Open Data Set for Publication "Privacy by Design: Aligning GDPR and Software Engineering Specifications with a Requirements Engineering Approach"

Demographic information 1. What is your current role in which you deal with GDPR? 2. Can you describe your professional background and experience? 3. How many years of experience do you have working with GDPR regulation? State of practice 4. Have you used any methods or tools for requirements engineering, system specification, or architecture specification to ensure GDPR compliance in your current or previous projects? If so, please provide examples. IF YES: Could you describe this tool/method? IF NO: How do you approach requirements engineering to ensure GDPR compliance? 5. What are the key features that methods or tools for requirements and system specification should have to ensure GDPR compliance? 6. How important is the consistency between requirements specification and system specification for GDPR compliance (requirements and system specifications do not contain contradictions)? Please elaborate. Please rate it on a scale of 1 (low importance) to 5 (high importance). Class of goals: capturing legal domain knowledge & goals 7. How important is it for requirements and system specification methods to capture legal domain knowledge (legal goals, core legal concepts and relationships between them)? Please rate this on a scale of 1 to 5, and explain your reasoning. 8. What specific goals do you aim to achieve when capturing legal domain knowledge (e.g., improving the communication of legal requirements)? 9. What evaluation questions need to be addressed to achieve these goals? 10. What metrics do you use for measuring the achievement of these goals or for answering the related evaluation questions? 1 Class of goals: traceability and consistency of specifications 11. How important is it to maintain traceability (relationships) between system and requirements specifications derived from regulations? How crucial is it to maintain traceability between system specification and the original regulatory text? What do you believe are the potential consequences of inconsistencies between the regulatory text, the requirements specification, and the system specifications? Please rate the importance of traceability and consistency on a scale of 1 to 5. 12. What are the concrete goals that need to be achieved with the implementation of traceability and consistency? 13. What evaluation questions need to be addressed to achieve these goals? 14. What metrics do you use for measuring the achievement of these goals or for answering the related evaluation questions? Class of goals: separation of compliance and non-compliance concerns 15. How important is it to ensure that regulatory compliance is specified as a separate and isolated concern (e.g., isolated from business concerns)? Please rate its importance on a scale of 1 to 5, and explain your reasoning. 16. What are the concrete goals that need to be addressed in specification of compliance as a separate concern? 17. What evaluation questions need to be addressed to achieve these goals? 18. What metrics do you use for measuring the achievement of these goals or for answering the related evaluation questions? Class of goals: system specification transparency and overview 19. How important is it to ensure that requirements and system specifications are transparent and understandable to stakeholders such as legal/compliance experts and auditors? Please rate its importance on a scale of 1 to 5, and explain your reasoning. 2 20. How important is it to ensure that stakeholders can effectively communicate about the system specifications, including negotiating trade-offs? Please rate its importance on a scale of 1 to 5, and explain your reasoning. 21. What are the concrete goals that need to be addressed with ensuring transparency and overview of system specification for GDPR compliance? 22. What evaluation questions need to be addressed to achieve these goals? 23. What metrics do you use for measuring the achievement of these goals or for answering the related evaluation questions? Class of goals: specification enabling system flexibility 24. How important is it for specification methods to support the flexibility and evolution of system specifications in response to changes in the software context, such as regulatory updates? Please rate its importance on a scale of 1 to 5, and explain your reasoning. 25. What goals need to be achieved to ensure the support for system flexibility? 26. What evaluation questions need to be addressed to achieve these goals? 27. What metrics do you use for measuring the achievement of these goals or for answering the related evaluation questions? Concluding questions 28. What are the other goals or classes of goals in system specification for GDPR compliance? 29. Are there any other important questions, metrics to consider? 30. Please rank the five classes of goals we have discussed according to their importance for the achievement of GDPR compliance (from 1 – the most important to 5 – the least important). Each ranking can be assigned once only. capturing legal domain knowledge & goals 1 – 2 – 3 – 4 – 5 traceability and consistency of specifications 1 – 2 – 3 – 4 – 5 separation of compl. and non-compl. concerns 1 – 2 – 3 – 4 – 5 3 system specification transparency and overview 1 – 2 – 3 – 4 – 5 specification enabling system flexibility 1 – 2 – 3 – 4 – 5 31. Please think about a brief summary of your opinion on methods for requirements and system specification for GDPR compliance. 4