  Context: Digital and physical trails of user activities are collected over
the use of software applications and systems. As software becomes ubiquitous,
protecting user privacy has become challenging. With the increase of user
privacy awareness and advent of privacy regulations and policies, there is an
emerging need to implement software systems that enhance the protection of
personal data processing. However, existing data protection and privacy
regulations provide key principles in high-level, making it difficult for
software engineers to design and implement privacy-aware systems. Objective: In
this paper, we develop a taxonomy that provides a comprehensive set of privacy
requirements based on four well-established personal data protection
regulations and privacy frameworks, the General Data Protection Regulation
(GDPR), ISO/IEC 29100, Thailand Personal Data Protection Act (Thailand PDPA)
and Asia-Pacific Economic Cooperation (APEC) privacy framework. Methods: These
requirements are extracted, refined and classified (using the goal-based
requirements analysis method) into a level that can be used to map with issue
reports. We have also performed a study on how two large open-source software
projects (Google Chrome and Moodle) address the privacy requirements in our
taxonomy through mining their issue reports. Results: The paper discusses how
the collected issues were classified, and presents the findings and insights
generated from our study. Conclusion: Mining and classifying privacy
requirements in issue reports can help organisations be aware of their state of
compliance by identifying privacy requirements that have not been addressed in
their software projects. The taxonomy can also trace back to regulations,
standards and frameworks that the software projects have not complied with
based on the identified privacy requirements.
