  Current day software development relies heavily on the use of service
architectures and on agile iterative development methods to design, implement,
and deploy systems. These practices result in systems made up of multiple
services that introduce new data flows and evolving designs that escape the
control of a single designer. Academic privacy engineering literature typically
abstracts away such conditions of software production in order to achieve
generalizable results. Yet, through a systematic study of the literature, we
show that proposed solutions inevitably make assumptions about software
architectures, development methods and scope of designer control that are
misaligned with current practices. These misalignments are likely to pose an
obstacle to operationalizing privacy engineering solutions in the wild.
Specifically, we identify important limitations in the approaches that
researchers take to design and evaluate privacy enhancing technologies which
ripple to proposals for privacy engineering methodologies. Based on our
analysis, we delineate research and actions needed to re-align research with
practice, changes that serve a precondition for the operationalization of
academic privacy results in common software engineering practices.
