Handling Of Personal Data Research Articles

Towards an Auditable Cryptographic Access Control to High-value Sensitive Data

We discuss the challenge of achieving an auditable key management for cryptographic access control to high-value sensitive data. In such settings it is important to be able to audit the key management process - and in particular to be able to provide verifiable proofs of key generation. The auditable key management has several possible use cases in both civilian and military world. In particular, the new regulations for protection of sensitive personal data, such as GDPR, introduce strict requirements for handling of personal data and apply a very restrictive definition of what can be considered a personal data. Cryptographic access control for personal data has a potential to become extremely important for preserving industrial ability to innovate, while protecting subject's privacy, especially in the context of widely deployed modern monitoring, tracking and profiling capabilities, that are used by both governmental institutions and high-tech companies. However, in general, an encrypted data is still considered as personal under GDPR and therefore cannot be, e.g., stored or processed in a public cloud or distributed ledger. In our work we propose an identity-based cryptographic framework that ensures confidentiality, availability, integrity of data while potentially remaining compliant with the GDPR framework.

Towards evaluating GDPR compliance in IoT applications

Abstract The General Data Protection Regulation (GDPR) was created for regulating how organizations that collect personal data process and protect it. In cases of digital handling of personal data, GDPR compliance must be proven by analyzing the actions that a system applies in order to gather, process and safeguard the data. We advocate that compliance must be considered in the design phase of the system, by analyzing the dependencies between system entities (e.g. personal data, users etc.) and the processes enacted upon them. Then, it is possible to generate a series of data reports that can be assessed by regulators who inspect the system for GDPR compliance. However, there can not be a universal methodology that covers all application domains and systems. To show proof of concept, we apply the methodology to a remote patient monitoring service that runs in the cloud.

Inside the Organization: Why Privacy and Security Engineering Is a Challenge for Engineers

Machine ethics is a key challenge in times when digital systems play an increasing role in people’s lives. At the core of machine ethics is the handling of personal data and the security of machine operations. Yet, privacy and security engineering are a challenge in today’s business world where personal data markets, corporate deadlines, and a lack of perfectionism frame the context in which engineers need to work. Besides these organizational and market challenges, each engineer has his or her specific view on the importance of these values that can foster or inhibit taking them into consideration. We present the results of an empirical study of 124 engineers based on the Theory of Planned Behavior and Jonas’ Principle of Responsibility to understand the drivers and impediments of ethical system development as far as privacy and security engineering are concerned. We find that many engineers find the two values important, but do not enjoy working on them. We also find that many struggle with the organizational environment: They face a lack of time and autonomy that is necessary for building ethical systems, even at this basic level. Organizations’ privacy and security norms are often too weak or even oppose value-based design, putting engineers in conflict with their organizations. Our data indicate that it is largely engineers’ individually perceived responsibility as well as a few character traits that make a positive difference to ethical system development.

Actualidades de la legislación mexicana sobre el uso de datos personales en la atención médica y la confidencialidad como derecho del médico

Recently, new laws on the handling of personal data have been published. Physicians should know them, since the information they obtain from the patient has been subject to what is therein established. To harmonize medical activity with these provisions, it is necessary to review the current legal framework. After this analysis, we observed that data the doctor registers in the medical record in the form of opinions or technical observations directed to other health professionals are not included. We consider this information should be protected the same way as that of the patient, in order to give legal certainty to the right of doctors to the discretion and confidentiality established in the "prescriptive freedom".

Development of Personal Data Handling Policy in Human Genome Research: a Historical Perspective in Japan

An analysis of the policy, research and historical documents was performed to better understand the regulatory context within which the Japanese government has come to address the social control of human genome research and the measures it has taken, with regard to the handling of personal data, an area where innovations in the life sciences and in information and communication technology overlap. Our study revealed a shift in policy over time from a rigid to a more collaborative approach to regulation. From the 1980s to the 2000s, security control measures were developed to prevent leakage of personal data to external entities, using methods such as anonymisation, which can be applied in a linkable or unlinkable fashion. However, by the 2010s, de-identification measures have been introduced. They make it possible to utilise personal data that is de-identified (not completely, but specific individuals cannot be easily identified) in certain types of genomic research. This also involved the establishment of an independent data protection authority that controls the utilisation of data in collaboration with other stakeholders. Through this process, bioethics policy has become an established science and technology policy in Japan; and in recent years, bioethics policy has also gained relevance in areas outside the life sciences.

Trust and ethical data handling in the healthcare context

Current practices for regulating the processing of personal data are oriented principally towards notions of governance, risk management, and regulatory compliance - based on data protection laws that have, in some jurisdictions, been in place for decades. Despite this framework, individuals are likely to encounter uses of their personal data which, while legal, may appear to lack fairness or legitimacy. Such uses may lead us to conclude that third parties are failing to take due account of our wishes and preferences. An organisation’s handling of personal data might fall short of our expectations in a number of ways, such as through over collection, insufficient care, unexpected or unwelcome use, or excessive sharing. For data controllers, greater focus on ethics (beyond legal compliance), might align them more closely with the expectations of their users and customers. Ethics has been core to the practice of medicine at least since the formulation of the Hippocratic oath [1], but the digital era introduces new risks which require ethical responses. Guidance for data controllers should be based on a clear understanding of digital privacy and its complexities, so that abstract notions of trust and ethics can be transformed into applicable principles and practical measures, while reflecting the diverse stakeholder motivations and interests. This article explores the trust-related factors and challenges that arise from the digital and online processing of personal data, particularly in the context of healthcare. The article proposes ethical principles, and approaches and resources for putting those principles into practice.

European data protection laws: Learnings and implications for Indian business

India’s data protection law is grossly inadequate in terms of personal data protection and privacy. While India is contemplating a separate law on personal data protection, this subject is currently dealt with by various laws. Irrespective of the inadequacies, laws of other countries, specifically the GDPR, have direct bearing on the processing and handling of personal data in India given their exterritorial scope. This paper explores the implication of the EU General Data Protection Regulation (GDPR) on Indian business. The paper reviews the state of data protection laws in India, followed by a review of GDPR and the implications of GDPR for Indian business. The paper argues that since India aims to be counted among the best, it would be wise to ensure that data protection laws are in sync with the best practices from across the world to maintain business competitiveness and ensure a level of personal data protection for its citizens.

Alternative Rule-Making within European Bioethics – Necessary and Therefore Legitimate?

There are two core principles in the law and ethics of biomedical research that could be considered universally accepted: first, all handling of personal data and human biological samples is conditioned by the informed consent of the individual involved; second, all medical research on human biological samples and personal data should be placed under the review of research ethics committees. These concepts are included in international, regional and national guidelines, rules and regulations for processing of data and biobanking. However, the legal implementations are carried out within each national legal order, by national organs enacting administrative decisions applicable within the state. In order for the research project to function in a multinational setting, the EU has developed soft law tools and governance mechanisms to facilitate European biomedical research. The question is whether this can be considered valuable and legitimate on the grounds of enhancing conditions for medical research.

Privacy Protection Legislative Scenario in Select Countries

The right of privacy is well established in international law.In fact, consumer privacy has attracted the widespread attention of regulators across the globe. Of course, privacy laws vary throughout the globe but, unfortunately, it has turned out to be the subject of legal contention between the European Union (EU) and the United States (US).Protection of personal data privacy under the law has been shaped by the interests of multiple constituencies: individuals, commercial organizations, government agencies, law enforcement, and national security services.For corporations that collect and use personal information, now ignoring privacy legislative and regulatory warning signs can prove to be a costly mistake. One of the greatest challenges faced by privacy and data protection professionals is demonstrating that their organizations have complied with the requirements of the various laws governing the handling of personal data. The freshly revised BS10012 can help organizations to meet their privacy management obligations. This is an exploratory, descriptive and qualitative study using secondary sources of data.Here, an attempt has been made to briefly acquaint the readers’ with the privacy laws prevalent in select countries.It is expected that a growing number of countries will adopt privacy laws to foster e-commerce.Undoubtedly, accountability for privacy and personal data protection needs to be a joint-effort among governments, privacy commissioners, organizations and individuals themselves. Legislators all over the world have taken notice and tried to minimize invasion of privacy but without much success.

Colliding Effects of Freedom of Access to Information and Personal Data Protection

Abstract: Significant efforts were taken in BiH in the adoption of legislation guarantying the rule of law and human rights. In the framework of this activity the Law on Freedom of Access to Information and the Law on Personal Data Protection were adopted. Unfortunately, practice in some cases shows present of conflict in implementation of those two laws. The most recent example is the case in which the Personal Data Protection Agency of Bosnia and Herzegovina conducted the administrative proceedings against the Prosecutor’s Office and the Court of Bosnia and Herzegovina for handling of personal data of accused and convicted persons at their official web-sites. As a result of these proceedings, The Personal Data Protection Agency adopted a decision warning the Prosecutor’s Office and the Court of BiH to refrain from such illegal complainant’s data handling and asking them to block personal data of all the persons comprised in the indictments and court decisions posted on its official web-site. This paper analyzes the consequences of the action of the Agency for Protection of Personal Data from perspective of international human rights standards and international jurisprudence and its impact on the justice, rule of law and human rights in the judicial sector.

Privacy Issues and Solutions in Social Network Sites

The security of private information of users online is a critical topic, particularly since social networking applications became popular. According to Cutillo et al. [1], beyond the usual vulnerabilities that threaten any distributed application over the Internet, online social networks raise specific privacy concerns due to their inherent handling of personal data.

Biometric template protection

The objective of this paper is to outline the potential threats to security and privacy that are associated with biometric-enabled applications, to summarize the resulting requirements to ensure secure and private handling of personal data, and to explain why standardization in this area is required. The currently ongoing standardization efforts in ISO/IEC in the area of biometric template protection are described.

Identification practices in government: citizen surveillance and the quest for public service improvement

This paper is concerned with the ambiguities and confusions that arise when studies of the ‘surveillance state’ are contrasted with studies of the ‘service state’. Surveillance studies take a largely negative view of the information capture and handling of personal data by Government agencies. Studies that examine Government service providing take a largely positive view of such data capture as Government is seen to be attempting to enhance service provision to individual citizens. This paper examines these opposing perspectives through a series of case studies and concludes that a new understanding and methodology should be brought forward so as to create a reconciliation of these two points of departure for research. The call is for an holistic appreciation of data capture activities by Government so that researchers and public policy makers alike can appreciate and reconcile these competing perspectives.

Data protection legislation in the United Kingdom

This paper is primarily concerned with development of data protection legislation in the United Kingdom from the late 1960s through to the enactment of the 1984 Data Protection Act. Following a series of private members' bills calling for varying degrees of privacy legislation, the UK government commissioned two significant reports in the 1970s. The first, the Younger Report on Privacy (1972), established 10 principles for the handling of personal data that were to influence data protection statutes in Europe. The Lindop Report on Data Protection (1978) examined public- and private-sector computer systems, recommending a flexible legislative environment – with a set of broad principles guiding a data protection authority in its development of codes of practice aimed at various sectors of the economy. The far-reaching nature of those recommendations can now be appreciated in the work of the modern Information Commissioner's Office, 25 years after the publication of the Lindop Report. However, the momentum created by the two studies faded during the period 1979–82. Labour and Conservative governments respectively consulted further and objected to additional bureaucracy involved in creating a data protection authority. During this period of entropy, unpublished memoranda and correspondence demonstrated how former members of the Lindop Committee maintained the pressure on government, ensuring that their work was not forgotten. Eventually, overseas legislation and the need for the UK to maintain its position at the ‘crossroads of the information highway’ ensured that the UK, albeit grudgingly, enacted a Data Protection Act in 1984. By that time, the UK had lost the lead in defining data protection law and policy established by the Reports of Younger and Lindop. In highlighting findings from the Committees and efforts by dedicated individuals in lobbying successive governments in the late 1970s and early 1980s, the authors demonstrate the importance of preserving historical memory.

Airports as data filters: Converging surveillance systems after September 11th

Airports are crucial channels of mobility for the global citizens of the twenty‐first century. They are points of entry and exit for tourists, business persons, workers, students and of course, for some refugees as well. The scale of operations is huge ‐ international passenger travel increased twelve‐fold in the second half of the twentieth century (Urry, 2000: 50) and the vast majority of this is accounted for in air travel. In the USA alone there are two million daily airtravelers on 20,000 flights (Gottdiener,2001: 1). Airports are ‘placeless’ sites of temporary sojourn, air‐lock chambers for nomadic executives or sun‐seekers. But they have profound social and political significance, particularly in personal data handling.

Applying digital rights management systems to privacy rights management

Disclaimer The views expressed by the authors of this article are their own and may not necessarily be taken to be those of either the Dutch Data Protection Authority or the National Research Council of Canada. Abstract While there are growing concerns about how to manage citizen privacy, currently there are no established technology solutions that meet the privacy needs required in some cases by legislation. In this paper we examine the prospect of adapting systems developed for Digital Rights Management to meet the challenges of Privacy Rights Management. In particular, the goal of this work is the adaptation of DRM technology to produce a privacy management architecture that reflects the requirements of Directive 95/46/EC for the protection of personal data. This paper first outlines the requirements for management of the personal data within the European Community it then describes the changes that would be required to transform a digital rights management system into a system to manage the handling of personal data. The paper concludes with a thorough discussion of the issues and potential of this approach.