Experimentação de um catálogo de padrões de requisitos de privacidade em conformidade com a lei geral de proteção de dados

Abstract

[Context] Data privacy regulations are being created and made available to assist professionals in applying them throughout the Software Development Process (SDP). The General Data Protection Law (LGPD), for instance, introduces concepts regarding the privacy of individuals' data that must be considered from the early stages of a software project. [Problem] In response to the lack of knowledge or the difficulties most professionals face in making software compliant with the LGPD, various approaches have been proposed to incorporate the law's legal precepts into the Requirements Engineering (RE) process—such as solutions for reusing privacy requirements in the form of patterns, catalogs, and inventories. [Objective] Accordingly, this research aims to evaluate the Privacy Requirements Patterns Catalog (CPRP) with both students and professionals to measure ease of use, usefulness, and mental workload during RE activities supported by the CPRP. [Methods] To this end, a controlled experiment was conducted with students taking RE courses, alongside a user perception assessment involving professionals from a software development firm. [Results] Quantitative and qualitative assessment results show that students experienced a high workload when specifying privacy requirements (PRs) in compliance with the LGPD. Furthermore, both assessments—involving students and professionals alike—revealed that the CPRP had low ease of use; however, participants reported that the tool is useful and expressed an intention to use it for privacy-related RE activities. [Conclusion] Therefore, this research indicates that while the CPRP is useful for specifying LGPD-compliant PRs, its low ease of use necessitates usability improvements to enhance the user experience.