Data Protection Standards Research Articles

ABOUT DATA PROTECTION STANDARDS AND INTELLECTUAL PROPERTY REGULATION IN THE DIGITAL ECONOMY: KEY ISSUES FOR UKRAINE

Changes that are constantly taking place in the digital economy cause increasing instability of legislation in the field of data protection and security. For example, in Ukraine, under martial law, there is an urgent need to adapt the legal regulation to European data protection standards (in terms of personal data processing). First of all, the correlation between EU law, national law of the EU Member States and national legislation of the EU candidate countries results in the principle of direct effect of EU law. In addition, EU data protection law has become an essential source for EU Member States in regulating artificial intelligence (AI), e-commerce and the Internet of Things (IoT). The article considers the specific topic of the conditions of approximation of international norms and legislation of Ukraine to EU law, trying to answer the questions of personal data protection in the conditions of martial law that have arisen. This work is based on a comparative analysis of the General Data Protection Regulation 2016/679 and internal data protection rules in Ukraine. At present, the research purpose of the article is to reveal the fact that data protection is a specific category of procedural law based on the principles of intellectual property law regarding data access rights and data ownership rights in the digital economy.

Patients' Willingness to Provide Their Clinical Data for Research Purposes and Acceptance of Different Consent Models: Findings From a Representative Survey of Patients With Cancer.

BackgroundSecondary use of clinical data for biomedical research purposes holds great potential for various types of noninterventional, data-driven studies. Patients’ willingness to support research with their clinical data is a crucial prerequisite for research progress.ObjectiveThe aim of the study was to learn about patients’ attitudes and expectations regarding secondary use of their clinical data. In a next step, our results can inform the development of an appropriate governance framework for secondary use of clinical data for research purposes.MethodsA questionnaire was developed to assess the willingness of patients with cancer to provide their clinical data for biomedical research purposes, considering different conditions of data sharing and consent models. The Cancer Registry of the German federal state of Baden-Württemberg recruited a proportionally stratified random sample of patients with cancer and survivors of cancer based on a full census.ResultsIn total, 838 participants completed the survey. Approximately all participants (810/838, 96.7%) showed general willingness to make clinical data available for biomedical research purposes; however, they expected certain requirements to be met, such as comparable data protection standards for data use abroad and the possibility to renew consent at regular time intervals. Most participants (620/838, 73.9%) supported data use also by researchers in commercial companies. More than half of the participants (503/838, 60%) were willing to give up control over clinical data in favor of research benefits. Most participants expressed acceptance of the broad consent model (494/838, 58.9%), followed by data use by default (with the option to opt out at any time; 419/838, 50%); specific consent for every study showed the lowest acceptance rate (327/838, 39%). Patients expected physicians to share their data (763/838, 91.1%) and their fellow patients to support secondary use with their clinical data (679/838, 81%).ConclusionsAlthough patients’ general willingness to make their clinical data available for biomedical research purposes is very high, the willingness of a substantial proportion of patients depends on additional requirements. Taking these perspectives into account is essential for designing trustworthy governance of clinical data reuse and sharing. The willingness to accept the loss of control over clinical data to enhance the benefits of research should be given special consideration.

Legalizing Illegal Mass Surveillance: A Transnational Perspective on Canada’s Legislative Response to the Expansion of Security Intelligence

AbstractThis article offers a transnational perspective on Canada’s legislative response to globally expanded national security intelligence activities in the War on Terror since 2001. I situate Canada’s new legislation against the backdrop of US and Japanese legislative responses and analyze the transition, including Bill C-13 (2014), Bill C-44 (2015), Bill C-51 (2015), and Bill C-59 (2019). I argue that the thrust of this legislative trend has been the active legalization of previously illegal surveillance activities by security intelligence agencies, rather than passive ineffectiveness in restricting state mass surveillance enabled by information and communication technologies. The transition is in synch with a global legislative trend that lowers the legal standards of privacy and personal data protection and weakens checks and balances in democratic governance. As a result, mass surveillance has increasingly undermined and regulated the rule of law, not vice versa.

ADEQUACY OF PRIVACY REGIME IN BANGLADESH: KEY CHALLENGES AND POTENTIAL POLICY MEASURES

Privacy is one of the most desired human rights in this ubiquitous computing era - when a vast majority of our work is done online using personal data. Numerous actors are continually monitoring our activities, and consequently, user privacy came under tremendous threats. In response, various legal and policy measures have been adopted at national, regional, and international levels. The citizens of Bangladesh are also experiencing diverse privacy threats, and hence, they deserve to have adequate legal protections. This context requires a study to search for answers to the question - whether there are any legal protections for privacy in the existing legal regime of Bangladesh comparable with international data protection standards. This study aims to fill the gap using doctrinal legal research methodology. The findings of this study reveal that although there is no privacy or comprehensive data protection law in Bangladesh, privacy is conditionally recognised in the Constitution. There are numerous isolated privacy provisions in some other subsidiary legislation and references to privacy in several case laws as well. The results of this study will enlighten all stakeholders regarding privacy issues and facilitate them to map and design future policy strategies. This eventually contributes to establishing a safer online ecosystem in Bangladesh.

The Right to Privacy and Protection of Personal Data: Emerging Trends and Implications for Development in Jurisprudence of European Court of Human Rights

The emergence of the right to personal data protection is usually considered in close proximity to the right to private life, however, the two rights despite the sufficient degree of similarity are not identical. The article analyses the main concepts and discussions around the protection of privacy and personal data protection, which primarily was only perceived as another facet of privacy, as well as provides a comprehensive overview of theoretical and practical problems associated with their protection. Provided for the right to data protection is not explicitly mentioned in the ECHR the main concern, therefore, is whether it receives an adequate level of protection within the Convention system. The article argues that given the lack of an explicit criterion for distinguishing the rights to privacy and data protection, it is the jurisprudence of the ECHR, which is of the utmost importance for the development of the right to personal data protection as a fundamental right. Due regard is given to the evolution of the fundamental approaches of the ECHR in this field. It is concluded that the effective enjoyment of the right to data protection, which is not specified in the text of the ECHR or its Protocols, undeniably relies on the ECHR’s interpretation of the key data protection standards enlisted in the Convention no. 108, as well as relevant EU legislation.

Follow the Leader? A Comparative Law Study of the EU’s General Data Protection Regulation’s Impact in Latin America

Abstract In May 2018, the General Data Protection Regulation (GDPR) entered into force in the European Union. As is widely recognized, its impact goes beyond the borders of the old continent, permeating through the regulatory processes of countries all over the world. Nowhere is this more evident than in Latin America, where governments have long emulated European data protection standards. Professor Anu Bradford has famously characterized this phenomenon as a prominent example of ‘the Brussels Effect,’ defined as Europe’s unilateral power to regulate global markets. Other scholars see a more complex dynamic at play. This is especially true in the data privacy context in which the EU has benefited from a highly transplantable legal model and normative innovations that have proved successful in a global marketplace of ideas. This Article joins the debate around the EU’s transnational influence on the regulation of personal data by evaluating the de jure impact that the GDPR has had in Latin America to date. To this end, the Article addresses three main questions. First, what is the panorama of data privacy legislation across Latin America since the 2016 adoption of the GDPR? Second, how have those countries in the region that have moved first to reform or enact data privacy legislation in light of the GDPR’s key innovations done so? And finally, what lessons can be learned from the Latin American experience based on the responses to these questions? In responding, the Article looks first at which countries in the region have introduced or proposed changes to their legislation in the wake of the GDPR’s enactment in 2016. It then evaluates the experience of key jurisdictions in greater detail, namely Brazil, Mexico, Chile and Uruguay, to determine what lessons can be drawn from their efforts. By pursuing these inquiries, the authors shed new light on the debate surrounding the nature of the de jure dimension of ‘the Brussels Effect’ in the region.

ПЕРСПЕКТИВНІ НАПРЯМИ УДОСКОНАЛЕННЯ РЕГУЛЮВАННЯ СФЕРИ ЗАХИСТУ ПЕРСОНАЛЬНИХ ДАНИХ В УКРАЇНІ

The process of legislative settlement of issues related to the protection of personal data began in the European Union (EU) with the entry into force of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals regarding the processing of personal data and on the free movement of such data (Directive). After adoption the Charter of Fundamental Rights of the European Union (2000), which Article 8 defined the protection of personal data as a human right, establishment of the sufficient principles in the Lisbon Treaty (2009), there were amended two key EU acts: the Treaty on EU and the Treaty establishing the European Community. As a result, everyone in the EU was guaranteed the right to protect their personal data. In 2016 the EU adopted Regulation 2016/679/EC of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data (Regulation), which radically updated the methods of collecting and processing personal data, and not only in the EU. As a result, to comply with its requirements, both EU-based companies and those operating in the EU or working with consumers from the EU market were forced to update their privacy/personal data policies. In turn, in Ukraine, significant progress in the development of legal regulation of personal data protection occurred later. As of 2010, public relations regarding collection, storage, use and dissemination of information about a person were regulated by more than two dozen uncoordinated laws and secondary legislation. To specify and define the mechanisms for implementing the provisions of Article 32, Constitution of Ukraine, which proclaimed the right of a person to non–interference in its personal life and established a ban on the collection, storage, use and dissemination of confidential information about a person without its consent, the Verkhovna Rada of Ukraine in 2010 adopted the law of Ukraine “On Personal Data Protection”. Having played a vital role in the legislative codification of the rules for processing personal data, the law, like the Directive, failed to respond to technological changes and the processes caused by this in society, despite numerous amendments made by MPs. Since the Association Agreement between EU and Ukraine came into power, there is noticeable arising necessity to harmonize the Ukrainian legislative framework with EU, as though contexts of adoption of the Regulation and the Law are different, so are the ways of resolving personal protection issues in Ukraine and the EU. Therefore, it is necessary to establish the new legislative amendments, the degree of compliance of personal data protection standards in Ukraine with the relevant standards in the EU. In this paper, as an outcome of estimations of relevant international research, further analytical and comparative analyses, there are some proposals to future institutional features of such modernization, affecting such issues as: clarification regarding material effects in order to limit legal regulation and avoid excessive legal burden on individuals, as well as in some cases on state authorities; providing new definitions of concepts that are not yet available in domestic regulation; establishment of fundamental guidelines for the processing of personal data in accordance with international standards; fostering more sustainable standards for the processing of sensitive personal data; in-depth structuring the issue of processing personal data for a different purpose than the one for which they were collected; regulating the implementation of the rights of personal data subjects, in particular, the right to information, the right to access, the right to correct personal data, the right to be forgotten, the right to personal data mobility, the right to restrict the processing of personal data, the right to protection from automated decision-making, the right of the data subject to protection of their rights and compensation for damage; clarifications regarding the definitions of the duties and responsibilities of the personal data controllers and operator; sustainable regulations concerning the issue of cross-border transfer of personal data.

The Right to Be Forgotten in the UK: A Case Note on the English and Welsh High Court Reasoning in NT1 & NT2 v. Google and the Post-Brexit Prospects in the GDPR era

The joined cases NT1 & NT2 present the first claim before the High Court of England and Wales (the Court) on the right to be forgotten, established by the Court of Justice of the European Union (CJEU) in the seminal Google Spain case. Both claimants, NT1 and NT2, had submitted a request for the de-listing of search results related to their prior criminal convictions. This case note considers how the Court was therefore faced with the question how to strike a balance between, on the one hand, the right to privacy, and, on the other hand, the publicity of criminal trials. In deciding upon this question, the Court notably weighed both EU and national law sources. It considered three main criteria: the nature of the offence, the public interest in the disclosure of the information concerned, and the rehabilitation of the claimant. This case note argues that the opposing conclusions reached in either of the joined cases are exemplary of the way these three criteria are embedded in the broader common law understanding of privacy and the concept of rehabilitation after criminal convictions. As regards the first criterion, on the nature of the offence, the joined cases suggest that if the offence does not involve dishonesty or is old and ‘not serious’, there is a greater chance that the Court does not consider it necessary for the information to remain public. As regards second criterion, on the public interest, it appears that if the claimant is active in public life in a manner related to the offences, this enhances the public interest in the information. Regarding the third criterion, on rehabilitation, it appears that the Court attaches great value to the concept of remorse for past convictions. The case note embeds these judicial considerations in the emphasis on ‘privileged principles of open justice’ in the English and Welsh common law jurisdiction, which have inhibited the post-war revolt to develop a strong right to privacy in civil law jurisdictions on the European continent. Finally, the case note reflects on post-Brexit data protection standards in England and Wales. Whilst assessing that courts will not be able to easily dismiss the relevance of CJEU case law on data protection, the case note identifies several stumbling blocks to lasting EU-UK equivalence on data protection laws and concludes that if anything, Brexit will diminish legal certainty for citizens and data subjects in England and Wales.

Application of the principle of transparency in processing of European national libraries patrons' personal data

PurposeThe purpose of this paper is to examine the relationship between the legal obligation of European libraries to ensure the transparent personal data processing and respect for user privacy. This paper will examine how libraries use privacy notices on websites to communicate with patrons about the processing of personal data and in what manner have libraries been guided by applicable transparency guidelines.Design/methodology/approachThe method used is the analysis of privacy policies and other privacy documents found on the websites of national libraries. The analysis sample includes documents of 45 European national libraries, 28 out of those being national libraries of European Union (EU) Member States. The elements for this analysis are derived from the mandatory elements of the General Data Protection Regulation and the recommendations of the WP29/EDPB Transparency Guidelines.FindingsThe findings suggest that European national libraries largely adhere to EU data protection standards. In total, 60% libraries use a separate privacy page, and 53% of the EU Member State national libraries websites managed to comply with publishing all necessary data protection information in a way recommended by the Guidelines, compared to 47% of non-Member State national libraries.Originality/valueThe research contributes to the understanding of the importance of the principle of transparency and its operationalization.

B. National Courts National security as an exception to EU data protection standards: The judgment of the Conseil d’État in French Data Network and others

B. National Courts National security as an exception to EU data protection standards: The judgment of the Conseil d’État in <i>French Data Network and others</i>

PCaGuard: A Software Platform to Support Optimal Management of Prostate Cancer.

Background and Objective Prostate cancer (PCa) is a severe public health issue and the most common cancer worldwide in men. Early diagnosis can lead to early treatment and long-term survival. The addition of the multiparametric magnetic resonance imaging in combination with ultrasound (mpMRI-U/S fusion) biopsy to the existing diagnostic tools improved prostate cancer detection. Use of both tools gradually increases in every day urological practice. Furthermore, advances in the area of information technology and artificial intelligence have led to the development of software platforms able to support clinical diagnosis and decision-making using patient data from personalized medicine. Methods We investigated the current aspects of implementation, architecture, and design of a health care information system able to handle and store a large number of clinical examination data along with medical images, and produce a risk calculator in a seamless and secure manner complying with data security/accuracy and personal data protection directives and standards simultaneously. Furthermore, we took into account interoperability support and connectivity to legacy and other information management systems. The platform was implemented using open source, modern frameworks, and development tools. Results The application showed that software platforms supporting patient follow-up monitoring can be effective, productive, and of extreme value, while at the same time, aiding toward the betterment medicine clinical workflows. Furthermore, it removes access barriers and restrictions to specialized care, especially for rural areas, providing the exchange of medical images and patient data, among hospitals and physicians. Conclusion This platform handles data to estimate the risk of prostate cancer detection using current state-of-the-art in eHealth systems and services while fusing emerging multidisciplinary and intersectoral approaches. This work offers the research community an open architecture framework that encourages the broader adoption of more robust and comprehensive systems in standard clinical practice.

Stretching the Limit, The Functioning of the GDPR’s Notion of Consent in the context of Data Intermediary Services

The European Union strives to keep its Data Economy competitive and fit for the future. The proclamation of data as ‘new oil’ requires the envisioning of new ways to make this ‘oil’ available to data-driven industries. The recently adopted Data Governance Act (DGA) is a tool that increases the possibility of data-flows towards data driven industries, while simultaneously promising to maintain uncompromised data protection standards for individuals. The DGA sets the legislative framework for Data Sharing Services or Data Intermediaries. These services stand in between data subjects and data users, and serve as actor that make demand- and supply sides of data meet. When handling personal data, the Data Governance Act pivots on several notions from the GDPR, for instance that of consent. In doing so, it becomes questionable whether or not the notion of consent functions, in the DGA, in the manner as it was envisioned to function in the GDPR. A strict reading of the notion of consent makes its application in the structure of the Data Governance Act difficult to image for reasons explored in this paper. Most pressing are the elements that make up the notion of consent. Those elements being that consent should be specific, freely given and informed. These three elements are put under strain in the DGA’s multi-party, data-pool, or data exchange relationships. This paper highlights how the Data Governance Act states its measures are designed to ‘fully’ respect the GDPR as starting point. However, when examining the notion of consent, true GDPR compliance may be an unobtainable goal or at least an unscalable one in some contexts of the Data Intermediary Services. Keywords: Consent | Data Governance Act | Data Intermediaries | Data Pooling | Data Holders | Data Users | European Strategy for Data

Remote Patient Monitoring Program for COVID-19 Patients Following Hospital Discharge: A Cross-Sectional Study

Background: The COVID-19 pandemic created an urgent need to act to reduce the spread of the virus and alleviate congestion from healthcare services, protect healthcare providers, and help them maintain satisfactory quality and safety of care. Remote COVID-19 monitoring platforms emerged as potential solutions.Objective: The purpose of this study was to evaluate the capacity and contribution of two different platforms used to remotely monitor patients with COVID-19 to maintain quality, safety, and patient engagement in care, as well as their acceptability, usefulness, and user-friendliness from the user's perspective. The first platform is focused on telecare phone calls (Telecare-Covid), and the second is a telemonitoring app (CareSimple-Covid).Methods: We performed a cross-sectional study. The data were collected through a phone survey from May to August 2020. Data were analyzed using descriptive statistics and t-test analysis. Participants' responses and comments on open-ended questions were analyzed using content analysis to identify certain issues and challenges and potential avenues for improving the platforms.Results: Fifty one patients participated in the study. Eighteen participants used the CareSimple-Covid platform and 33 participants used the Telecare-Covid platform. Overall, the satisfaction rate for quality and safety of care for the two platforms was 80%. Over 88% of the users on each platform considered the platforms' services to be engaging, useful, user-friendly, and appropriate to their needs. The survey identified a few significant differences in users' perceptions of each platform: empathy toward users and the quality and safety of the care received were rated significantly higher on the CareSimple-Covid platform than on the Telecare-Covid platform. Users appreciated four aspects of these telehealth approaches: (1) the ease of access to services and the availability of care team members; (2) the user-friendliness of the platforms; (3) the continuity of care provided, and (4) the wide range of services delivered. Users identified some technical limitations and raised certain issues, such as the importance of maintaining human contact, data security, and confidentiality. Improvement suggestions include promoting access to connected devices; enhancing communications between institutions, healthcare users, and the public on confidentiality and personal data protection standards; and integrating a participatory approach to telehealth platform development and deployment efforts.Conclusion: This study provides preliminary evidence that the two remote monitoring platforms are well-received by users, with very few significant differences between them concerning users' experiences and views. This type of program could be considered for use in a post-pandemic era and for other post-hospitalization clienteles. To maximize efficiency, the areas for improvement and the issues identified should be addressed with a patient-centered approach.

7.I. Workshop: Data for health services research: what can we learn from other countries?

High-quality, comprehensive, and timely data is essential for health services research. Increasingly, health services research requires using not only individual datasets but linked data, which use common key variables to bring together information from multiple data sources. This can include clinical data (e.g., results from clinical examination and diagnostic tests), routinely collected data on utilization (e.g., insurance claims) and further, partially unstructured data produced in daily life - as well as data from other areas (economic, environment, social). The need for linked data is reinforced by digital transformation in health care around the world and the availability of new data resources (‘big data') as well as the recent COVID-19 pandemic. We carried out an international comparison of data for health services research - both regarding databases with individual level data as well as those on a geographical or population level. We asked experts from more than ten countries to provide feedback on data linkage initiatives to determine the content of the data, how the data is collected, how the data is linked and cleaned, how the data is stored, and how the data is used for research. In some countries, data collected in the health system is largely fragmented and there is no unique identifier to facilitate linkage across datasets. In other countries, the government supports data linkage initiatives and provides summary data for all public data (down to the census) which can be used on request for projects that are in the public interest. The development - and possible linkage - of relevant databases is closely related to the organizational design of the health care system, especially the structure of service provision and the corresponding billing and reimbursement mechanisms. The accessibility of these databases is also influenced by data protection regulations and standards, including cultural considerations. The objective of this research is to identify important and potentially useful case studies that could provide insights into the different approaches to data linkage that exist worldwide and to perhaps provide ideas for future more or less ‘disruptive' solutions to countries undertaking the ambitious endeavor of health data linking. Therefore, we designed the analysis in such a way that findings on data structure and flow in selected countries are, to the extent possible, system-independent and transferable, while simultaneously also capturing some country-specific regulatory frameworks. This workshop will explore how countries govern and use data generated in the health system and what additional insights about best practices can be learned from the international experience. The workshop will begin with a presentation about the analytical framework, followed by a panel discussion of the experience from country case studies, continue with an audience contribution, and wrap up with a conclusions round.Key messages Data linkage initiatives that bring together information from clinical, utilization, social, and other data sources are increasingly important in health services research.An international comparison of data linkage initiatives provides best practices for data linkage that could be applied in individual country settings.

Financial Intelligence Units: Reflections on the applicable data protection legal framework

Financial Intelligence Units (FIUs) are key players in the current Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) legal system. FIUs are specialised bodies positioned between private financial institutions and states’ law enforcement authorities, what renders them a crucial middle link in the chain of information exchange between the private and public sectors. Considering that a large share of this information is personal data, its processing must meet the minimum data protection standards. Yet, the EU data protection legal framework is composed of two main instruments, i.e. the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED), which provide different thresholds for the protection of personal data. The aim of this paper is to clarify the applicable data protection legal regime for the processing of personal data by FIUs for AML/CFT purposes. To that end, the paper provides an overview of the nature and goals of AML/CFT policy and discusses the problem of the diversity of existing FIU models. Further, it proposes a number of arguments in favour of and against the possibility of applying either the GDPR or LED to the processing of personal data by the FIUs and reflects on how convincingly these arguments can be used depending on the specificities of a given FIU model.

ASSESSING THE IMPLICATIONS OF SCHREMS II FOR EU–US DATA FLOW

AbstractWith the constant flow of data across jurisdictions, issues regarding conflicting laws and the protection of rights arise. This article considers the EU–US data transfer relationship in the aftermath of the decision in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems where the Court of Justice of the European Union (CJEU) invalidated an EU–US data transfer agreement for the second time in just five years. This judgment continues the line of cases emphasising the high value the Court places on securing EU personal data in accordance with EU data protection standards and fundamental rights. This article assesses the implications of the ruling for the vulnerable EU–US data transfer relationship.

Dubai International Financial Centre’s Updated Data Protection Law, Part 2: Implementing a modern, global law in a UAE financial free zone

The Dubai International Financial Centre (DIFC), purveyor of Data Protection Law, DIFC Law No. 5 of 2020, is the result of a legislative overhaul aimed at creating an environment of ethical data management. The Updated DP Law combines international data protection standards of the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act and others with innovative, new concepts that work for the DIFC’s FinTech/X-tech incubator. Ultimately, the goal is to obtain adequacy recognition by the European Commission. This paper is Part 2 in a series that tells us how such a law was created and how a small jurisdiction in the United Arab Emirates is making big strides in data protection.

Privacy-preserving AI for cybersecurity: Balancing threat intelligence collection with user data protection

This paper explores the case of using privacy-preserving artificial intelligence in cybersecurity by analyzing the importance of effective threat intelligence in the conflict with potential invasions and high user data protection standards. With the increased articulation of cyber threats, AI is crucial in fortifying detection, reaction, and prevention measures for cyber threats in CSFs. However, such large-scale information feeding these systems raises many privacy issues, and hence, strong privacy preservation mechanisms that ensure user anonymity and protect the information from misuse are needed. This study reveals how AI threat detection accuracy can be preserved while protecting users' privacy through data obfuscation, differential privacy, and federated learning. Furthermore, the article highlights the need to apply privacy-enhancing patterns, including Privacy by Design, as new patterns in cybersecurity lifecycles. The recommendations derived here are intended to help researchers and practitioners achieve equal data protection results and threat intelligence efficiency when employing AI models. This approach promotes a secure and highly sensitive terrain for disseminating AI-assisted cybersecurity innovations.

State of the Art in Adoption of Contact Tracing Apps and Recommendations Regarding Privacy Protection and Public Health: Systematic Review.

BackgroundDuring the COVID-19 pandemic, contact tracing apps have received a lot of public attention. The ongoing debate highlights the challenges of the adoption of data-driven innovation. We reflect on how to ensure an appropriate level of protection of individual data and how to maximize public health benefits that can be derived from the collected data.ObjectiveThe aim of the study was to analyze available COVID-19 contact tracing apps and verify to what extent public health interests and data privacy standards can be fulfilled simultaneously in the process of the adoption of digital health technologies.MethodsA systematic review of PubMed and MEDLINE databases, as well as grey literature, was performed to identify available contact tracing apps. Two checklists were developed to evaluate (1) the apps’ compliance with data privacy standards and (2) their fulfillment of public health interests. Based on both checklists, a scorecard with a selected set of minimum requirements was created with the goal of estimating whether the balance between the objective of data privacy and public health interests can be achieved in order to ensure the broad adoption of digital technologies.ResultsOverall, 21 contact tracing apps were reviewed. In total, 11 criteria were defined to assess the usefulness of each digital technology for public health interests. The most frequently installed features related to contact alerting and governmental accountability. The least frequently installed feature was the availability of a system of medical or organizational support. Only 1 app out of 21 (5%) provided a threshold for the population coverage needed for the digital solution to be effective. In total, 12 criteria were used to assess the compliance of contact tracing apps with data privacy regulations. Explicit user consent, voluntary use, and anonymization techniques were among the most frequently fulfilled criteria. The least often implemented criteria were provisions of information about personal data breaches and data gathered from children. The balance between standards of data protection and public health benefits was achieved best by the COVIDSafe app and worst by the Alipay Health Code app.ConclusionsContact tracing apps with high levels of compliance with standards of data privacy tend to fulfill public health interests to a limited extent. Simultaneously, digital technologies with a lower level of data privacy protection allow for the collection of more data. Overall, this review shows that a consistent number of apps appear to comply with standards of data privacy, while their usefulness from a public health perspective can still be maximized.

Pool Testing as a Strategy for Prevention of SARS-CoV-2 Outbreaks in Schools: Protocol for a Feasibility Study.

BackgroundSchool closures are a widely implemented strategy for limiting infection spread in the current COVID-19 pandemic. The negative impact of school closures on children and young people is increasingly apparent, however.ObjectiveWe aim to evaluate the feasibility of an infection monitoring program in schools to enable targeted quarantining to replace school closures. The program is currently being implemented in two model schools in Magdeburg, Germany, within the framework of the Study of Coronavirus Outbreak Prevention in Magdeburg Schools (Studie zur Ausbruchsvermeidung von Corona an Magdeburger Schulen [STACAMA]).MethodsFive pupils per class are pseudorandomly selected twice a week and asked to provide a gargle sample over a 16-week evaluation period. RNA is extracted from each sample individually in a laboratory and pooled according to school class for real-time reverse transcription polymerase chain reaction (rRT-PCR) analysis. Immediate individual sample testing will be carried out in the case of a positive pool test. Individual RNA extraction prior to pooling and application of rRT-PCR result in high test sensitivity. Testing will be performed in strict adherence to data protection standards. All participating pupils will receive a 16-digit study code, which they will be able to use to access their testResultsWhen the study commenced on December 2, 2020, 520 (52%) pupils and their families or guardians had consented to study participation. The study was suspended after four test rounds due to renewed school closures resulting from rising regional infection incidence. Testing resumed when schools reopened on March 8, 2021, at which time consent to participation was provided for 54% of pupils. We will quantitatively and qualitatively evaluate the logistics and acceptability of the program.ConclusionsThe findings from this study should inform the design of infection surveillance programs in schools based on gargle samples and a PCR-based pool testing procedure, enabling the identification of aspects that may require adaptation before large-scale implementation. Our focus on each step of the logistics and on the experiences of families should enable a robust assessment of the feasibility of such an approach.International Registered Report Identifier (IRRID)DERR1-10.2196/28673