GDPR Compliance Research Articles

Hyperledger fabric platform for healthcare trust relations—Proof-of-Concept

In recent years, blockchain technologies have expanded from the finance field to other areas that rely on trust-based solutions. The healthcare industry represents one such area, as digital transformation disrupts relationships between patients, healthcare professionals, and healthcare institutes. Patients and healthcare institutes lack a proficient tool to verify the credentials of medical professionals in a digital environment. Furthermore, healthcare professionals lack a tool where they are in control over their credentials. The first contribution of this paper is a proposal of a solution that leverages the private permissioned Hyperledger Fabric blockchain and smart contracts to provide a source of transparent trust for relationships within the healthcare industry. Second, we pave the ground for GDPR compliance by storing only the hash values on the blockchain. Third, we solve the problem of patient authentication by utilizing cryptographic techniques. Finally, we prove the usability of the proposed solution by implementing a user interface and creating a live deployment.

Assessing the Solid Protocol in Relation to Security and Privacy Obligations

The Solid specification aims to empower data subjects by giving them direct access control over their data across multiple applications. As governments are manifesting their interest in this framework for citizen empowerment and e-government services, security and privacy represent pivotal issues to be addressed. By analysing the relevant legislation, with an emphasis on GDPR and officially approved documents such as codes of conduct and relevant security ISO standards, we formulate the primary security and privacy requirements for such a framework. The legislation places some obligations on pod providers, much like cloud services. However, what is more interesting is that Solid has the potential to support GDPR compliance of Solid apps and data users that connect, via the protocol, to Solid pods containing personal data. A Solid-based healthcare use case is illustrated where identifying such controllers responsible for apps and data users is essential for the system to be deployed. Furthermore, we survey the current Solid protocol specifications regarding how they cover the highlighted requirements, and draw attention to potential gaps between the specifications and requirements. We also point out the contribution of recent academic work presenting novel approaches to increase the security and privacy degree provided by the Solid project. This paper has a twofold contribution to improve user awareness of how Solid can help protect their data and to present possible future research lines on Solid security and privacy enhancements.

Implementing GDPR Compliance in Medical Device Data Management

Implementing GDPR Compliance in Medical Device Data Management

Do investments in cancer registry databases and tools bring added value? NORDCAN as an example

Background In the 1990s, the large-scale collaboration Kreftbildet i Norden (KIN) drew attention to the need for timely cancer statistics for cancer control planning in the Nordic countries. Supported by the Nordic Cancer Union (NCU), a web-based version of NORDCAN was continually developed by the Association of Nordic Cancer Registries (ANCR) from 2003, with website support and hosting by the International Agency for Research on Cancer (IARC). Despite empirical evidence of its global reach, the question of whether recurrent investment in NORDCAN brings added value was raised; we sought to formally assess this. Methods Scientific value was determined by extracting publications citing NORDCAN from PubMed. We compared the funds allocated to the KIN project and later Nordic studies on cancer predictions and survival, with those allocated to NORDCAN. Results 96 publications in 43 journals were retrieved. Two publication peaks, in 2010 and in 2016 relate to Nordic cancer survival and Danish age care projects, respectively. Papers citing NORDCAN increased substantially from 4 published in 2017 to the 24 papers in 2022. The integration of survival and prediction projects into NORDCAN reduced the costs of investment to one-quarter of the those required in earlier years, in real terms. Discussion User statistics and scientific output clearly points to NORDCAN bringing added value given resources expended, even with the additional costs imposed to ensure GDPR compliance. Research funding indicates that the databases and interactive tools are critical as both research and education resources. Nonetheless, a sustainable funding model is needed if NORDCAN is to continue to fulfill its utility in cancer control, health care planning and cancer research.

An AI framework to support decisions on GDPR compliance

The Italian Public Administration (PA) relies on costly manual analyses to ensure the GDPR compliance of public documents and secure personal data. Despite recent advances in Artificial Intelligence (AI) have benefited many legal fields, the automation of workflows for data protection of public documents is still only marginally affected. The main aim of this work is to design a framework that can be effectively adopted to check whether PA documents written in Italian meet the GDPR requirements. The main outcome of our interdisciplinary research is INTREPID (artI ficial iNT elligence for gdpR compliancE of P ublic admI nistration D ocuments), an AI-based framework that can help the Italian PA to ensure GDPR compliance of public documents. INTREPID is realized by tuning some linguistic resources for Italian language processing (i.e. SpaCy and Tint) to the GDPR intelligence. In addition, we set the foundations for a text classification methodology to recognise the public documents published by the Italian PA, which perform data breaches. We show the effectiveness of the framework over a text corpus of public documents that were published online by the Italian PA. We also perform an inter-annotator study and analyse the agreement of the annotation predictions of the proposed methodology with the annotations by domain experts. Finally, we evaluate the accuracy of the proposed text classification model in detecting breaches of security.

The Evolution of Consumer Rights in the Digital Marketplace

This study aims to explore the evolution of consumer rights in the digital marketplace, focusing on how technological advancements and changing consumer behaviors have influenced consumer rights and protections. It seeks to identify the main themes and concepts that characterize consumer experiences and concerns in the digital age, with an emphasis on privacy, security, transparency, and inclusivity. Utilizing a qualitative research approach, this study collected data through semi-structured interviews with 26 participants, representing a diverse cross-section of digital marketplace users. The interviews were designed to achieve theoretical saturation, exploring a wide range of experiences and perspectives on consumer rights in the digital domain. Thematic analysis was employed to identify and analyze recurring themes and concepts within the interview data. The analysis revealed three main themes: Changing Nature of Consumer Interactions, Evolving Consumer Rights and Protections, and the Impact of Technological Advancements. Within these themes, key categories emerged, including Digital Consumer Engagement, Trust and Security Concerns, Transparency in Transactions, Right to Privacy, Accessibility and Inclusivity, and the implications of Artificial Intelligence, Blockchain, and the Gig Economy. These categories encompassed concepts such as ease of access, data privacy, clear pricing, GDPR compliance, and personalized shopping experiences, highlighting the complex landscape of consumer rights in the digital marketplace. The study concludes that the digital marketplace presents both challenges and opportunities for consumer rights. Technological advancements have transformed consumer interactions and expectations, necessitating enhanced mechanisms for privacy, security, transparency, and inclusivity. To safeguard and enhance consumer rights in this dynamic environment, a collaborative effort among stakeholders, including businesses, policymakers, and consumers, is essential. Furthermore, fostering digital literacy among consumers is critical for empowering them to navigate and protect their rights in the digital marketplace effectively.

CIDaTa: an ontology-based framework for international data transfers and GDPR compliance

CIDaTa: an ontology-based framework for international data transfers and GDPR compliance

CIDaTa: an ontology-based framework for international data transfers and GDPR compliance

CIDaTa: an ontology-based framework for international data transfers and GDPR compliance

Data sharing in neurodegenerative disease research: challenges and learnings from the innovative medicines initiative public-private partnership model.

Efficient data sharing is hampered by an array of organizational, ethical, behavioral, and technical challenges, slowing research progress and reducing the utility of data generated by clinical research studies on neurodegenerative diseases. There is a particular need to address differences between public and private sector environments for research and data sharing, which have varying standards, expectations, motivations, and interests. The Neuronet data sharing Working Group was set up to understand the existing barriers to data sharing in public-private partnership projects, and to provide guidance to overcome these barriers, by convening data sharing experts from diverse projects in the IMI neurodegeneration portfolio. In this policy and practice review, we outline the challenges and learnings of the WG, providing the neurodegeneration community with examples of good practices and recommendations on how to overcome obstacles to data sharing. These obstacles span organizational issues linked to the unique structure of cross-sectoral, collaborative research initiatives, to technical issues that affect the storage, structure and annotations of individual datasets. We also identify sociotechnical hurdles, such as academic recognition and reward systems that disincentivise data sharing, and legal challenges linked to heightened perceptions of data privacy risk, compounded by a lack of clear guidance on GDPR compliance mechanisms for public-private research. Focusing on real-world, neuroimaging and digital biomarker data, we highlight particular challenges and learnings for data sharing, such as data management planning, development of ethical codes of conduct, and harmonization of protocols and curation processes. Cross-cutting solutions and enablers include the principles of transparency, standardization and co-design - from open, accessible metadata catalogs that enhance findability of data, to measures that increase visibility and trust in data reuse.

Two pillars of open science

CSI-COP Project is an EU-funded Project that investigates GDPR compliance to better understand how far we are being tracked by default as we use the Internet to visit websites and apps on our mobile devices. CSI-COP engages citizen scientists to address the growing concerns in society around privacy issues and the methods that are supposed to ensure integrity in the collection and use of data.This workshop will highlight the fundament rights we all have to digital privacy, explores how much institutions comply with the GDPR, introduces tools and solution to protect your digital privacy and introduces you to a massive open online course on the topic. The workshop will pose questions and concerns about the system scholars use to communicate between themselves (e.g. academic journals and monographs) and with the broader public.An interested observer will notice that the current digital content industry is heavily oriented towards building platforms that track users’ behaviour and seek to convince them to stay longer and come back sooner onto the platform. Similarly, authors are incentivised to publish more and to become champions of dissemination. Generally, the digital content industry is permeable to non-human contributors (algorithms that are able to generate content and reactions), anonymity and identity fraud.It is pertinent to organise a series of workshops about the early signs of track and persuasion in scholarly communication. The CSI-COP project inspired an independent pilot study that tried to determine the opportunity for conducting research about the use of “track and persuade” technologies in scholarly communication. We collected observations on a sample of 148 relevant websites and we interviewed 15 experts related to the field. Through this work, we tried to identify 1) the essential questions that could inspire proper research, 2) good practices to be recommended for future research, and 3) whether citizen science is a suitable approach to further research in this field. The findings could contribute to determining a broader solution for building trust and infrastructure in scholarly communication. The principles of Open Science were used as a framework to see if they offer insights into this work.The CSI-COP project offers an international discussion forum to exchange experiences on the matter of digital tracking and remains open to engaging with the larger public in order to raise awareness and refine results about the use of cookies and other digital trackers.You are all welcome to join this workshop and explore together the depth of digital tracking in the scholarly communication field and beyond it.CSI-COP project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 873169.

Strategies and Recommendation for Data Loading of FHIR-Based Data Marts with Focus on GDPR Compliance.

Interoperability and portability of healthcare data to enable research in the healthcare sector is an important factor towards precision medicine and a learning health system. With many safety-nets put in place like the European General Data Protection Regulation, and local standards like the broad consent set up by the German Medical Informatics Initiative, management and compliance to these standards across all systems and clinical data repositories becomes a daunting task. An appropriate process needs to be established especially when patient data is transferred to and from different systems and standards. On extraction and transforming, an appropriate method of loading the modified data to a destination where it can be read and accessed needs to be established besides functional compliance by the repository systems. This paper makes recommendations in relation to data load strategies while working with FHIR server-based data marts.

Privacy-Aware Cloud Auditing for GDPR Compliance Verification in Online Healthcare

Emerging multitenant cloud computing ecosystems allow multiple applications to share virtualized pool of computing and networking resources. As a result, such ecosystems are becoming increasingly prone to data privacy concerns (personal data leakages and unauthorized access). While cloud computing providers support robust security and privacy mechanisms (e.g., public key cryptography, firewalls, and virtual private networks, among many others), they lack mechanisms and frameworks to monitor, audit, and verify these data privacy concerns. The emergence of data protection regulations around the world, such as General Data Protection Regulation in Europe and the Data Protection Act in the U.K., further emphasizes the need to overcome these privacy limitations. In this article, a novel technique for monitoring, auditing, and verifying the operations carried out on a user’s personal data in cloud computing ecosystems is proposed. Our research methodology leverages distributed ledger technologies (e.g., blockchain and smart contracts) for developing an immutable recording technique, which transparently logs, monitors, and verifies the operations carried out on user data. Using a healthcare pharmacy scenario and extensive real-world experiments, we validate the feasibility of the proposed technique. The proposed work handles a large pool of requests ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$&gt;$</tex-math></inline-formula> 13K) ensuring minimal latency ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\approx$</tex-math></inline-formula> 50–60 ms) and overheads for three different service packages varied with respect to the number of actors and operations.

Taking an Analytic Approach to GDPR Compliance

Taking an Analytic Approach to GDPR Compliance

Media users’ and professionals’ responses to personal data receipts: A mixed methods study

European General Data Protection Regulation requires organisations to request the data subject’s consent for personal data processing. Data controllers must be able to demonstrate valid consent was obtained (‘transparency’). Media often struggle to meet GDPR requirements in practice. We identified several issues with existing consent procedures amongst which a need for trustworthy approaches to record and track consent. In this article, we evaluate a specific transparency initiative: a Personal Data Receipt (PDR) for news personalisation. We investigated how European media users and media professionals evaluated the PDR. We conducted qualitative surveys and interviews to explore and describe individuals’ viewpoints on/responses to the PDR. The main strengths highlighted in this study are: GDPR compliance and improved data processing transparency which leads to more control and user trust. PDR weaknesses are mainly related to users not reading the receipt, lack/overload of information, and design issues. Based on our findings, we identified missing elements and formulated recommendations for PDR improvement to optimise consent strategies. By examining how individuals responded to this specific transparency tool, and rhetorical tactics connected to it (placation, diversion, jargon, and misnaming), our study provides informed suggestions for ways out of digital resignation (Draper &amp; Turow, 2019).

Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent.

The enforcement of the GDPR in May 2018 has led to a paradigm shift in data protection. Organizations face significant challenges, such as demonstrating compliance (or auditability) and automated compliance verification due to the complex and dynamic nature of consent, as well as the scale at which compliance verification must be performed. Furthermore, the GDPR’s promotion of data protection by design and industrial interoperability requirements has created new technical challenges, as they require significant changes in the design and implementation of systems that handle personal data. We present a scalable data protection by design tool for automated compliance verification and auditability based on informed consent that is modeled with a knowledge graph. Automated compliance verification is made possible by implementing a regulation-to-code process that translates GDPR regulations into well-defined technical and organizational measures and, ultimately, software code. We demonstrate the effectiveness of the tool in the insurance and smart cities domains. We highlight ways in which our tool can be adapted to other domains.

A GDPR-Compliant Partner Notification Service.

Partner Notification processes focus on the notification of sexual partners to prevent the transmission of Sexually Transmitted Infections (STIs). The INTEGRATE Joint Action provides an integrated platform called RiskRadar, for combination prevention activities targeting STIs, including an anonymous, free and voluntary Partner Notification service. The presented service information flow ensures privacy, security and GDPR compliance which were identified as vital with similar tools. The service is available via web and mobile interfaces using a unique random code provided from authorised healthcare professionals to support privacy.

Stretching the Limit, The Functioning of the GDPR’s Notion of Consent in the context of Data Intermediary Services

The European Union strives to keep its Data Economy competitive and fit for the future. The proclamation of data as ‘new oil’ requires the envisioning of new ways to make this ‘oil’ available to data-driven industries. The recently adopted Data Governance Act (DGA) is a tool that increases the possibility of data-flows towards data driven industries, while simultaneously promising to maintain uncompromised data protection standards for individuals. The DGA sets the legislative framework for Data Sharing Services or Data Intermediaries. These services stand in between data subjects and data users, and serve as actor that make demand- and supply sides of data meet. When handling personal data, the Data Governance Act pivots on several notions from the GDPR, for instance that of consent. In doing so, it becomes questionable whether or not the notion of consent functions, in the DGA, in the manner as it was envisioned to function in the GDPR. A strict reading of the notion of consent makes its application in the structure of the Data Governance Act difficult to image for reasons explored in this paper. Most pressing are the elements that make up the notion of consent. Those elements being that consent should be specific, freely given and informed. These three elements are put under strain in the DGA’s multi-party, data-pool, or data exchange relationships. This paper highlights how the Data Governance Act states its measures are designed to ‘fully’ respect the GDPR as starting point. However, when examining the notion of consent, true GDPR compliance may be an unobtainable goal or at least an unscalable one in some contexts of the Data Intermediary Services. Keywords: Consent | Data Governance Act | Data Intermediaries | Data Pooling | Data Holders | Data Users | European Strategy for Data

Cookies ‘n’ Consent: An empirical study on the factors influencing of website users’ attitude towards cookie consent in the EU.

Since GDPR came into enforcement in 2018, various firms have been found violating or circumventing the ePrivacy Directive known as the Cookie Law which lays out the cookie consent guidelines for websites. To improve the GDPR compliance rate, several conversations are going on between EU commission, Data protection agencies, business &amp; websites owners and ad vendors regarding their cookie policy, obtaining user consent for data collection and its usage. One of the key stakeholders who are the website users, whose privacy is in question seems to be left out from the discussions. The study aimed to understand user perception towards website cookie banners, which are mandatory under GDPR, and the influence of factors like awareness of cookies, user experience, consent banner design, privacy risk, brand trust on user’s willingness for accepting all cookies, to develop recommendations to improve customer’s motivations to give consent. Using a quantitative approach, the primary data was collected from 132 internet users residing in the EU region through an online survey questionnaire shared in social media networks. The results showed that the (i) majority of respondents had more than moderate level of awareness about cookies (ii) they are more likely to accept cookies for quick access or task completion, (iii) acceptance of cookies was varied across different categories of online activity and (iv) given a choice they are more likely to opt-out of 3rd party cookies which are widely used for targeted advertising. Since 3rd party cookies will be phased out in the near future and are likely to be replaced with more advanced customer tracking technologies which are harder to opt-out of, this study proposes a framework for Consent for Advertising Directive (CAD) to go beyond the existing Cookie Law, which will improve user data protection regardless of the tracking technology used, and help brands to improve transparency about their data collection and avoid GDPR violations.

Enhancing GDPR compliance through data sensitivity and data hiding tools

Since the emergence of GDPR, several industries and sectors are setting informatics solutions for fulfilling these rules. The Health sector is considered a critical sector within the Industry 4.0 because it manages sensitive data, and National Health Services are responsible for managing patients&amp;rsquo; data. European NHS are converging to a connected system allowing the exchange of sensitive information cross different countries. This paper defines and implements a set of tools for extending the reference architectural model industry 4.0 for the healthcare sector, which are used for enhancing GDPR compliance. These tools are dealing with data sensitivity and data hiding tools A case study illustrates the use of these tools and how they are integrated with the reference architectural model.

Blockchain and GDPR – A Study on Compatibility Issues of the Distributed Ledger Technology with GDPR Data Processing

This research work aims to investigate Blockchain technology and GDPR compliance studies. This will analyze the data privacy perspective with respect to distributed ledger technology. Blockchain has become one of the most frequently discussed technologies for its ability to allow for peer-to-peer transactions without a centralized intermediary. The GDPR was implemented in May 2018 for EU member states to maintain data privacy. DLT, the underlying technology of blockchain as is a decentralized system without any monetary authority. This research conducted a thorough literature review on prior conducted research to investigate the problems and determine the gaps of GDPR compliance with blockchain technologies and discuss the technical, use-case designs or solutions that make blockchain more compliant GDPR in terms of privacy. This systematic literature review addresses the gaps, feasibility, efficiency, and data privacy issues on compatibility problems that are primarily concerned with how a distributed ledger technology system in which recorded data or transaction cannot be changed or erased is challenging the GDPR data subject access rights (DSAR), where every data subject’s personal data which is compliant to GDPR has a right to exercise their Rights to rectify, delete or limit the processing of your personal data at any time if necessary.