages the API security. Enforcing
ing access to specific endpoints or data for indi- security through the API gateway is a compara-
vidual clients. Access management is typically tively new concept and serves the API security
performed using a “key” to identify applications better, unlike traditional security measures. API
calling the APIs as well as the end users. This security management performs message analysis,
key has access to specific endpoints and has access tokens, and authorization parameters
access privileges for certain data limits. grants, and therefore, API gateway checks authori-
To this end, Open Authorization (OAuth) and zation of users followed by message parameters
OpenID are used for user authentication and and content checks (sent by the authorized
authorization for the web services. OAuth is the users). It also ensures that the client data are not
open standard for access management, and it written when usage logs are maintained. Hence,
enables users to have access to API resources the API gateway acts like traffic police and ensures
without sharing passwords. OAuth is compli- that only legitimate users are allowed access to
mented with another standard: OpenID Connect. APIs. It also encrypts or redacts the confidential
This is an identity layer on top of the OAuth information as well as controls and analyzes the
framework, and it authenticates users by obtain- APIs usage. Essentially, with the help of an API
ing the basic profile information. gateway, we are moving security from the applica-
tion to the organizational infrastructure.
Communication security Transport Layer
Security (TLS) and the secure socket layer are Limitations of Traditional API Security Model
used for the communication security of any web Traditional security mechanisms such as
service. TLS standard is used to establish secure OAuth and the other aforementioned techniques
connection between two endpoints (client and focus only on the visible aspects of the security
server), and it makes sure that the data sent such as authentication, access control, and autho-
between them is encrypted and unaltered. REST rization. However, with the growth in API develop-
API uses HTTP and is supported by the TLS ment and the emergence of new APIs, the risk of
encryption. It also uses JavaScript Object Notation sensitive data exposure beyond the business
(JSON): a file format used to transfer data securely boundaries also increases. The traditional
and efficiently over web browsers. By using HTTP approach of “limiting access to the API” instead of
and JSON, REST APIs do not need to store or mitigating the attacks has not been so encourag-
repackage the data and are considered faster and ing. Furthermore, every new API brings along a

84 IT Professional

Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
Figure 2. General data protection regulation (GDPR).4

new attack vector associated with it. Therefore, it filling the security gaps such as addressing new
is challenging to address the security attacks on cyber-threats and making predictions on the
APIs through a singular traditional approach such basis of existing patterns to manage the API secu-
as access control. Similarly, the stolen or shared rity. A more detailed discussion about ML-based
credentials may also result in catastrophic attacks API security, available techniques, and platforms
on APIs. The traditional injection, data stealing, can be found in the work by Hussain et al.2
and manipulation attacks are still possible on APIs.
To this end, the traditional APIs may not be able to
GENERAL DATA PROTECTION
mitigate these types of attacks. Therefore, a more
REGULATION
versatile, variable, context-aware, and intelligent
The European Union parliament approved a
security mechanism is needed for API security.
revolutionary regulation on personal data protec-
tion in April 2016, and it has been functional since
Machine Learning (ML) and API Security May 2015. GDPR emphasizes on personal data pro-
Smart API security must be an integral part of
tection, transparency, and data ownership rights
the API operations. ML can be used not only to
for individual users. In addition to this, it also gives
identify the malicious intent in data transactions
right and access to users: how they wish to get
across platforms, but it also helps evolving the
their data treated as shown in Fig. 2. Personal data
security practices in the wake of current security
in GDPR are defined as any information that can
practices. To date, ML has been widely used in the
identify any individual directly or indirectly, and
security of systems and networks, for instance,
“personal data processing” is defined as the set of
context-aware authentication, authorization, intr-
automated and manual operations performed on
usion detection, malware analysis, and so on.3
the personal data.5 These operations include data
In the context of API security, ML is primarily
collection, recording, organization, structuring,
leveraged to learn the patterns of normal behav-
storage, adaptation or alteration, retrieval, consul-
ior incorporating the contextual information for
tation, use, disclosure by transmission, dissemina-
each API. The identified patterns are then used
tion, alignment or combination, restriction,
to identify and block the potential cyber attacks
erasure or destruction,y,z etc.
on the APIs. Continuous learning capabilities are
From enterprise perspective, GDPR requires
added to the system and APIs, through which
the following:
anomalous behavior can be identified. In short,
ML can extend the API security beyond access y
https://gdpr.eu//
z
control and communication security and help https://gdpr-info.eu/art-21-gdpr/

September/October 2020
85
Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
 General Interest

 Transparency: Clear policies must be defined nondiscrimination, right to explanation, and the
for data protection, data processing, and data right to be forgotten.
portability of the customer related information.
 Access control: Enterprises must possess
Feature engineering and nondiscrimination
proper security tools as well as processes for
right Personal data processing rules are the pillars
the protection of the customers private data.
of GDPR, i.e., revealing racial/ethnic origin, political
 Personal privacy and right to be forgotten: A cus-
opinions, religious beliefs, biometric data used for
tomer older than 16 years of age has full right
identification purposes, health data, data related
to dictate what type of data an enterprise can
to sexual orientation, and the processing of genetic
collect about that customer. Furthermore, the
data are protected by the GDPR. For instance,
customer has full right to demand his/her
these data points are incredibly valuable in genetic
data to be deleted after usage.
research and are being used for predictive model-
ing in different domains. However, explicit consent
Some of the works carried out related to
is required by the data subjects for opting in for
understanding and interpretation of GDPR can be
such model training as well as for ongoing model
found in the work by Sirur et al.6,7 In Tesfay et al.,8
retraining to improve model accuracy.
the authors presented a PrivacyGuide, a privacy
policy summarization tool inspired by ML and
natural language processing techniques to clas- Modeling, prediction, and right to
sify the privacy policy content. explanation Clients, customers, and/or users
have the right to understand the processing logic
Activities Related to the GDPR Compliance and reasons for any potential decisions made for
According to GDPR, the cost of noncompli- or on behalf of them. Therefore, the processors
ance is very high, and companies are at the risk (enterprises) are bound to provide meaningful
of losing customers and global revenue. Further- information about the decision logic and justifica-
more, potential fines of up to EUR 20 million can tion of any prediction and envisaged consequen-
be imposed on the companies violating the regu- ces of this processing for the data owner.
lations. Nevertheless, the challenges posed due
to the restriction of GDPR compliance also pro- Model retaining, updates, and the right to
vide an opportunity for organizations to take be forgotten This right permits data owners to
concrete and smart decisions for data privacy dictate processors (enterprises) to erase all per-
governance and compliance. sonal data associated with them. Apparently, it
Several companies such as Informatica,9 seems very straightforward to delete corre-
Greenhouse (Greenhouse support),10 McKin- sponding accounts and related data. However, it
sey 11, and Lever12 provide data privacy gover- poses lots of technical challenges for ML models,
nance solutions for GDPR. In the same spirit, the if retraining and regular update of ML model is
Interactive Advertising Bureau of Canada (IAB required, which in turn requires availability of
Canada), being the national voice and thought one’s data. To date, the right to authenticate first
leader of the Canadian interactive marketing and whether their data are used to retrain the predic-
advertising industry, provides the compliance tive model or not, how the ML model will be
steps for GDPR.13 Canadian digital media and retrained without data, where the line should be
industry offering goods and services to EU indi- drawn in terms of amount of data to be retained
viduals or monitoring their behaviors (which and to be forgotten are essential to consider.
may include tracking for behavioral advertising
purposes) must comply and follow the defined
IAB rules. API SECURITY AND COMPLIANCE
WITH GDPR
Contradiction of GDPR Rules With ML In this section, we discuss the effect of GDPR
GDPR grants three important rights to the on ML-driven security as a whole and, specifi-
owner (data subject) of personal data: right of cally, API security.

86 IT Professional

Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
ML-Driven Security and GDPR Moreover, right of data erasure (given to data
GDPR has a significant effect on ML-enabled subject) without any undue delay (Article 17(1)
security as the GDPR imposes restriction on the of the GDPR) can be problematic for ML-driven
use of automated decision making, including services because some ML algorithms need to
profiling (Article 22).14 This leads to an impres- keep the data used in the training. By removing
sion that further development of ML-enabled this data, the algorithm’s effectiveness can be
decisions are hampered. Specifically, in this era impacted. These algorithms tend to use the his-
of cyber-physical systems and big data in which torical data (for generating new rules) for future
automated decisions and predictive analysis are data processing for self-improvement.
a norm, GDPR compliance with ML-enabled solu-
tions seems unacceptable and unadaptable. Nev-
Data and Computational Transparency
ertheless, it is easier to avoid decisions that
Automated decision making is defined as the
directly affect individuals. However, it is unclear
decisions made without human intervention and
to signify the types of harmful profiling. For
is prohibited in GDPR. As the personal data of an
instance, it is hard to say whether advertise-
individual are used in any decision making, it is
ments sent by Google and Facebook have nega-
needed that is should be transparent to users
tive effect or not. In fact, detailed clarification
and the questions “how and why any decisions
and classification are required to distinguish
are made (Article 13,14)” should be answered.
among various automated decisions, essentially
However, many challenges are associated with
being procedural or substantive, rule-based, or
realizing this level of transparency. Here, we dis-
law-based.15
cuss some of the associated challenges.

Does GDPR Affect the ML-Driven API Security? Technical challenges According to the
GDPR will significantly affect the ML-driven GDPR, a controller using user data for some auto-
security solutions. Consumers routinely inter- mated decision making is obliged to provide
acting with ML-enabled services, such as per- meaningful information about logic used in mak-
sonal assistants, chatbots, and roboadvisors, ing such decisions. This enables users to express
will be significantly affected. Furthermore, GDPR their opinion about these decisions and also
restrictions will increase the cost of ML-driven have the right to challenge them. Questions such
solutions directly or indirectly. For instance, the as what exactly is needed to be revealed to the
requirement to explain the details of algorithmic owner,’ how algorithms (used for decision mak-
decisions to a human is not only complex but ing) can be explained, and how the complexity of
also time consuming. The right of data portabil- an algorithm can be simplified to be explained to
ity does not directly affect the ML-driven serv- the owner, should be answered. However, there
ices, but it increases the cost indirectly. It are many technical obstacles in explaining the
restricts the companies to create and maintain algorithms. For instance, simple tree-based algo-
large and complex datasets in reusable formats, rithms are easy to explain, as compared to neural
such that data are readily available on user networks, which are almost impossible to
request.16 Also, there is a tradeoff between algo- explain. Neural networks, ML, and deep learning
rithmic transparency and accuracy. Therefore, are considered “Black Boxes,” and it is very diffi-
more transparent and less accurate algorithms cult to explain or identify a potential point of fail-
are developed to explain the algorithmic deci- ure. As these complex algorithms are opaque
sions to consumers, and it might lead to unfair even for developers; therefore, it becomes very
decision making. Similarly, prohibition on solely challenging to educate nontechnical users.
automated decisions might lead to humans mak-
ing unfair and unreasonable decisions. This will Intellectual property Algorithmic transpar-
also prohibit the use of rational algorithms, ency can lead to the exposure of intellectual
which are adaptable to modification in data and property to the public, which will not only jeopar-
can be adjusted over time to account for the dize the privacy of the computational secret but
unintended biases.17 can also endanger the policies of the authorities.

September/October 2020
87
Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
 General Interest

For instance, tax authorities will never like to Also, as per GDPR, data processing is
reveal algorithms used to select tax payers for restricted to the consent of the data subject. It is
secondary and detailed review. Similarly, a finan- also worth mentioning that the corporate cus-
cial institution will not disclose the ML model tomer and employee data might be scattered as
used for mortgage percentage and interest rates. structured or unstructured data across the
Similarly, IP-related issues also hinder the data cloud or on local/distributed file systems. There-
transparency. According to trade-related aspects fore, remote controlling (deletion, processing,
of intellectual property rights agreement and transfer with subject’s consent or intention) of
world intellectual property organization copy- personal data, stored in the file systems and pro-
right treaty, software programs are protected by prietary cloud, will be complex. Therefore, it will
the copyright act. In this situation, concrete be a challenging task to obtain a comprehensive
measures should be taken to keep the algorithm view of the personal data across an enterprise.
transparency as well as maintaining copyright
acts. This means that GDPR’s required transpar-
ency can be achieved only by sharing “logic CONCLUSION
behind decisions,” and not the algorithm itself. GDPR strictly advocates for “privacy by
design,” i.e., data protection and computational
Data Portability and Storage explainability should be included during system
Traditionally, there are three types of data development rather than adding it later. Similarly,
portability approaches, i.e., jurisdiction-to- businesses should practice privacy-preserving
jurisdiction, organization-to-organization, and analytic methods, business models, and techni-
the data localization approaches.18 The jurisdic- ques such as differential privacy, homomorphic
tion-to-jurisdiction approach governs transbor- encryption, and federated learning. For existing
der data flows based on adequate and equivalent ML-enabled API security solutions, the automated
national data protection laws. An organization- decisions made by intelligent softwares (or
to-organization approach put this responsibility machines) must be explained to meet the GDPR
on individual data controllers for meeting data requirements. For instance, Quantitative Input
protection’ standards. Finally, data localization Influence (QII)20 is used to achieve algorithmic
approach depends on public policy efforts to transparency. QII is developed to clarify and
store personal data within a particular juris- explain the ML algorithm (and related factors),
diction’s boundaries. GDPR is in accordance with which were used in any automated decision mak-
the third approach of data localization. ing. In a nutshell, it is imperative to investigate the
In light of GDPR and data localization, major effect of ML-enabled API security mechanisms on
changes are required in the entire ecosystem. the GDPR.
New cloud infrastructures are required across
the EU as well as across the globe to accommo-
date the GDPR laws. Moreover, a major paradigm
& REFERENCES
shift is expected in the data storage systems and 1. A. L. Fernando, J. Costa, B. Barbosa, A. Monti, and
in-house storage. In this context, in-house proc- N. Rettenmaier, “Environmental impact assessment of
essing and storage of personal data seem to be a perennial crops cultivation on marginal soils in the
more appropriate solution as compared to stor- mediterranean region,” Biomass Bioenergy, vol. 111,
age on the public cloud. This is due to the fact pp. 174–186, 2018.
that it is very difficult to provide transparency of 2. F. Hussain, B. Noye, and S. Sharieh, “Current state of
personal data in public clouds. To keep the API security and machine learning,” 2019. [Online].
GDPR compliance, an organization can only Available: https://bit.ly/36NEMf0
transfer data to an external processor by ensur- 3. D. Ucci, L. Aniello, and R. Baldoni, “Survey of machine
ing adequate levels of data protection and pri- learning techniques for malware analysis,” Comput.
vacy. If there are security doubts about any Secur., vol. 81, pp. 123–147, 2019.
particular destination, controller, or processor, 4. “How to make your product GDPR compliant,” 2018.
the data cannot travel there.19 [Online]. Available: https://bit.ly/3b25HHm

88 IT Professional

Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.
 5. J. Wong and T. Henderson, “How portable is 17. T. Zarsky, “The trouble with algorithmic decisions: An
portable?: Exercising the GDPR’s right to data analytic road map to examine efficiency and fairness
portability,” in Proc. ACM Int. Joint Conf. Int. Symp. in automated and opaque decision making,” in Sci.,
Pervasive Ubiquitous Comput. Wearable Comput., Technol., Human Values, vol. 41, pp. 118–132,
2018, pp. 911–920. Oct. 2015.
6. S. Sirur, J. R. Nurse, and H. Webb, “Are we there yet?: 18. J. Selby, “Data localization laws: Trade barriers or
Understanding the challenges faced in complying with legitimate responses to cyber security risks, or both?”
the general data protection regulation (GDPR),” in in Proc. Int. J. Law Inf. Technol., vol. 25, pp. 213–232,
Proc. 2nd Int. Workshop Multimedia Privacy Secur., Jul. 2017.
2018, pp. 88–95. 19. D. Kamarinou, C. Millard, and J. Singh, “Machine
7. M. R. I. Nekvi and N. H. Madhavji, “Impediments to learning with personal data,” in Queen Mary School of
regulatory compliance of requirements in contractual Law Legal Studies Research, Nov. 2016. [Online].
systems engineering projects: A case study,” ACM Available: https://papers.ssrn.com/sol3/papers.cfm?
Trans. Manage. Inf. Syst., vol. 5, no. 3, pp. 15:1–15:35, abstract_id=2865811
Dec. 2014. 20. A. Datta, S. Sen, and Y. Zick, “Algorithmic
8. W. B. Tesfay, P. Hofmann, T. Nakamura, S. Kiyomoto, transparency via quantitative input influence: Theory
and J. Serna, “Privacyguide: Towards an and experiments with learning systems,” in Proc. IEEE
implementation of the EU GDPR on internet privacy Symp. Secur. Privacy, May 2016, pp. 598–617.
policy evaluation,” in Proc. 4th ACM Int. Workshop
Secur. Privacy Analytics, 2018, pp. 15–21.
Fatima Hussain is a security analyst in API Secu-
9. Informaticia, “Comply with GDPR,” 2019. [Online].
rity and Governance squad, Royal Bank of Canada
Available: https://infa.media/2SdyJLQ
(RBC), Toronto, ON, Canada. She is leading the
10. Greenhouse Support, “Greenhouse, EU compliance,
development and promotion of new APIs, along with
and the general data protection regulation (GDPR),”
API security and governance duties. She is also an
2018. [Online]. Available: https://bit.ly/2tTHrqt Adjunct Professor at Ryerson University, Toronto.
11. McKinsey and Company, “Tackling GDPR compliance Contact her at [email protected].
before time runs out,” 2018. [Online]. Available:
https://mck.co/38QeytR Rasheed Hussain is currently an Associate Pro-
12. K. Dhillon, “How is lever supporting our customers fessor with Innopolis University, Innopolis, Russia. His
GDPR compliance efforts?” 2018. [Online]. Available: research interests include information security, cyber-
https://bit.ly/315fKH8 security, privacy, vehicular networks, blockchain, and
13. iab.Canada, “GDPR compliance steps,” 2018. future Internet. Contact him at [email protected].
[Online]. Available: https://www.iabcanada.com/
resource/gdpr-update-february-2018-13-key-com Brett Noye is the director, responsible for the
pliance-steps/ API security within RBCs API Platforms team. His
14. Intersoft Consulting, “Rights of the data subject,” 2018.
27 years of IT experience spans CableTV Brokerage,
market data, and banking sectors across multiple
[Online]. Available: https://gdpr-info.eu/art-21-gdpr/
roles, platforms, and technologies. Contact him at
15. M. Brkan, “AI-supported decision-making under the
[email protected].
general data protection regulation,” in Proc. 16th Ed.
Int. Conf. Artif. Intell. Law, 2017, pp. 3–8.
Salah Sharieh is the head of digital transformation
16. European Commission Justice and Consumer,
at RBC Toronto, Toronto, ON, Canada, having 25 years
“Guidelines on automated individual decision-making of experience in business, technology, and digital
and profiling for the purposes of regulation,” 2018. transformation. He is also an adjunct professor at
[Online]. Available: https://ec.europa.eu/newsroom/ Ryerson University, Toronto. Contact him at salah.
article29/item-detail.cfm?item_id=612053 [email protected].

September/October 2020
89
Authorized licensed use limited to: University of Canberra. Downloaded on October 05,2020 at 06:02:46 UTC from IEEE Xplore. Restrictions apply.