Identifying Commitment-Based Software Requirements to Thwart Unfair and Deceptive Practices

Companies publish privacy notices to notify consumers about their information practices. These privacy notices express company-specific commitments to the consumer about how the company will collect, use, and securely store data. Requirements engineers need to understand these commitments so they may be operationalized into specific security and privacy requirements. In the U.S., corporate commitments must meet the Federal Trade Commission's expectations for fair business practices. Companies must thus ensure that they maintain these commitments in accordance with corporate policies, laws, and regulations. We present an approach for identifying commitment-based requirements to support this objective.