  Privacy engineering, as an emerging field of research and practice, comprises
the technical capabilities and management processes needed to implement,
deploy, and operate privacy features and controls in working systems. For that,
software practitioners and other stakeholders in software companies need to
work cooperatively toward building privacy-preserving businesses and
engineering solutions. Significant research has been done to understand the
software practitioners' perceptions of information privacy, but more emphasis
should be given to the uptake of concrete privacy engineering components. This
research delves into the software practitioners' perspectives and mindset,
organisational aspects, and current practices on privacy and its engineering
processes. A total of 30 practitioners from nine countries and backgrounds were
interviewed, sharing their experiences and voicing their opinions on a broad
range of privacy topics. The thematic analysis methodology was adopted to code
the interview data qualitatively and construct a rich and nuanced thematic
framework. As a result, we identified three critical interconnected themes that
compose our thematic framework for privacy engineering "in the wild": (1)
personal privacy mindset and stance, categorised into practitioners' privacy
knowledge, attitudes and behaviours; (2) organisational privacy aspects, such
as decision-power and positive and negative examples of privacy climate; and,
(3) privacy engineering practices, such as procedures and controls concretely
used in the industry. Among the main findings, this study provides many
insights about the state-of-the-practice of privacy engineering, pointing to a
positive influence of privacy laws (e.g., EU General Data Protection
Regulation) on practitioners' behaviours and organisations' cultures. Aspects
such as organisational privacy culture and climate were also confirmed to have
[...].
