Individual Data Protection Research Articles

The Internet of Things (IoT) and its impact on individual privacy: An Australian perspective

The Internet of Things (IoT) heralds a new era of computing whereby every imaginable object is equipped with, or connected to a smart device allowing data collection and communication through the Internet. The IoT challenges individual privacy in terms of the collection and use of individuals' personal data. This study assesses the extent to which the Australian Privacy Principles protect individual privacy associated with data collection through the IoT. A systematic literature review identified four key privacy themes that represent issues related to the collection of individuals' data through the IoT: unauthorised surveillance, uncontrolled data generation and use, inadequate authentication and information security risks. These four themes are used to critically analyse the Australian Privacy Principle's (APPs) protection of individual data. Findings indicate that (1) the APPs do not adequately protect individual privacy of data collected through the IoT, and (2) future privacy legislation must consider the implications of global reach of IoT services, and ubiquity and security of IoT data collection with respect to individual privacy.

Analysis of Legal and Ethical Issues for Data Analytic Service Providers in the Healthcare Industry

This paper will attempt to identify, predict and provide solutions for legal and ethical issues related to the relationship between healthcare providers and DASPs contracted by healthcare providers. First, the paper will attempt to explain “big data” in relation to its adoption in the healthcare industry, providing an overview of big data and including a brief explanation of big data uses in other industries. Second, we will explain the budding roles of DASPs in the healthcare industry. Third, the paper will explore hypothetical ethical and legal situations related to the inevitable relationship between healthcare providers and data analytics providers and attempt to provide solutions (both legal and ethical, where possible) for each scenario presented. And, finally, the paper will set forth some policy advice for DASPs planning to or considering participation in the healthcare sector. We present this analysis from two main premises. First, DASPs in healthcare should be held to a very high standard of ethical conduct for both security and individual data protection and privacy purposes. Second, that new or updated statutory language will be needed to properly protect individual data while simultaneously providing guidance to contracted DASPs working within the healthcare industry.

The Council of Europe Data Protection Convention reform: Analysis of the new text and critical comment on its global ambition

The year 2010 set an important milestone in the development of data protection law in Europe: both Europe's basic regulatory texts, the EU Data Protection Directive and the Council's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), were placed at an amendment process, having served individual data protection for many years and witnessed in the meantime technological developments that threatened to make their provisions obsolete. After briefly presenting Convention 108, the analysis that follows will highlight the Council's data protection system currently in effect as well as developments relating to the Convention's amendment so far with the aim of identifying improvements and shortcomings. While doing this two separate points of view shall be adopted: at first a micro point of view will attempt to identify improvements and shortcomings through an ‘insider’ perspective, that is, judging only the merits and difficulties of the draft text at hand. Afterwards a macroscopic view will be adopted, whereby strategic issues will be discussed pertaining to the important issue of the relationship of the suggested draft with the EU data protection system, as well as, the same draft's potential to constitute the next global information privacy standard.

Statistical Disclosure Control for Data Privacy Preservation

With the phenomenal change in a way data are collected, stored and disseminated among various data analyst there is an urgent need of protecting the privacy of data. As when individual data get disseminated among various users, there is a high risk of revelation of sensitive data related to any individual, which may violate various legal and ethical issues. Statistical Disclosure Control (SDC) is often applied to statistical databases for preserving the privacy of individual data. Microaggregation is an efficient Statistical Disclosure Control perturbative technique for microdata protection i.e. protection of individual data. Unlike k-Anonymity, microaggregation method modifies data without suppressing or generalizing it. But to prevent the disclosure of sensitive data it should not be modified to an extent that the data utility is affected. So, the major challenge is how to perturb the data in such a way that a balance is maintained between data utility and risk of data disclosure. Here in this paper, we have proposed a new SDC method based on multivariate dataoriented microaggregation technique for individual data protection with minimal information loss and low data disclosure risk. Experimental results show that our proposed method proves our claim as when compared with other stateof art existing methods of data protection. General Terms Statistical Disclosure Control, PPDM, Microaggregation

The proposed Regulation and the construction of a principles-driven system for individual data protection

The overhaul of the EU data protection regime is a welcome development for various reasons: the 1995 Directive is largely outdated and cumbersome within an Internet (indeed, Web 2.0) environment. The 2008 Framework Decision is a practically unenforceable instrument, and even harmful in its weakness in protecting personal data. The Commission's proposed Regulation and Directive intended to replace it to improve the data protection afforded to individuals in their respective fields of application across the EU today. This paper considers some of the principles, some new, some old, that underpin the proposed new data protection framework, which was released on 25 January 2012. We offer an analysis of the key principles of lawfulness of the processing, access to justice, transparency and accountability – principles intended to be all-encompassing, abstract and omnipresent. Some of the above principles may appear to be new, but such is not necessarily the case. For instance, the principle of lawfulness is central in the current 1995 Directive, but it reappears in an amended form in the proposed EU data protection framework. On the other hand, the principle of accountability is an addition to the list that will need to prove its value in practice. Regardless of the outcome of the EU data protection framework amendment process and the ultimate wording of the instruments that compose it, the application and visibility of these principles ought to remain unaffected.

Huvariome: a web server resource of whole genome next-generation sequencing allelic frequencies to aid in pathological candidate gene selection

BackgroundNext generation sequencing provides clinical research scientists with direct read out of innumerable variants, including personal, pathological and common benign variants. The aim of resequencing studies is to determine the candidate pathogenic variants from individual genomes, or from family-based or tumor/normal genome comparisons. Whilst the use of appropriate controls within the experimental design will minimize the number of false positive variations selected, this number can be reduced further with the use of high quality whole genome reference data to minimize false positives variants prior to candidate gene selection. In addition the use of platform related sequencing error models can help in the recovery of ambiguous genotypes from lower coverage data.DescriptionWe have developed a whole genome database of human genetic variations, Huvariome, determined by whole genome deep sequencing data with high coverage and low error rates. The database was designed to be sequencing technology independent but is currently populated with 165 individual whole genomes consisting of small pedigrees and matched tumor/normal samples sequenced with the Complete Genomics sequencing platform. Common variants have been determined for a Benelux population cohort and represented as genotypes alongside the results of two sets of control data (73 of the 165 genomes), Huvariome Core which comprises 31 healthy individuals from the Benelux region, and Diversity Panel consisting of 46 healthy individuals representing 10 different populations and 21 samples in three Pedigrees. Users can query the database by gene or position via a web interface and the results are displayed as the frequency of the variations as detected in the datasets. We demonstrate that Huvariome can provide accurate reference allele frequencies to disambiguate sequencing inconsistencies produced in resequencing experiments. Huvariome has been used to support the selection of candidate cardiomyopathy related genes which have a homozygous genotype in the reference cohorts. This database allows the users to see which selected variants are common variants (> 5% minor allele frequency) in the Huvariome core samples, thus aiding in the selection of potentially pathogenic variants by filtering out common variants that are not listed in one of the other public genomic variation databases. The no-call rate and the accuracy of allele calling in Huvariome provides the user with the possibility of identifying platform dependent errors associated with specific regions of the human genome.ConclusionHuvariome is a simple to use resource for validation of resequencing results obtained by NGS experiments. The high sequence coverage and low error rates provide scientists with the ability to remove false positive results from pedigree studies. Results are returned via a web interface that displays location-based genetic variation frequency, impact on protein function, association with known genetic variations and a quality score of the variation base derived from Huvariome Core and the Diversity Panel data. These results may be used to identify and prioritize rare variants that, for example, might be disease relevant. In testing the accuracy of the Huvariome database, alleles of a selection of ambiguously called coding single nucleotide variants were successfully predicted in all cases. Data protection of individuals is ensured by restricted access to patient derived genomes from the host institution which is relevant for future molecular diagnostics.

The Portuguese regulatory regime for Binding Corporate Rules

Given the vast number of requests for authorisations for the transfer of personal data to countries outside of the EU and the growing complexity of how companies and corporate groups choose to structure their international activities, it should hardly have come as a surprise when, in 2003, the Article 29 Data Protection Working Party recommended that the approaches afforded by the standard contractual clauses and Safe Harbor Principles should be complemented by Binding Corporate Rules. Citing a growing demand on the part of multinational companies, which due to their complex architectural structures worldwide would like to benefit from the possibility to adopt ‘codes of conduct for international transfers’ (WP 74, p. 5), the Working Party analysed the possibility of authorizing cross-border data transfers under a BCR system and came to the conclusion that it would be a useful additional alternative to the already existing methods of conducting international transfers. While the Working Party endorsed BCRs in this manner, however, the actual decision of whether to accept BCRs was left to the individual data protection authorities of each member state. Portuguese Law 67/98, of 26 October 1998, on the Protection of Personal Data (the Data Protection Law) implements the EU Data Protection Directive 95/46/ EC. Article 20(2) of the Data Protection Law, which is analogous to Article 26(2) of the Directive, expressly empowers the national data protection authority (the CNPD) to authorize transfers of personal data to a State which does not ensure an adequate level of protection as long as ‘the controller adduces adequate safeguards with respect to the protection of the privacy

Nowe przepisy prawne Unii Europejskiej w sprawie statystyki

The author stresses the important role of legal regulations to meet the basic functions of statistics. The regulations should especially: define the concept and the role of official statistics in contrast to other statistical activities, provide legal basis to observe the independence and objectivity rules by statistical services, grant legitimation to receive data from different sources. The legal regulations shall create the methodological conditions of the functioning information systems in the country based on uniform statistical and economic concepts, classifications and identification systems. They should grant a legal protection of individual data obtained from respondents in statistical surveys. Recently adopted by The European Parliament (EP) and The Council Regulation No. 223/2009 of the 11 March 2009 on European statistics as well as two decisions: No. 234/2008/WE appointing European Advisory Committee on Statistics and No. 235/2008/WE establishing European Consultative Council on Statistics Managing have been discussed.

Protezione dei dati personali e ricerca biomedica

Individual data protection is a legitimate right of everybody, but an excess of zeal in preserving privacy may seriously threaten research for statistical or scientific purposes, e.g. for epidemiological research on medical records; some compromises are needed that guarantee the individual's rights while preserving validity and feasibility of research. An ethical Code for data protection in statistical and scientific research was recently signed from most Italian statistical associations, with the aim of identifying rules and criteria for legitimately and reasonably departing from general rules of Italy's Data Protection Act, when requested from aims and design of research. This paper focuses on biomedical research. The aim is to discuss ethical aspects of clinical and epidemiological research and how they are dealt with by the Code. Peculiarities of biomedical research are first presented along with underlying ethical theories; examples of injuries of legislation on research are then reported from other countries; responses of the Code are finally discussed.

Transborder data flows: adoption and diffusion of protective legislation in the global electronic commerce environment

Information privacy is currently regarded as one of the key ethical issues of the information age. Rapid technological developments and the advent of Internet based commerce or electronic commerce (e‐commerce) have forced several nations of the world to enact legislation to protect the information privacy of their citizens and corporations. Transborder data flows (TBDFs) have been known to have a significant impact on multinational and transnational corporations with respect to international data transfers. This paper discusses the issues and implications of TBDFs and provides a comparative account of the privacy laws on individual data protection in different countries. Also proposed is a theoretical model relating to diffusion of social policies of use with respect to the adoption and diffusion of privacy laws by different nations of the world in a global e‐commerce environment.