Data Protection Regulation Research Articles

Privacy versus pedagogy – students’ perceptions of using learning analytics in higher education

The rapid recent use of learning analytics (LA) in higher education, specifically during the COVID-19 pandemic, allows the monitoring of users' behavior while learning. Using LA may promote students' learning outcomes but also intrude into their privacy. This study aimed to explore students’ behaviour and perceptions towards privacy and data protection when using LA for pedagogical needs, examine the privacy trade-off of students' willingness to share personal information in exchange for pedagogical benefits and understand the predicting variables for this privacy trade-off. A model was developed containing five groups of influencing variables (demographic data, perceptions, feelings, behaviour and awareness) on the privacy trade-off. A total of 1,014 students completed an online questionnaire. The results found that students do care about their privacy but are not aware of privacy and data protection regulations. They are willing to trade off privacy for pedagogical benefits, and they trust their academic institutions, but they want transparency. Age, a sense of security in the academic institution, behaviour, data misuse concern and institution management of students' personal information are the significant predictors for a privacy trade-off. It is important to engage students in the process as they are the main beneficiaries of LA and build trust between them and the institution. Implications for practice or policy: Academic institution should actively provide information to raise privacy awareness. Academic institutions should engage students in the process of using LA to create a high degree of trust. Universities should endorse LA policy, fostering it for pedagogical purposes. Instructors may utilise LA to enrich student learning, respecting their willingness to share pedagogical data. Academic institutions should provide a high level of transparency in order to build students’ trust in their institutions.

Liability For Damage Based On The Processing Of Biometric Data Through Video Surveillance Of Residential Buildings Against The Provisions Of The General Data Protection Regulation Implementation Act

Liability For Damage Based On The Processing Of Biometric Data Through Video Surveillance Of Residential Buildings Against The Provisions Of The General Data Protection Regulation Implementation Act

Chat messenger use in the care of patients with Parkinson's disease

The demand for chat messaging apps for communication between physicians, therapists and patients is increasing. The expectations for this form of communication and uncertainties regarding introduction and use are heterogeneous. The implementation of chat messengers in the care of patients with Parkinson's disease should be facilitated by recommendations regarding introduction and usage. Semi-structured interviews with neurologists and physiotherapists were conducted to capture the expectations and needs regarding the use of chat messengers. From the data analysis, recommendations were derived. The expectations for technical functionality exceeded the chat messenger functions. This concerns, e.g., the connection of the chat messenger to the electronic patient file. There is agreat deal of uncertainty, particularly when it comes to the applicable General Data Protection Regulations (GDPR). The recommendations relating to the use of chat messengers, data protection aspects, the design of such tools and methodological considerations can help to implement the tool as an additional communication channel. Practical recommendations regarding functionality, the use of chat messengers in everyday life and in relation to data protection are derived from the results. By improving knowledge, physicians and therapists can contribute to the successful establishment of chat messengers as an additional communication tool.

The Interplay Between Cybersecurity in Europe and the Development of the General Data Protection Regulation: A Study of Lateral Pressure

The securitization of cyberspace has been a specter to the political studies in various countries. This article focuses on the dynamic of speech act on implementation consent and its relation to the theory of lateral pressure formulated by Nazli in studying cyber politics. Since 2018, the European Commission has implemented GDPR as a basic law related to data transfer, collection and process (TCP). This policy has brought a fundamental problem to the activity conducted by the state and private sector. Moreover, it was also criticized that this policy has brought to the discrimination of algorithm that came to bias to the minority group. In speak of Methodology, we used qualitative research of 418 articles with the keyword ‘consent’ focusing on Social and Humanities Science in Journal Sage; after manual analysis, we found 146 articles related to the consent study and social science. The final project is to find out the significant tendency of how Europe has securitized GDPR through speech acts by correlating it to the Lateral Pressure Index. The potential implications of the finding could give theoretical preference in formulating a data protection base policy.

Eye-Tracking Devices for Virtual and Augmented Reality Metaverse Environments and Their Compatibility with the European Union General Data Protection Regulation

Even though the Metaverse from science fiction is not a reality yet, it is possible to take a glimpse into how it might look like. However, the current vision of the Metaverse does not only encompass software. A great deal of companies is complementing their Metaverse projects with Virtual and Augmented Reality devices such as headsets and glasses. In this line, one of the last technological advancements in virtual and augmented reality devices included the introduction of eye-tracking technology. However, when new and additional kinds of data are processed, emerging risks for data protection might arise. This paper will, therefore, discuss the compatibility of eye-tracking devices for virtual and augmented reality environments with the European Union General Data Protection Regulation (GDPR). Being the GDPR considered a worldwide role model in terms of fundamental rights protection, the compatibility of such devices with one of the most severe data protection regimes will be put to the hardest test. The paper will do so by analyzing the state of the art of the technology, its use in headsets and glasses for virtual and augmented reality Metaverse environments, and the potential risks that such use might entail for data protection. After that, such risks will be confronted with the relevant applicable provisions of the GDPR. Finally, the paper will issue policy recommendations.

Security and Privacy Challenges in Software as a Service (SaaS)

This document In the rapidly evolving landscape of cloud computing, Software as a Service (SaaS) has emerged as a dominant model for delivering software applications over the internet. However, this model introduces significant security and privacy challenges. This research paper delves into these issues, highlighting the unique risks associated with SaaS platforms. The study explores common vulnerabilities such as data breaches, unauthorized access, data loss, and identity theft, which are exacerbated by the centralized nature of SaaS solutions where data is stored on remote servers managed by service providers. To address these challenges, the paper underscores the importance of robust security measures, including encryption, access controls, and secure software development practices. Additionally, it emphasizes the necessity for SaaS providers to adopt advanced privacy protection techniques like data anonymization and differential privacy to meet user expectations and comply with stringent legal regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Through a comprehensive review of literature and analysis of current SaaS security practices, the research identifies critical risks and provides strategic recommendations for enhancing security and privacy in SaaS environments. By integrating multiple layers of security throughout the software development lifecycle, enforcing strict access management protocols, and ensuring compliance with regulatory standards, SaaS providers can significantly mitigate risks and safeguard sensitive user data. The findings of this study highlight the imperative for continuous improvement in SaaS security strategies to keep pace with emerging threats and technological advancements. Ultimately, by prioritizing security and privacy, SaaS providers can not only protect their users but also gain a competitive edge in the increasingly crowded market of cloud services.

Regulatory compliance in the age of data privacy: A comparative study of the Nigerian and U.S. legal landscapes

This comparative study delves into the intricate regulatory compliance mechanisms governing data privacy in Nigeria and the United States. Employing a qualitative methodology, this research synthesizes existing literature and case studies to highlight the pivotal role of data protection regulations in safeguarding personal information in an increasingly digital world. The analysis begins with an exploration of the conceptual framework of data privacy, emphasizing key principles such as transparency, accountability, and data minimization. It then meticulously examines the Nigerian Data Protection Regulation (NDPR) and the diverse U.S. legal landscape, including the California Consumer Privacy Act (CCPA) and the Health Insurance Portability and Accountability Act (HIPAA). The main findings reveal significant differences in regulatory approaches, with Nigeria's centralized enforcement by the National Information Technology Development Agency (NITDA) contrasting sharply with the U.S.'s fragmented state and federal oversight. Case studies underscore the challenges faced by both jurisdictions in ensuring compliance, ranging from resource constraints in Nigeria to the complexities of navigating multiple regulatory requirements in the U.S. The study concludes that while both countries emphasize the importance of data privacy, their divergent legal landscapes reflect unique cultural, economic, and operational contexts. The research recommends harmonizing data protection standards, enhancing enforcement mechanisms, and fostering greater public awareness to address the evolving challenges of data privacy. This study contributes to the global discourse on data privacy by offering insights into the strengths and weaknesses of different regulatory frameworks, thereby providing a roadmap for policymakers, businesses, and other stakeholders to navigate the complexities of data privacy compliance. Keywords: Data Privacy, Regulatory Compliance, Nigeria, United States, Data Protection, Legal Frameworks.

Towards a Blockchain Hybrid Platform for Gamification of Healthy Habits: Implementation and Usability Validation

(1) Background: In developed countries, public health faces a number of problems, including sedentary lifestyles and poor diets, which collectively contribute to the occurrence of preventable diseases. Noncommunicable diseases represent the leading cause of global mortality. Despite the promotion of healthy living, compliance remains a significant challenge. The integration of gamification into health apps has been demonstrated to facilitate behavioral change. Blockchain technology enhances the effectiveness of gamification by providing data trustability and support for auditable incentives. This feature is possible and easy due to the inherent characteristics of blockchain automating processes through Smart Contracts, rewarding participants and creating leaderboards in a transparent and reliable manner. The use of smart contracts and events enhances the traceability and reliability of decentralized applications, including healthcare. Interoperability in blockchain tools facilitates the deployment of complex environments. The aim of this research is the deployment of a tool for the implementation and testing of a gamification platform based on blockchain technology. (2) Methods: Pre-experimental research was carried out to assess the usability of the decentralized application developed. (3) Results: A decentralized application was developed with the objective of gamifying healthy habits. The application was evaluated using the System Usability Scale, obtaining a score of 80.49, and the Cronbach’s Alpha score, which was found to be 0.75. (4) Conclusions: A prototype of a decentralized application connected with a blockchain network to reward challenge fulfilment was deployed. Despite being in early development, it demonstrated high usability. Employing blockchain technology guarantees transparency and traceability while remaining in compliance with legal requirements like the General Data Protection Regulation.

The European commitment to human-centered technology: the integral role of HCI in the EU AI Act’s success

Abstract The evolution of AI is set to profoundly reshape the future. The European Union, recognizing this impending prominence, has enacted the AI Act, regulating market access for AI-based systems. A salient feature of the Act is to guard democratic and humanistic values by focusing regulation on transparency, explainability, and the human ability to understand and control AI systems. Hereby, the EU AI Act does not merely specify technological requirements for AI systems. The EU issues a democratic call for human-centered AI systems and, in turn, an interdisciplinary research agenda for human-centered innovation in AI development. Without robust methods to assess AI systems and their effect on individuals and society, the EU AI Act may lead to repeating the mistakes of the General Data Protection Regulation of the EU and to rushed, chaotic, ad-hoc, and ambiguous implementation, causing more confusion than lending guidance. Moreover, determined research activities in Human-AI interaction will be pivotal for both regulatory compliance and the advancement of AI in a manner that is both ethical and effective. Such an approach will ensure that AI development aligns with human values and needs, fostering a technology landscape that is innovative, responsible, and an integral part of our society.

The Right to Data Portability as a Personal Right

The right to the portability of personal data guarantees the interested party the right to receive personal data that concern themselves. Specifically, data which a person has provided to a ‘data collector’ in a structured format can currently be transmitted to another ‘data collector’ without any legal consequences as long as the original ‘collector’ has received consent either derived via a contract or other means. This data transaction from one ‘collector’ to another is often carried out by automated means; it is easily technically possible and is therefore considered to not negatively affect the rights and freedoms of others. This right to data transfer is guaranteed when it comes to data collected in the public interest or in the exercise of public powers conferred on the ‘collector’. The main precedent to the right to data portability is the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, regarding the protection of natural persons with respect to the processing of personal data and their free circulation, which repeals Directive 95/46/EC (General Data Protection Regulation). In Article 20, this regulation discusses the right to data portability, establishing the basic guidelines for this right. Thus, a new personal right is guaranteed, given the context of the general protection of data. In order to strengthen control over their own data, a natural person must also be allowed to receive data in the same structured way.

Regulating data: Evidence from corporate America

AbstractUsing the enforcement of the General Data Protection Regulation (GDPR) as our empirical setting, we examine how stricter data privacy and data protection requirements affect shareholder wealth, firms’ investment decisions, and data breaches. Consistent with consumer privacy negatively affecting firms, we find that U.S. firms exposed to the GDPR lose 0.7%–1.1% in market value relative to unexposed firms in the week in which the regulation became enforceable. We find that the decrease in market value is partially attributable to a decrease in sales growth. GDPR‐exposed firms increase their investment above that of control firms and become less likely to report a data breach post‐regulation. The decrease in data breach likelihood is statistically and economically significant, resulting in up to 34 million records not being leaked, which costs between $205 million and $561 million to firms in breach mitigation expenses per year. The results of this study should be of interest to academics and regulators worldwide by examining the costs and benefits of regulating data.

Understanding the GDPR from a requirements engineering perspective—a systematic mapping study on regulatory data protection requirements

AbstractData protection compliance is critical from a requirements engineering (RE) perspective, both from a software development lifecycle (SDLC) perspective and regulatory compliance. Not including these requirements from the early phases of the SDLC can prove costly and challenging afterward. The general data protection regulation (GDPR) from the European Union (EU) sets a list of requirements that organizations working within its scope should satisfy. However, these requirements are complex to work with, as legal prose tends to be vague and imprecise, and not all requirements have received the same attention from researchers. This study aims to identify the research published in RE for helping compliance with regulatory data protection requirements. We gathered and analyzed 90 articles from 2016 to 2022 through a systematic mapping study. We analyzed key trends in the sample, such as year of publication, publication venue, type of research, interdisciplinarity in the author’s background, GDPR focus of compliance element, and type of proposal. Our main findings show ongoing interest, mostly published in conferences, in achieving overall compliance with the GDPR and consent as the most popular topics. Other topics, such as cookies or children’s data, did not receive significant attention. Research over the whole RE process has been done. 20 (22%) of the papers have authors affiliated with non-computer science; however, most research seems not interdisciplinary. We finally discuss gaps in the literature, possible future areas of research, and the importance of interdisciplinary research for regulatory data protection requirements in RE.

Privacy’s Sky-High Battle: The Use of Unmanned Aircraft Systems for Law Enforcement in the European Union

Benefiting from the rapid advancements in Unmanned Aircraft Systems (UAS) technology with enhanced tracking and data collection capabilities, law enforcement authorities re-discovered air as a dimension where state power can be exercised in a more affordable, accessible, and compact way. On the other hand, during law enforcement operations, UAS can collect various types of data that can be personal or sensitive, threatening the right to privacy and data protection of the data subjects. Risks include challenges related to data security, bulk data collection, the diminished transparency and fairness resulting from the inconspicuous nature of UAS, as well as ethical concerns intertwined with privacy and data protection. Upon examination of the legal framework including the General Data Protection Regulation the Law Enforcement Directive, various Aviation rules, and the new proposal for the Artificial Intelligence Act, it becomes apparent that the EU legal framework’s adequacy in safeguarding privacy and data protection against law enforcement use of UAS is context-dependent, varying across use cases. The current framework lacks clarity, leading to arbitrary application and limited protection for data subjects. Enforcement of safeguards is insufficient, and the Aviation Regulations, applicable to law enforcement UAS, require member states' opt-in, which has not occurred as of the authors’ knowledge. The Artificial Intelligence Act addresses UAS operations but focuses on market risks rather than obligations imposed on law enforcement authorities. Consequently, the existing framework is rendered inadequate for medium to high-risk law enforcement operations, leaving individuals vulnerable and insufficiently protected against intrusive UAS surveillance. Rectifying this involves addressing the enforcement gap and making the necessary amendments to relevant regulatory aspects. Additionally, the implementation of specific technical measures and steps to foster effective cooperation among stakeholders in UAS deployment for law enforcement is imperative.

Railway security checks at the border: between intrusive security technologies and fundamental traveller rights

Background European railway borders are facing a particular exposure to security threats and need a delicate securitization and free movement, especially amid globalisation, the current geopolitical landscape and increased migrant flows. For example, the war in Ukraine illustrated the challenges experienced at the Eastern EU borders by the refugee migration surge in early 2022. Methods This paper will focus on the European border security control process from the rail border perspective. It will encompass the lessons learned from the UIC Refugee Task Force as well as insights from the ongoing EU-funded Horizon Europe project ODYSSEUS (Unobtrusive Technologies for Secure and Seamless Border Crossing for Travel Facilitation). Project ODYSSEUS aims to support the security and integrity of the European space, reduce illegal movements of people and goods across EU borders, facilitate travelling for citizens all while protecting fundamental rights of travellers. Results The project will test a combination of multi-behavioural and General Data Protection Regulation (GDPR) compliant biometric user identity verification tools, allowing citizens to cross EU border without any interruption or queue. Further, novel luggage and baggage checks will allow citizens’ vehicles and cargos to be remotely checked at land borders to speed up the border check processes in a secure and reliable manner. The project will run three pilot tests at road, rail and water borders. Conclusion In this paper, we analyse the implementation of project’s technologies in the rail border crossing pilot test and discuss the implications for the actors involved in the process of railway border crossing (e.g., border authorities, railway operators and railway travellers).

Dark patterns: EU's regulatory efforts

AbstractIn a world where technology is rapidly advancing, regulation of dark pattern practices has become a topic of increasing importance. Society has become somewhat desensitized to these deceptive online practices that manipulate users into taking actions, which are not in their best interests, such as difficulty unsubscribing from a service, prominence of consent buttons, and countless other advanced tactics to obscure transparency. However, these ongoing practices harm both the individual user, and society in general, by impeding informed decision‐making. This Article addresses the European Union's leading efforts to tackle dark pattern practices, and in particular, addresses the numerous legislative acts which have been enacted to regulate and eliminate them. The acts explored in this Article include the General Data Protection Regulation, the Uniform Commercial Practices Directive, the Data Act, the Digital Markets Act, the Digital Services Act, the Amendment to the Directive on Financial Services Contracts Concluded at a Distance, and the Artificial Intelligence Act. This Article then discusses the interplay between the numerous acts, and the resulting ambiguities and overlap which have led to a level of regulatory redundancy. This Article examines not only the difficulty in interpretation of the various acts, but additionally, explores the issues which arise in implementation from a jurisdictional perspective. Further, this Article suggests potential solutions to address the fragmented legislation, including a hybrid form of harmonization, as well as methods for consolidation and centralization.

The Regulations of the Supervisory Officer Personal Data Protection-Based Accountability Principle

<div><table cellspacing="0" cellpadding="0" align="left"><tbody><tr><td align="left" valign="top"><p>This study examines The Model of Regulations Supervisory Officer Personal Data Protection-Based Accountability Principle: Lessons from Sweden. This study is a qualitative approach by reviewing and analyzing legal aspects and comparing laws. Even though Indonesia has a personal data protection law, misuse of personal data is still excessive. Owing to accountability basis PDP supervision arrangements have not been properly implemented. Meanwhile, Sweden was chosen as a comparison country since it was one of the first countries to have a personal data protection law. The result shows that in Sweden, personal data is regulated in the General Data Protection Regulation and the personal data supervisor well implemented the principle of accountability therefore it worked effectively. Meanwhile in Indonesia, given that a data protection supervisor has not been established, Protection of personal data is still carried out by each agency appointed by law on a sectoral basis and it deemed less effective in providing personal data protection. Therefore, the personal data supervisor with a single rule and direct responsibility to the president is the perfect model for Indonesia.</p></td></tr></tbody></table></div>

P-340 Reconciling diversity in health and genomic data collection with the regulation of AI in clinical genomics

Abstract Study question How far the existing and emerging EU regulations address concerns about lack of diversity in genomic databases which used to train AI in genomics? Summary answer The main regulations in the European Union provide no clear answers for reconciling the need for more diverse genetic data with regulatory standards. What is known already AI researchers need high quality genomic data that reflect the underlying diversity of human populations to develop and validate safe, effective, and equitable tools for genomic medicine. The problem is that most of the genomic data that are available to develop such tools are of insufficient quality, due to inappropriate use of population descriptors, and over representative of individuals of European ancestry. We used the example of developing algorithms to calculate polygenic risk scores ( PRS) and concerns about their accuracy for various sub-populations to illustrate our discussion. Study design, size, duration We have analysed the relevant EU regulations including, the upcoming AI Act, Medical Devices Regulation ( MDR), In Vitro Diagnostic Medical Devices ( IVDR) and the GDPR to assess how the concerns related to lack of diversity in genetic/genomic databases have been addressed. Participants/materials, setting, methods NA. Main results and the role of chance The main regulations for clinical AI in the European Union, namely those regulating medical devices, provide no clear answers for reconciling the need for more diverse genetic data with regulatory standards. On the other hand, some of the data protection regulation requirements arising from the EU General Data Protection Regulation (GDPR) may further challenge collection of sensitive attributes such as race/ancestry which might be needed for brining diversity to databases. On the other hand, several interesting impending new regulations addressing AI and algorithms such as the EU’s AI Act may help in some ways, but still fail to ultimately grapple with the fundamental obstacles in producing the diverse genomic data needed to achieve regulatory objectives. In particular, the proposed requirements related to data quality and transparency need to be accompanied by further guidance on how to define representativeness and how to address long-term impact on fairness concerns in the context of medical AI, when the developed tools are not of optimal use for populations not descending from European ancestry. Limitations, reasons for caution NA. Wider implications of the findings The legal analysis provided in this paper will provide insights for broader types of AI tools which may be implemented in the context of Assisted Reproductive Technologies and beyond. Trial registration number NA

Safety and Privacy in Immersive Extended Reality: An Analysis and Policy Recommendations

Extended reality (XR) technologies have experienced cycles of development—“summers” and “winters”—for decades, but their overall trajectory is one of increasing uptake. In recent years, immersive extended reality (IXR) applications, a kind of XR that encompasses immersive virtual reality (VR) and augmented reality (AR) environments, have become especially prevalent. The European Union (EU) is exploring regulating this type of technology, and this article seeks to support this endeavor. It outlines safety and privacy harms associated with IXR, analyzes to what extent the existing EU framework for digital governance—including the General Data Protection Regulation, Product Safety Legislation, ePrivacy Directive, Digital Markets Act, Digital Services Act, and AI Act—addresses these harms, and offers some recommendations to EU legislators on how to fill regulatory gaps and improve current approaches to the governance of IXR.

Exploring Data Privacy and Privacy Paradox Nature of Consumers Using Block Chain Technology: Application of SLR and Bibliometric Analysis Tools

This research presents an in-depth study of blockchain technology’s impact on data privacy and the consumer behaviour phenomenon known as the privacy paradox. Through a systematic literature review (SLR) and bibliometric analysis, the study delves into the effectiveness of blockchain in safeguarding personal data in an increasingly digital world. Key databases such as Scopus and Web of Science provide rich academic contributions, particularly from regions with stringent data privacy laws. The findings highlight blockchain’s effectiveness in limiting unauthorised data access, boosting user control and tackling the privacy paradox, where personal information is shared despite privacy worries. Yet, it points out challenges in aligning blockchain with legal frameworks, such as General Data Protection Regulation, particularly concerning data erasure rights. The study emphasises three themes: blockchain’s progression toward robust data protection, psychological aspects of the privacy paradox in consumer decisions and attitudes toward blockchain solutions. It notes gaps in standardisation, public awareness and blockchain’s practical applications, alongside ethical and policy issues. Conclusively, the research stresses the need for aligning technological advancements with legal and ethical frameworks, highlighting user experience in digital technology adoption. It positions blockchain as a pivotal factor in reshaping digital privacy, advocating for continued innovation and exploration in blockchain applications to ensure a secure, user-empowering future globally.

Study of Cybersecurity Laws and Regulations

In the modern digital era, cybersecurity has become a crucial field due to the increase in cyberthreats and assaults, which pose serious hazards to people, businesses, and countries. To meet these changing difficulties, a wide range of national and international cybersecurity rules and regulations have been developed. This research paper explores a thorough analysis of these laws and regulations. The first section of the report gives an overview of the state of cybersecurity throughout the world, emphasising how frequently and how sophisticatedly cyber-attacks are becoming. After that, it takes a close look at the laws that control cybersecurity in both the public and private domains. The paper addresses the jurisdictional issues that emerge in the globally interconnected realm of cyberspace and investigates the fundamental ideas that support cybersecurity legislation, such as data protection, breach notification, and responsibility. Additionally, the study paper examines important cybersecurity laws from across the globe, such as the Cybersecurity Information Sharing Act of the United States, the California Consumer Privacy Act, and the General Data Protection Regulation (GDPR) of the European Union (CISA). The efficacy of these measures in protecting confidential data and reducing cyber risks is assessed.