Metadata and Legal Issues: Privacy vs Information Security

For the purposes of our work we use the notion of metadata to implement usage control and risk management mechanisms from an information security point of view. These metadata allow us on the one hand to define contextual security rules and on the other hand to ensure the traceability of information. Their use may however have legal consequences, in particular regarding the metadata that can be recorded (see personal data), how they should be stored (see probative value in case of litigation) or the computer processing in which they may be involved. Another topical issue is the storage and processing of data via a service provider: the cloud. It must however be ensured that this solution does not lead to a loss of controllability of the information for the company. The objective of this paper is to position our work with respect to these legal issues.

In 9ème Conférence sur la Sécurité des Architectures Réseaux et des Systèmes d’Information (SARSSI'2014), pages 65-76