# Finding Privacy-relevant Source Code

**Authors:** Feiyang Tang, Bjarte M. Østvold  
**arXiv:** [2401.07316](https://arxiv.org/abs/2401.07316)  
**Date:** 2024-01-14  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2401.07316v1/

## Key points

- Privacy code review is important for data protection compliance
- Limited resources make privacy code review challenging
- Authors propose a new approach focusing on privacy-relevant methods in source code
- Static analysis is used to identify these methods based on their occurrences in commonly used libraries
- Methods are ranked by frequency of invocation with actual personal data in popular GitHub applications
- Approach identifies fewer than 5% of methods as privacy-relevant, reducing time required for code reviews
- Approach validated through case studies on Signal Desktop and Cal.com
- Approach applied to 100 open-source applications, analyzing prevalence and types of personal data processing
- Small percentage of application methods invoke privacy-relevant methods and process personal data or PII
- Automated approach enhances efficiency and effectiveness of privacy code reviews

## Summary

Privacy code review is an essential process for ensuring compliance with data protection regulations. However, it can be challenging due to limited resources. To address this issue, the authors propose a new approach that focuses on privacy-relevant methods in source code - specific methods involved in processing personal data. They use static analysis to identify these methods based on their occurrences in commonly used libraries and rank them according to their frequency of invocation with actual personal data in popular GitHub applications. The evaluation shows that their approach identifies fewer than 5% of the methods as privacy-relevant, reducing the time required for code reviews. The effectiveness of the approach is further validated through case studies on Signal Desktop and Cal.com. The authors also apply their approach to 100 open-source applications and analyze the prevalence and types of personal data processing. The findings show that a small percentage of application methods invoke privacy-relevant methods and process personal data or Personally Identifiable Information (PII). Overall, this automated approach enhances the efficiency and effectiveness of privacy code reviews by identifying and categorizing privacy-relevant methods in real-world applications.