Abstract
For the proper provision of online services, service providers need to collect some personal data from their customers; for instance, an address is collected in order to deliver goods to the right customer. Here the service provider and customer are called data collector (DC) and data subject (DS) respectively. After receiving the personal data, the DC is free to use them as he likes: he may process them for purposes which are not consented by the DS, and even share them with third parties (TPs). Researchers have paid attention to this problem, but previously proposed solutions do not guarantee that, after they have been disclosed to DCs, personal data can only be used as specified by DSs. These solutions require good behaving DCs and assume that DCs’ behavior is verifiable, but do not actually show what happens after DCs get the data. In this paper, we propose a solution that guarantees this by enforcing sticky policies along communication chains composed of a DS, a DC and one (or more) TPs. Our solution uses trusted platform modules (TPMs) and virtual machines (VMs).