Lawfulness by design – development and evaluation of lawful design patterns to consider legal requirements

Abstract

New political objectives, emerging regulatory regimes for the digital sphere, and higher penalties for violations have intensified the pressure to develop lawful IT artefacts. As the adaptation of existing IT artefacts to new regulations can be expensive and arduous, a more attractive approach would be to design IT artefacts lawfully from the beginning. A major challenge is that the law is generally technology-neutral, and lawful design requires legal expertise throughout the development, which is costly and time consuming due to communication challenges between legal experts and developers. One possible approach to proactively consider IT regulations in the systems development is design patterns that convey legal design knowledge and support developers in determining the appropriate design options. Consequently, we develop a framework for lawful design patterns and demonstrate their feasibility and advantages using the example of developing AI-based assistants and the regulation of the General Data Protection Regulation (GDPR). Using the design pattern framework, we develop design patterns for lawful AI-based assistants and evaluate them using (a) an experimental approach to show the usefulness of the patterns for developers and (b) rely on a legal simulation study to holistically evaluate how design patterns contribute to lawful IT.