General Data Protection Regulation Research Articles

It is not just a click: protection of in-game behaviour data as biometric data under the GDPR

This article investigates the potential classification of players’ in-game behaviour data from basic computer peripherals, like keyboards and mouses (behavioural telemetry), as biometric data under the General Data Protection Regulation (GDPR). Modern technologies allow these types of data to reveal a wealth of personal information, including age, gender, emotional states, collaboration abilities, problem-solving skills, economic status, consumption habits, and character traits. The analysis is structured into three sections: understanding the nature of in-game behaviour data, assessing its alignment with the GDPR’s definition of biometric data, and examining the repercussions for gaming companies if such data is deemed biometric. The conclusion asserts that behavioural telemetry and gameplay metrics can indeed be considered biometric under the GDPR, as it plays a crucial role in player identification and exhibits similarities with biometric systems in the context of game analytics processes. This classification implies heightened legal responsibilities for gaming companies, triggering risk-based provisions within the GDPR. The article introduces a novel perspective by suggesting that seemingly innocuous in-game behaviour data may fall under the purview of biometric data.

BRON: A blockchained framework for privacy information retrieval in human resource management

The correctness and the true validated data in Human Resource Management (HRM) are important for organizations as the data plays an impactful role in recruiting, developing, and retaining a skilled workforce. On one hand, the validated data in an organization helps in recruiting legitimate skillful employees; on the other hand, keeping the employee's data safe and maintaining privacy laws such as compliance with the General Data Protection Regulation (GDPR) is also an organization's responsibility. Besides, transparency in human resource management operations is crucial because it promotes trust and fairness within an organization. The present HRM systems are centralized in nature and their verifiable credential system is ineffective; this leads to the intentions of internal data sabotage or internal threats. Besides, the organizations' biases also become more prominent.In this paper, we address the above-mentioned problems with a blockchain framework for HRM to utilize the privacy of data access through a Privacy Information Retrieval (PIR) process. To be specific, our proposed framework called Blockchained piR of resOurces as humaN (BRON), is the first blockchain framework to show an effective mechanism to access data from organizations globally without hampering privacy. BRON uses a generalized user registration process to use the services of data access and in the background, it uses Zero-Knowledge Proofs (ZKPs) for global verification and PIR for privacy-based data retrieval. More specifically, credential verification and ZKP-based PIR are the highlights of our proposed BRON. Another interesting aspect of BRON is the use of Proof-of-Authority (PoA) to validate the anonymity and unlinkability of any HR operation. Finally, BRON has also contributed with a smart contract to incentivize the employees. BRON is very generic and easily be customizable as per the HR requirements. We run a set of experiments on BRON and observe that it is successful in providing privacy-assured data access and decentralized human resource data management. Overall, BRON provides 30% reduced latency and 35% better throughput as compared to the existing blockchain solutions in the direction of HRM.

Incorporating artificial intelligence (AI) into recruitment processes: ethical considerations

Purpose This study aims to explore the implementation of artificial intelligence (AI) into recruitment by considering its potential to maximise the effectiveness of the human resources (HR) processes, challenges associated with the implementation and ethical concerns. Design/methodology/approach A qualitative research approach was used to reach the stated objectives within the context of the small open economy – the Czech Republic. Interviews were conducted with four participants, Czech-based recruiters, each with five or more years of experience in their field. The interviews were conducted in Autumn 2023 within the online platform. The answers were transcribed and thematically analysed. Findings The participants who were interviewed heavily emphasised the importance of the role of the human factor in recruitment, yet several observations and insights were obtained. In particular, some interviewees indicated a possible usage of a chatbot for the first round of the candidates' selection, but they see it as problematic in the final decision on the position fulfilment, where the human factor is not replaceable so far. The key ethical challenges of the broader implementation of AI in the recruitment practices of the respondents remain the risks regarding privacy and data protection, especially the General Data Protection Regulation (GDPR) legislation. Originality/value This article delivers pertinent insights for recruiters on using AI in recruitment, bringing forth a more subtle understanding of the faceted subject of AI-based recruitment.

Towards a GDPR Compliance Assessment Toolkit

The European Union's (EU) General Data Protection Regulation (GDPR) makes it illegal to collect, process, and store personal data unless it is done in accordance with the prescribed legal and regulatory clauses enshrined in the Act. Organisations face significant challenges in navigating GDPR requirements and assessing their level of compliance. In particular, failure to comply with GDPR may potentially expose the data Controller and Processor to steep legal penalties including possibly administrative fines of up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, which is imposed by the Supervisory Authority. This paper presents the results of a minimum viable product, the GDPR Compliance Assessment Toolkit (GCAT). The main objective of the GCAT is to assist organisations to assess their current state of compliance to GDPR. Drawing from an experimental research and development approach, GCAT is then compared with other existing GDPR compliance assessment technologies. Comparative analysis results shows that GCAT simplifies and optimize GDPR compliance assessments.

GDPR compliance via software evolution: Weaving security controls in software design

Software should comply with international privacy laws, like the General Data Protection Regulation (GDPR). However, implementing appropriate technical controls is often an error-prone and time-consuming process. This is partly due to the limited knowledge of software engineers about privacy and security. This paper proposes SoCo, a semi-automated approach to support organizations in achieving software compliance with the GDPR data protection principles. To do so, SoCo supports engineers in identifying and integrating appropriate technical controls in sequence diagrams during the design phase. SoCo includes a technique to assist engineers to identify data processing activities in software applications modeled as sequence diagrams that may need to comply with the GDPR, a catalog of privacy and security controls that engineers can use to fix non-compliant activities, and a technique to implement such controls in the non-compliant sequence diagrams. Our evaluation results show that SoCo can help software engineers identify and design appropriate security controls to address GDPR violations and required moderate manual effort when applied to a substantive open-source application.Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

A Deleuzian Perspective on the Right of Data Protection on Social Media

The goal of this article is to explore – from the given theoretical framework – the effectiveness of the European Union’s data protection capabilities, namely through the General Data Protection Regulation. The first and second sections develop the theory of control societies – as well as its historical background – and connects it with the theory of surveillance capitalism as its essential component. The third section delas with some critiques that have arisen in the few years after the GDPR came into force. The conclusion of the paper is that, only a few years after the GDPR came into force, it is still too early to decisively say what effect will it have on the big data industry. However, from the problems that have been elaborated, it seems unlikely that the big data industry will be meaningfully challenged when it comes to data protection.

How to Elucidate Consent-Free Research Use of Medical Data: A Case for "Health Data Literacy".

The extensive utilization of personal health data is one of the key success factors of modern medical research. Obtaining consent to the use of such data during clinical care, however, bears the risk of low and unequal approval rates and risk of consequent methodological problems in the scientific use of the data. In view of these shortcomings, and of the proven willingness of people to contribute to medical research by sharing personal health data, the paradigm of informed consent needs to be reconsidered. The European General Data Protection Regulation gives the European member states considerable leeway with regard to permitting the research use of health data without consent. Following this approach would however require alternative offers of information that compensate for the lack of direct communication with experts during medical care. We therefore introduce the concept of "health data literacy," defined as the capacity to find, understand, and evaluate information about the risks and benefits of the research use of personal health data and to act accordingly. Specifically, health data literacy includes basic knowledge about the goals and methods of data-rich medical research and about the possibilities and limits of data protection. Although the responsibility for developing the necessary resources lies primarily with those directly involved in data-rich medical research, improving health data literacy should ultimately be of concern to everyone interested in the success of this type of research.

GEN-RWD Sandbox: bridging the gap between hospital data privacy and external research insights with distributed analytics

BackgroundArtificial intelligence (AI) has become a pivotal tool in advancing contemporary personalised medicine, with the goal of tailoring treatments to individual patient conditions. This has heightened the demand for access to diverse data from clinical practice and daily life for research, posing challenges due to the sensitive nature of medical information, including genetics and health conditions. Regulations like the Health Insurance Portability and Accountability Act (HIPAA) in the U.S. and the General Data Protection Regulation (GDPR) in Europe aim to strike a balance between data security, privacy, and the imperative for access.ResultsWe present the Gemelli Generator - Real World Data (GEN-RWD) Sandbox, a modular multi-agent platform designed for distributed analytics in healthcare. Its primary objective is to empower external researchers to leverage hospital data while upholding privacy and ownership, obviating the need for direct data sharing. Docker compatibility adds an extra layer of flexibility, and scalability is assured through modular design, facilitating combinations of Proxy and Processor modules with various graphical interfaces. Security and reliability are reinforced through components like Identity and Access Management (IAM) agent, and a Blockchain-based notarisation module. Certification processes verify the identities of information senders and receivers.ConclusionsThe GEN-RWD Sandbox architecture achieves a good level of usability while ensuring a blend of flexibility, scalability, and security. Featuring a user-friendly graphical interface catering to diverse technical expertise, its external accessibility enables personnel outside the hospital to use the platform. Overall, the GEN-RWD Sandbox emerges as a comprehensive solution for healthcare distributed analytics, maintaining a delicate equilibrium between accessibility, scalability, and security.

Social Media Platforms and General Data Protection Regulation Violation for Minor Users

Social Media Platforms and General Data Protection Regulation Violation for Minor Users

A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs

Specifying legal requirements for software systems to ensure their compliance with the applicable regulations is a major concern of requirements engineering. Personal data which is collected by an organization is often shared with other organizations to perform certain processing activities. In such cases, the General Data Protection Regulation (GDPR) requires issuing a data processing agreement (DPA) which regulates the processing and further ensures that personal data remains protected. Violating GDPR can lead to huge fines reaching to billions of Euros. Software systems involving personal data processing must adhere to the legal obligations stipulated both at a general level in GDPR as well as the obligations outlined in DPAs highlighting specific business. In other words, a DPA is yet another source from which requirements engineers can elicit legal requirements. However, the DPA must be complete according to GDPR to ensure that the elicited requirements cover the complete set of obligations. Therefore, checking the completeness of DPAs is a prerequisite step towards developing a compliant system. Analyzing DPAs with respect to GDPR entirely manually is time consuming and requires adequate legal expertise. In this paper, we propose an automation strategy that addresses the completeness checking of DPAs against GDPR provisions as a text classification problem. Specifically, we pursue ten alternative solutions which are enabled by different technologies, namely traditional machine learning, deep learning, language modeling, and few-shot learning. The goal of our work is to empirically examine how these different technologies fare in the legal domain. We computed F2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$_2$$\\end{document} score on a set of 30 real DPAs. Our evaluation shows that best-performing solutions yield F2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$_2$$\\end{document} score of 86.7% and 89.7% are based on pre-trained BERT and RoBERTa language models. Our analysis further shows that other alternative solutions based on deep learning (e.g., BiLSTM) and few-shot learning (e.g., SetFit) can achieve comparable accuracy, yet are more efficient to develop.

Toward the European Health Data Space: The IMPaCT-Data secure infrastructure for EHR-based precision medicine research

Background:Art. 50 of the proposal for a Regulation on the European Health Data Space (EHDS) states that “health data access bodies shall provide access to electronic health data only through a secure processing environment, with technical and organizational measures and security and interoperability requirements”. Objective:To identify specific security measures that nodes participating in health data spaces shall implement based on the results of the IMPaCT-Data project, whose goal is to facilitate the exchange of electronic health records (EHR) between public entities based in Spain and the secondary use of this information for precision medicine research in compliance with the General Data Protection Regulation (GDPR). Data and methods:This article presents an analysis of 24 out of a list of 72 security measures identified in the Spanish National Security Scheme (ENS) and adopted by members of the federated data infrastructure developed during the IMPaCT-Data project. Results:The IMPaCT-Data case helps clarify roles and responsibilities of entities willing to participate in the EHDS by reconciling technical system notions with the legal terminology. Most relevant security measures for Data Space Gatekeepers, Enablers and Prosumers are identified and explained. Conclusion:The EHDS can only be viable as long as the fiduciary duty of care of public health authorities is preserved; this implies that the secondary use of personal data shall contribute to the public interest and/or to protect the vital interests of the data subjects. This condition can only be met if all nodes participating in a health data space adopt the appropriate organizational and technical security measures necessary to fulfill their role.

Studying Health and Illness Experience using Linked Data (SHIELD): Empowering customers to donate shopping data for chronic pain research

Introduction & BackgroundChronic pain is considered a priority in healthcare and a threat to well-being across the globe, it is thus crucial to accurately measure the national levels of pain conditions and their impacts on workplace productivity and well-being. Chronic pain has traditionally been studied in isolation with either self-reported survey data or standalone shopping records. The former are limited in scale and can be marred by response biases, while the latter lack ‘ground truths’: what research teams can measure are usually the purchase patterns of pain relief products, but neither the severity nor types of pain conditions. Objectives & ApproachData donation tools offer a novel approach to study chronic pain by linking the two aspects and establish statistical relationships between medicine consumptions and the multiple facets of pain experience. In a survey, we asked participants (N = 953) to share their loyalty card data with us, which is made possible with the data portability tool provided by Tesco (i.e., the largest supermarket chain in the United Kingdom) as part of the General Data Protection Regulation (GDPR). Based on questions adopted from popular inventories used in health research (e.g., EQ5D Health States, ONS4 Well-being, WEMWBS scales), we also asked participants to report the details of their pain conditions, hours of employment, and both general and mental health states. This allowed us to associate chronic pain - both subjective and objective (i.e., reflected by medicine consumption) - with its economic and personal consequences. Data collection was conducted via research panel providers, thus should approximate national representativeness. Relevance to Digital FootprintsThis work links digital footprints data donated by individuals to self-reported survey data, also develops an infrastructure for these data to be collected and safely stored. Conclusions & ImplicationsOne key value of this project is to pioneer a measure of chronic pain that can be applied to transactional records that are much bigger in scale in future analytic works. Our research team has access to an array of different digital footprints data, including longitudinal transactional data provided by a major pharmacy chain (~20 million customers and ~429 million baskets). In order to utilise these data to associate them with regional workplace productivity measures and well-being data released by the Office for National Statistics, a metric must be defined to extract the prevalence of chronic pain from shopping data, which is informed by the patterns found by the data donation project.

Impact of the General Data Protection Regulation on the Global Mobile App Market: Digital Trade Implications of Data Protection and Privacy Regulations

Impact of the General Data Protection Regulation on the Global Mobile App Market: Digital Trade Implications of Data Protection and Privacy Regulations

The DMA’s Consent Moment and its Relationship with the GDPR

Abstract The Digital Markets Act (DMA) is designed to ensure fair and contestable digital markets. With one of the key sources of market power of big tech being data, it is not surprising that it is the subject matter of a number of DMA provisions. Article 5(2) prohibits gatekeepers from engaging in forms of accumulation and cross-use of personal data, unless they receive users’ consent, defined by reference to the General Data Protection Regulation (GDPR). Consent as defined by the GDPR suffers from a number of shortcomings, among other things, relating to whether consent can be truly freely given. The DMA tries to address some of the shortcomings by formulating a version of consent that seemingly goes beyond the GDPR. While a new version of consent may ensure greater effectiveness, it raises questions concerning the interaction and compatibility with the GDPR. To shed light on this issue, the paper discusses the role and meaning of consent in the DMA vis-à-vis the GDPR and explores how to interpret consent under both the DMA and GDPR in a manner that is consistent with each other and that accounts for the characteristics of digital markets.

Understanding Public Perception of Internet Security in the European Union

Abstract This paper presents an extensive analysis of Internet security experiences and perceptions among European Union (EU) citizens, as detailed by data within commented graphics highlighting awareness of online privacy practices, security-related aspects and data tracking methods. The paper also examines the implications of the General Data Protection Regulation (GDPR) regarding businesses operating within the EU and the European Economic Area (EEA). Via a thorough investigation of Internet users' awareness of cookies as tracking tools and the prevalence of security-related incidents, the paper provides insights into the evolving landscape of online privacy and security. It elucidates the challenges and opportunities presented by GDPR compliance for businesses, compliance requirements, spanning core principles and broader implications of data processing practices. The findings mark the imperative to align businesses’ operations with GDPR provisions, addressing key aspects such as consent mechanisms, lawful bases and the importance of robust data security measures. The conclusion reveals the significance derived from the intersection of internet security perceptions, GDPR compliance, and business operations within the EU and EEA. Synthesizing empirical data with regulatory analysis, the paper provides a valuable understanding of the challenges and opportunities within the evolving regulatory landscape, thereby equipping businesses with actionable strategies in order to safeguard data privacy rights and uphold regulatory compliance in the digital age.

Analysis of GDPR Compliance in Utilizing Personal Data for Public Health Purposes in Romania.

The General Data Protection Regulation (GDPR), which became effective on May 25, 2016, underscored the significance of confidentiality across various economic and social domains. Within the medical sector, confidentiality of patient health information is meticulously governed by laws, e.g., no. 95/2006 and no. 46/2003. While these laws address numerous privacy aspects within the doctor-patient relationship, it becomes necessary to update them to align with the latest advancements in emerging technologies, particularly in the context of telemedicine. Upon reviewing the overview of rules pertaining to health data processing in Romania, as published by the European Data Protection Board (EDPB) in 2021, and comparing it with the current public health and research laws in Romania, it becomes apparent that there is a regulatory gap concerning the secondary use of health data. This gap is particularly notable in terms of planning, managing and enhancing the healthcare system, as well as utilizing such data for scientific and historical research purposes, leading to the necessity of developing and regulating the European Health Data Space. Although steps have been taken to align the GDPR legislation in Romania, there is still a disproportionality in the regulation of privacy and cyber security with the implementation of new technologies that will collect, process and store sensitive medical data.

The data quality problem (in the European Financial Data Space)

Abstract By creating the European Financial Data Space (EFDS), the European Commission aims to foster the development of data-driven innovation in the financial sector. Artificial intelligence (AI) is the most notable innovation that could benefit from enhanced access to data through the EFDS. However, the current policy framework establishing the EFDS suffers from a major limitation—it neglects the question of data quality or whether the data shared in the EFDS will be fit for the purpose of the development of AI applications. The AI Act and General Data Protection Regulation could play a role in fostering data quality in this area, but the two frameworks are also unlikely to do that to a satisfactory extent. To address the data quality problem, this article proposes policymakers should develop a framework for data quality that encompasses both a conceptual and an organizational dimension aimed at promoting the free flow of high-quality data in the EFDS.

Navigating compliance and regulations in marketing analytics: Upholding ethical standards and consumer trust

This paper delves into the multifaceted marketing analytics compliance and regulation landscape across diverse business sectors and legal frameworks. It discusses a spectrum of norms with respect to overseeing data collection, processing and utilisation in marketing endeavours. Stringent global laws govern the handling of personal data, necessitating strict adherence. The paper scrutinises pivotal compliance elements like consent, transparency and data security alongside pivotal legislation like the California Consumer Privacy Act and the General Data Protection Regulation. It assesses the implications for marketing analytics, emphasising rights regarding personal data access, erasure anonymisation methods and ethical data use. Non-compliance repercussions, encompassing legal and financial risks and reputational harm, are highlighted, as many industries are facing distinct regulatory challenges. The paper details the essential components of policies, training, monitoring and enforcement that are crucial to ensuring marketing compliance. It stresses the role of technology, advocating for marketing compliance software to streamline processes, monitor compliance and adapt swiftly to regulatory shifts. It elucidates the collaborative nature needed within marketing teams to achieve effective compliance management. The conclusion highlights how compliance software helps with regulatory updates, data privacy, monitoring and content assessment. This paper emphasises the dynamic nature of marketing analytics compliance, urging vigilance with regard to legislative alterations and technological advancements. The paper provides a comprehensive insight into managing compliance challenges in this evolving field while upholding ethical standards and fostering consumer trust.

Implementation and Execution of Big Data-based Studies in Ophthalmology within the Framework of the GDPR.

The processing of the retrospective data pool for ophthalmology holds huge potential, especially for the research sector. "Big Data" enables medical science to draw conclusions for the future from historical data. Based on the evaluation of such data, algorithms could be trained, for instance, that are capable of making decisions with the help of artificial intelligence. As a result, the medical decision-making process on certain issues could be accelerated, enriched in qualitative and quantitative terms, or even completely be taken over. Ophthalmology is a rapidly evolving field. Due to the multitude of partly automated medical imaging technologies and the predestined accessibility of the eye for such technologies, ophthalmology, similarly to radiology or dermatology, is well suited for artificial intelligence-assisted image data analysis and the frequently associated initiation of diagnosis and therapy. Meanwhile, numerous studies exist based on AI-assisted image data analysis of ophthalmological image data. To the extent that the algorithms filter out results from the data pools by means of calculation rules and are even capable of making independent decisions on the basis of decision trees, the enormous benefit and, simultaneously, the profit for scientific research is quite obvious. Accordingly, it would be desirable to have unrestricted and comprehensive possibility of corresponding data processing of these health data for ophthalmological research. In spite of the potential for ophthalmology, for which there is only fragmentary evidence, the question of practical feasibility arises. In particular, the legal requirements and limits of European and national data protection law must be taken into account, prior to any unreflected processing of personal (health) data. Only by doing so can we circumvent existing obstacles and pitfalls, which can lead to severe fines. Most important are to date the requirements of two legal texts: The General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). This article provides an overview of the relevant legal requirements applicable in the field of ophthalmology and highlights the major pitfalls and implementation requirements.

Synthetic data and European General Data Protection Regulation: Ethics, quality and legality of data sharing

Synthetic data is increasingly being used across the financial services, clinical research, manufacturing and transport industries. In clinical research, use cases for synthetic data include secondary analysis to identify novel treatment pathways, to develop healthcare policies, to evaluate research methods and, importantly, to evaluate research hypotheses without exposing real patients to potentially harmful experimental treatments. Methods for creating synthetic data in a manner that can reconcile the privacy of clinical trial participants while preserving the utility of data for analysis are rapidly evolving. However, challenges remain that include obtaining appropriate consent for the use of real patient data in the creation of synthetic datasets, eliminating bias in synthetic data and ensuring that data privacy concerns can be addressed.