arXiv subjects

Georgia M. Kapitsaki

Publications and source records attributed to Georgia M. Kapitsaki.

8 recordsLinked to original sources

arXiv2026

Analyzing developer discussions on EU and US privacy legislation compliance in GitHub repositories

Context: Privacy legislation has impacted the way software systems are developed, prompting practitioners to update their implementations. Specifically, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have forced the community to focus on users' data privacy.\\ Objectives: Relying on the vast amount of data on developer issues available in GitHub repositories, our aim is to gather empirical evidence on the issues developers of Open Source Software discuss to comply with privacy legislation.\\ Method: We examined such discussions by mining and analyzing 32,820 issues from GitHub repositories. We partially analyzed the dataset automatically to identify law user rights and principles indicated, and manually analyzed a sample of 1,186 issues based on the type of concern addressed.\\ Results: We devised 24 discussion categories placed in six clusters: user rights and consent, compliance implementation, documentation, data storing/sharing, general compliance, and contextual adaptability. Developers mainly focus on specific user rights from the legislation (right to erasure, right to opt-out, right to access), addressing other rights less frequently, while most discussions concern user consent, user rights functionality, bugs and cookie management.\\ Conclusion: The created taxonomy can help practitioners understand which issues are discussed for law compliance, so that they ensure they address them first in their systems. In addition, the educational community can reshape curricula to better educate future engineers on the privacy law concerns raised, and the research community can identify gaps and areas for improvement to support and accelerate data privacy law compliance.

cs.SE↗

arXiv2026

Regulatory compliance-readiness in the AI Supply Chain: examining datasets in Hugging Face

A very large number of datasets are made available via Hugging Face (HF). These datasets are used to train a vast number of AI models, also available via HF. There are regulatory issues that might arise in the AI supply chain when those datasets do not follow, for instance, data privacy practices, or do not disclose their data sources, cleaning and preparation processes. In this preliminary work, regulatory compliance-readiness is examined as a quality attribute in the framework of HF datasets, with a main focus on data privacy (e.g. GDPR, CCPA). Towards this direction, an analysis on regulatory compliance (e.g. with privacy laws) of the dataset using the dataset card and the dataset structure overview as starting points has been performed. We collected 11,682 HF datasets that have a dataset card, are not gated and have at least 500 downloads and analyzed the datasets using automated techniques and manual analysis on a sample of the dataset. The results show that a very small number of datasets are explicit on the datasets creation processes and mention data sources, while some make mentions to Personally Identifiable Information (PII) or other sensitive data in their data schemas. These results show the need for more detailed examinations of regulatory compliance in AI datasets and models, and research on tools that provide guidance to practitioners and automate the compliance process.

cs.SE↗

arXiv2026

Modelling GDPR-based Privacy Requirements with Software Engineering Diagrams: A Systematic Literature Review

The application of the General Data Protection Regulation (GDPR) has significantly affected privacy requirements elicitation, modelling, and verification in Software Engineering (SE). One of the affected areas is requirements visualisation through modelling diagrams, which plays a crucial role in ensuring privacy compliance, as functional system requirements should be integrated with GDPR-based privacy requirements. We present a systematic literature review on how SE diagrams have been employed to capture and integrate GDPR-based privacy requirements into software system design. The study aims to identify the existing research landscape, existing gaps, and directions for future work. Following a rigorous search protocol and addressing two research questions, 18 primary studies published between 2017 and 2025 were selected, analysed, and categorised based on (i) the diagram types used, and (ii) the GDPR principles or rights addressed. The findings highlight the need for inter-diagram integration, full lifecycle traceability mechanisms, tool support, and automated compliance checking.

cs.SE↗

arXiv2025

Examining Software Developers' Needs for Privacy Enforcing Techniques: A survey

Data privacy legislation, such as GDPR and CCPA/CPRA, has rendered data privacy law compliance a requirement of all software systems. Developers need to implement various kinds of functionalities to cover law needs, including user rights and law principles. As data compliance is tightly coupled with legal knowledge, it is not always easy to perform such integrations in software systems. Prior studies have focused on developers' understanding of privacy principles, such as Privacy by Design, and have examined privacy techniques used in the software industry. Nevertheless, emerging developer needs that can assist in privacy law compliance have not been examined but are useful in understanding what development automation tools, such as Generative AI, need to cover to make the compliance process more straightforward and seamless within the development process. In this work, we present a survey that examines the above needs with the participation of 68 developers, while we have examined which factors affect practitioners' needs. Most developers express a need for more automated tools, while privacy experience increases practitioners' concerns for privacy tools. Our results can assist practitioners in better positioning their development activities within privacy law compliance and point to an urgent need for privacy facilitators.

cs.SE↗

arXiv2025

FOSS-chain: using blockchain for Open Source Software license compliance

Open Source Software (OSS) is widely used and carries licenses that indicate the terms under which the software is provided for use, also specifying modification and distribution rules. Ensuring that users are respecting OSS license terms when creating derivative works is a complex process. Compliance issues arising from incompatibilities among licenses may lead to legal disputes. At the same time, the blockchain technology with immutable entries offers a mechanism to provide transparency when it comes to licensing and ensure software changes are recorded. In this work, we are introducing an integration of blockchain and license management when creating derivative works, in order to tackle the issue of OSS license compatibility. We have designed, implemented and performed a preliminary evaluation of FOSS-chain, a web platform that uses blockchain and automates the license compliance process, covering 14 OSS licenses. We have evaluated the initial prototype version of the FOSS-chain platform via a small scale user study. Our preliminary results are promising, demonstrating the potential of the platform for adaptation on realistic software systems.

cs.SE↗

arXiv2025

Evolution of repositories and privacy laws: commit activities in the GDPR and CCPA era

Free and open source software has gained a lot of momentum in the industry and the research community. The latest advances in privacy legislation, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), have forced the community to pay special attention to users' data privacy. The main aim of this work is to examine software repositories that are acting on privacy laws. We have collected commit data from GitHub repositories in order to understand indications on main data privacy laws (GDPR, CCPA, CPRA, UK DPA) in the last years. Via an automated process, we analyzed 37,213 commits from 12,391 repositories since 2016, whereas 594 commits from the 70 most popular repositories of the dataset were manually analyzed. We observe that most commits were performed on the year the law came into effect and privacy relevant terms appear in the commit messages, whereas reference to specific data privacy user rights is scarce. The study showed that more educational activities on data privacy user rights are needed, as well as tools for privacy recommendations, whereas verifying actual compliance via source code execution is a useful direction for software engineering researchers.

cs.SE↗

arXiv2021

An analysis of open source software licensing questions in Stack Exchange sites

Free and open source software is widely used in the creation of software systems, whereas many organisations choose to provide their systems as open source. Open source software carries licenses that determine the conditions under which the original software can be used. Appropriate use of licenses requires relevant expertise by the practitioners, and has an important legal angle. Educators and employers need to ensure that developers have the necessary training to understand licensing risks and how they can be addressed. At the same time, it is important to understand which issues practitioners face when they are using a specific open source license, when they are developing new open source software products or when they are reusing open source software. In this work, we examine questions posed about open source software licensing using data from the following Stack Exchange sites: Stack Overflow, Software Engineering, Open Source and Law. We analyse the indication of specific licenses and topics in the questions, investigate the attention the posts receive and trends over time, whether appropriate answers are provided and which type of questions are asked. Our results indicate that practitioners need, among other, clarifications about licensing specific software when other licenses are used, and for understanding license content. The results of the study can be useful for educators and employers, organisations that are authoring open source software licenses and developers for understanding the issues faced when using licenses, whereas they are relevant to other software engineering research areas, such as software reusability.

cs.SE↗

arXiv2021

Mining DEV for social and technical insights about software development

Software developers are social creatures: they communicate, collaborate, and promote their work in a variety of channels. Twitter, GitHub, Stack Overflow, and other platforms offer developers opportunities to network and exchange ideas. Researchers analyze content on these sites to learn about trends and topics in software engineering. However, insight mined from the text of Stack Overflow questions or GitHub issues is highly focused on detailed and technical aspects of software development. In this paper, we present a relatively new online community for software developers called DEV. On DEV users write long-form posts about their experiences, preferences, and working life in software, zooming out from specific issues and files to reflect on broader topics. About 50,000 users have posted over 140,000 articles related to software development. In this work, we describe the content of posts on DEV using a topic model, showing that developers discuss a rich variety and mixture of social and technical aspects of software development. We show that developers use DEV to promote themselves and their work: 83% link their profiles to their GitHub profiles and 56% to their Twitter profiles. 14% of users pin specific GitHub repos in their profiles. We argue that DEV is emerging as an important hub for software developers, and a valuable source of insight for researchers to complement data from platforms like GitHub and Stack Overflow.

cs.SE↗