G4DPA: uma arquitetura para compartilhamento auditável de arquivos contendo dados pessoais

Abstract

In recent years, the frequency of personal data breaches has increased significantly, causing serious material and moral damage to individuals and organizations alike. This scenario, coupled with the increase in the storage and processing of personal data in the cloud, has resulted in the development or improvement of personal data protection regulations around the world. Examples of such regulations include GDPR in the European Union and LGPD in Brazil, designed with the objective of enhancing the protection of the privacy of individuals. In this way, organizations engaged in the processing of personal data are imperative to identify an effective solution that can attest to their compliance with applicable regulations. This includes the capacity to undergo audits to avoid state-imposed sanctions, such as fines. However, it remains unclear which methodology represents the optimal approach to developing such a solution. The aim of this work is to present an architecture for searching and retrieving files containing personal data between different institutions, without the requirement of storing the files directly in a centralized repository or exposing the internal systems of these institutions to internet access. Furthermore, it proposes a mechanism for auditing the processing operations carried out on shared data, thereby safeguarding the privacy of data subjects and ensuring compliance with personal data protection regulations. A review of the scientific literature was conducted to identify the key areas of non-compliance with these regulations in existing works and the main techniques and technologies employed. Based on this analysis, the Gateway for Data Privacy Auditing (G4DPA) architecture is presented, in which a gateway is leveraged to facilitate the operations of registering, searching, and requesting the sharing of personal data files between controllers. The gateway pseudoanonymizes the file custody information and the identities of the parties involved before sending them to a blockchain through the functions of a smart contract, while the transmission of the file content is carried out through an IPFS network directly between the controllers. A proof of concept was implemented using an Ethereum blockchain and experiments were conducted in a hypothetical scenario in the context of e-healthcare. Finally, the results of the experiments are presented and analyzed in terms of costs, capacity, and performance to evaluate the proposed solution.