  Modern privacy regulations, such as the General Data Protection Regulation
(GDPR), address privacy in software systems in a technologically agnostic way
by mentioning general "technical measures" for data privacy compliance rather
than dictating how these should be implemented. An understanding of the concept
of technical measures and how exactly these can be handled in practice,
however, is not trivial due to its interdisciplinary nature and the necessary
technical-legal interactions. We aim to investigate how the concept of
technical measures for data privacy compliance is understood in practice as
well as the technical-legal interaction intrinsic to the process of
implementing those technical measures. We follow a research design that is 1)
exploratory in nature, 2) qualitative, and 3) interview-based, with 16 selected
privacy professionals in the technical and legal domains. Our results suggest
that there is no clear mutual understanding and commonly accepted approach to
handling technical measures. Both technical and legal roles are involved in the
implementation of such measures. While they still often operate in separate
spheres, a predominant opinion amongst the interviewees is to promote more
interdisciplinary collaboration. Our empirical findings confirm the need for
better interaction between legal and engineering teams when implementing
technical measures for data privacy. We posit that interdisciplinary
collaboration is paramount to a more complete understanding of technical
measures, which currently lacks a mutually accepted notion. Yet, as strongly
suggested by our results, there is still a lack of systematic approaches to
such interaction. Therefore, the results strengthen our confidence in the need
for further investigations into the technical-legal dynamic of data privacy
compliance.
