Title: PRIVACY AND DATA PROTECTION IN BUSINESS PROCESSES

Privacy and Data Protection in Business Processes

The aim of this section is to define the term of privacy for this work and to identify the threats that exist for a customer with single and multi-stage business processes. Section 4.1 lead to an understanding of privacy for business processes. As sensor networks are used for business processes, e.g. by the METRO Future Store, interactions between customers and service providers get unconsented by customers. Personal data is collected without notification. Customers are not aware of the content of their profiles which are created by service providers. Section 4.2 focuses on unconsented profiling and introduces the need for ‘Ambient Law’ as an instrument for customers in order to retrace the collection and use of personal data. Section 4.5 describes privacy threats in general if personal data are disclosed and delegated in business processes. Section 4.4 shows a case study where personal data are used in order to get access on services. Section 4.5 picks up this kind of authorisation and presents in the case study loyalty program profiling as a privacy threat if personal data as access rights are delegated to service providers. Section 4.6 shows privacy threats if software agents get customers’ data act on behalf of them. Section 4.7 summarises the analysis of this chapter.