International Data Protection Research Articles

Univie: An App for Managing Digital Health Data of Refugees.

The refugee crisis has reached historic proportions, with more than 82 million people on the run. Access to healthcare is often difficult for them due to a lack of medical records and language barriers. This paper examines a digital medical documentation system for refugees that captures, stores, and translates records. International data protection standards are considered. The contribution consists of designing a system that manages and translates medical data across borders and integrates a prediction model for epidemics in refugee camps.

Surveillance and Five Eyes: Changing Dimensions of India’s Cyber Security

Cyber security becomes more challenging in the interconnected global environment when digital borders surpass physical boundaries. This study closely looks into the dynamic interactions that exist between the Five Eyes Alliance’s widespread surveillance tactics and India’s cyber security resilience. Amid this complex web of international data protection dynamics, the tactics used by India provide insights into the difficulties faced and the creative solutions advancing the country’s digital defence. A thorough understanding of India’s response to the evolving threats posed by the cooperative intelligence efforts of Five Eyes’ alliance is shedding light on the multifaceted dimensions of the country’s cyber security posture as it navigates this challenging terrain. This investigation adds significant information to the larger conversation on global cyber security by highlighting the necessity of flexible tactics and creative solutions for protecting digital assets, both globally and domestically in India.

Leonhard Med, a trusted research environment for processing sensitive research data.

This paper provides an overview of the development and operation of the Leonhard Med Trusted Research Environment (TRE) at ETH Zurich. Leonhard Med gives scientific researchers the ability to securely work on sensitive research data. We give an overview of the user perspective, the legal framework for processing sensitive data, design history, current status, and operations. Leonhard Med is an efficient, highly secure Trusted Research Environment for data processing, hosted at ETH Zurich and operated by the Scientific IT Services (SIS) of ETH. It provides a full stack of security controls that allow researchers to store, access, manage, and process sensitive data according to Swiss legislation and ETH Zurich Data Protection policies. In addition, Leonhard Med fulfills the BioMedIT Information Security Policies and is compatible with international data protection laws and therefore can be utilized within the scope of national and international collaboration research projects. Initially designed as a "bare-metal" High-Performance Computing (HPC) platform to achieve maximum performance, Leonhard Med was later re-designed as a virtualized, private cloud platform to offer more flexibility to its customers. Sensitive data can be analyzed in secure, segregated spaces called tenants. Technical and Organizational Measures (TOMs) are in place to assure the confidentiality, integrity, and availability of sensitive data. At the same time, Leonhard Med ensures broad access to cutting-edge research software, especially for the analysis of human -omics data and other personalized health applications.

Control of Personal Data and Cyber ​​Space by Global Digital Platforms in Relation to Indonesia's Digital Sovereignty

The dominance of foreign digital platforms in the application ecosystem within Indonesia poses significant implications for the sovereignty of the Indonesian state; the utilization of such foreign digital technologies results in the inadvertent surrender and delegation of citizen data to foreign entities for monitoring and processing purposes. This phenomenon has elicited concern among legal scholars, as the usage of foreign applications signifies the applicability of the legal frameworks from the countries of origin of these applications. This raises critical questions regarding the sovereignty of the Indonesian state, particularly concerning its ability to exert control over data and cyberspace in the context of global platforms. The methodological approach employed in this investigation is grounded in normative legal research, utilizing a conceptual framework that examines relevant legal statutes. The aggregation and distribution of personal data constitutes an infringement upon individual privacy rights, as the right to privacy inherently encompasses the prerogative to determine the provision of personal information. The strategic policies and initiatives undertaken by the Indonesian government to bolster national digital sovereignty can be realized through several measures: the implementation of comprehensive personal data protection standards to enhance national digital sovereignty, the establishment of an independent authority for personal data protection, the fortification of cybersecurity measures to mitigate data security risks, and the jurisdictional enforcement of cyberspace law towards achieving digital economic sovereignty. There exists a pressing need for extensive regulatory frameworks to safeguard personal data as an integral component of human rights. A balance must be struck in the management of personal data processing, ensuring the protection of rights and fostering awareness among data subjects, thereby facilitating the development of a secure digital economic ecosystem that offers legal certainty for enterprises and enhances consumer confidence. Furthermore, the establishment of equitable international personal data protection regulations is essential to support the advancement of the digital economy through arrangements governing cross-border data flow.

Language Translation Tool

The Language Translation Tool project aims to develop an advanced, user-friendly software application that facilitates accurate and efficient translation between multiple languages. Leveraging the latest advancements in neural machine translation (NMT) and artificial intelligence (AI), the tool is designed to overcome the limitations of traditional translation methods, providing high-quality translations in real-time. The core of the tool is built on state-of-the-art transformer models, such as OpenAI's GPT-4 and other comparable architectures, which have been fine-tuned on extensive multilingual datasets. This allows the tool to not only translate text with remarkable accuracy but also to understand context, idiomatic expressions, and cultural nuances, ensuring that the output is both grammatically correct and contextually appropriate. Key features of the Language Translation Tool include: The project also emphasizes data privacy and security, ensuring that user data is handled with the utmost confidentiality and compliance with international data protection standards. In conclusion, the Language Translation Tool project represents a significant step forward in bridging language barriers, fostering global communication, and promoting cross-cultural understanding through innovative technology. The successful implementation of this tool promises to revolutionize how individuals and organizations interact in an increasingly interconnected world.

Enhancing Big Data Security through Comprehensive Data Protection Measures: A Focus on Securing Data at Rest and In-Transit

Purpose: This research paper aims to enhance Big Data security by implementing comprehensive data protection measures, focusing on securing data at rest and in transit. In the era of Big Data, organizations handle vast quantities of data characterized by high velocity, volume, and variety, which complicates management and increases security risks. Methodology: The study examines various data protection strategies, including encryption, access control, data masking, immutable storage, tokenization, and physical security for data at rest. For data in transit, it explores encryption protocols, secure transfer methods like SSH and TLS, VPNs, Zero Trust architecture, and secure APIs. These methods are crucial for safeguarding sensitive information and preventing unauthorized access. Findings: The findings highlight common security challenges in Big Data, such as data breaches, unauthorized access, and integrity issues. The study emphasizes the need for robust protection measures and offers a comprehensive view of the data security landscape. Implementing these strategies helps organizations safeguard sensitive information and ensure compliance with international data protection regulations, enhancing their overall security posture. Unique contribution to theory policy and practice: This paper contributes to theory, policy, and practice by advocating comprehensive data protection strategies. It stresses the importance of continuous monitoring and regulatory compliance, providing practical insights into best practices and technologies that protect Big Data. The research supports developing robust data protection policies and practices, advancing knowledge in Big Data security.

DATA BREACHES EXIT STRATEGY: A COMPARATIVE ANALYSIS OF DATA PRIVACY LAWS

Data has become highly valuable in the era of digitalisation and is the main target of cybercriminals. Cybercriminals steal data by exploiting system vulnerabilities. The rise of catastrophic data breach incidents affects business operations, reputation and legal standing, leading to business disruptions, financial loss and reputation damage. These incidents have raised data security concerns. The frequent incident is partly due to insufficient security measures in place. This article employs doctrinal research focusing on legal principles based on legislation to analyse Malaysia’s legal framework for protecting personal data in Malaysia and a comparison with other jurisdictions, i.e. the European Union General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 and the China Personal Information Protection Law (PIPL). The findings show that Malaysia’s data protection laws fall short of the international norm in some areas. This article suggests that Malaysian policymakers may amend the Personal Data Protection Act 2010 to align with international data protection standards to strengthen data security measures in preventive, detective and responsive data breaches. Consequently, this article provides an analysis of data protection laws in Malaysia and compares them with other advanced jurisdictions. It offers valuable insights into the challenges and opportunities involved in safeguarding personal data, the legal framework, and organisational strategies related to data privacy and security.

Enhancing the Responsibilities of Data Controllers in Vietnam: Insights from the European General Data Protection Regulation


 This article explores the evolving landscape of data protection law in Vietnam, focusing specifically on the responsibilities of data controllers under Vietnam's new Personal Data Protection Decree (Decree No. 13/2023/ND-CP - hereinafter referred to as Decree 13) and compares it with the European Union's General Data Protection Regulation (GDPR). The main objective is to assess how the provisions regarding data controllers’ responsibilities under Decree 13 align with international data protection standards, identifying its progress and challenges. The analysis uncovers both convergence and divergence points between the related provisions under Decree 13 and the GDPR, particularly in terms of clarity, scope, and enforcement mechanisms. A significant challenge identified is the ambiguity in Decree 13’s provisions on data controllers’ responsibilities and the absence of several essential elements, which could undermine the effectiveness of Vietnam's data protection framework. To address these issues, the article offers strategic recommendations for legislative improvements and practical adjustments for data controllers in Vietnam. In conclusion, while navigating the path to a comprehensive data protection framework poses challenges for Vietnam, this journey offers an opportunity to align with regional and global developments in data protection laws. By learning from the GDPR and adapting to its specific features, Vietnam can develop a robust, effective, and trustworthy data protection environment, safeguarding its citizens' privacy rights and facilitating a favorable international business climate.

Legal and Regulatory Framework for the Protection of Scientific Data in Guinea

Faced with the growing importance of data security, this research aims to examine the Guinean legal and regulatory framework relating to the protection of scientific data. Through a systematic analysis of legal and regulatory provisions, enriched by interviews with key players in the academic and scientific community, the study evaluates the coherence and efficiency of legislation in Guinea with regard to international standards. Preliminary findings reveal the existence of notable progress but also significant deficits, particularly with regard to alignment with international data protection standards. On this basis, recommendations are put forward with the aim of improving the current legal and regulatory structure for optimal safeguarding of scientific data in the Republic of Guinea.

A reflection on the UAE's new data protection law: A comparative approach with GDPR

On 2nd January, 2022, the United Arab Emirates' (UAE) new Federal Decree-Law on the Protection of Personal Data came into force and became the first federal-level law to address processing of personal data. This law, which is largely influenced by major international privacy and data protection legislation, in particular the European General Data Protection Regulation (GDPR), is intended to align UAE data protection standards with global standards and principles and also follows the recent trend in legislation for privacy and data protection in the Golf Corporation Council region. This paper follows a comparative approach by highlighting the key aspects of this law through the lens of the GDPR, in attempt to provide an overview of requirements that should be taken into consideration by companies operating or wishing to settle in the UAE.

Data Privacy Regulations in Ghana: A Guide to GDPR Compliance for Businesses

The protection of personal data is a top priority for both individuals and organizations in the modern digital world. In the Ghanaian context, strict data privacy laws are essential to protecting citizens' rights and privacy. The legal foundation for these restrictions is the 1992 constitution of Ghana and Data Protection Act, specifically the Data Protection Act, 2012 (Act 843), which establishes the guidelines for legitimate data processing, the responsibilities of data controllers and processors, and the rights of data subjects. Compliance with local laws, however, may not be sufficient for enterprises operating on a worldwide scale or in international marketplaces as a result of the fact that globalization and digitalization cut across national boundaries. This article delves into Ghana's complex data privacy landscape, illuminating key points and providing suggestions for how businesses can improve their data protection practices by adhering to internationally recognized data protection standards like the General Data Protection Regulation (GDPR) of the European Union. Understanding the fundamental principles of Ghana's Data Protection Act, the scope and applicability of GDPR in Ghana, the importance of data mapping and inventory, the function of Data Protection Impact Assessments (DPIAs), consent and the rights of data subjects, data security and breach notification, and the potential sanctions for non-compliance are some of the key areas of focus. Readers can obtain a profound awareness of Ghana's data privacy landscape and the procedures necessary to successfully align with national and international data protection regulations by navigating this in-depth exploration. Businesses that prioritize compliance with data protection regulations in Ghana are better positioned not only to meet legal requirements but also to foster trust, drive innovation, and contribute to the nation's digital advancement on the global stage. In an ever-evolving digital world where data privacy is paramount.

A cervical cancer biorepository for pharmacogenomics research in Zimbabwe

BackgroundResearch infrastructures such as biorepositories are essential to facilitate genomics and its growing applications in health research and translational medicine in Africa. Using a cervical cancer cohort, this study describes the establishment of a biorepository consisting of biospecimens and matched phenotype data for use in genomic association analysis and pharmacogenomics research.MethodWomen aged > 18 years with a recent histologically confirmed cervical cancer diagnosis were recruited. A workflow pipeline was developed to collect, store, and analyse biospecimens comprising donor recruitment and informed consent, followed by data and biospecimen collection, nucleic acid extraction, storage of genomic DNA, genetic characterization, data integration, data analysis and data interpretation. The biospecimen and data storage infrastructure included shared -20 °C to -80 °C freezers, lockable cupboards, secured access-controlled laptop, password protected online data storage on OneDrive software. The biospecimen or data storage, transfer and sharing were compliant with the local and international biospecimen and data protection laws and policies, to ensure donor privacy, trust, and benefits for the wider community.ResultsThis initial establishment of the biorepository recruited 410 women with cervical cancer. The mean (± SD) age of the donors was 52 (± 12) years, comprising stage I (15%), stage II (44%), stage III (47%) and stage IV (6%) disease. The biorepository includes whole blood and corresponding genomic DNA from 311 (75.9%) donors, and tumour biospecimens and corresponding tumour DNA from 258 (62.9%) donors. Datasets included information on sociodemographic characteristics, lifestyle, family history, clinical information, and HPV genotype. Treatment response was followed up for 12 months, namely, treatment-induced toxicities, survival vs. mortality, and disease status, that is disease-free survival, progression or relapse, 12 months after therapy commencement.ConclusionThe current work highlights a framework for developing a cancer genomics cohort-based biorepository on a limited budget. Such a resource plays a central role in advancing genomics research towards the implementation of personalised management of cancer.

ЦИФРОВЫЕ ИННОВАЦИИ, СООТВЕТ- СТВУЮЩИЕ ТРЕБОВАНИЯМ ПОД/ФТ И РИСК-ОРИЕНТИРОВАННЫЙ ПОДХОД

The article analyzes a review of the best in- ternational practices in the field of AML/CFT, developed and adopted by such countries as Germany, Great Britain, USA, Singapore, France. These include the standards of the Intergovernmental Commission on Financial Monitoring (FATF), as well as the ongoing monitoring and risk-based approach that are being implemented to combat money laun- dering around the world. The following re- search methods were used in the article: an analysis of modern scientific literature by foreign authors, focused on the aspect of crimes related to money laundering in the international AML regime in accordance with FATF standards. The purpose of this study is to consider the possibility of introducing artificial intelligence (AI) in the field of AML/CFT based on an analysis of the best international practices. 13 sources were ana- lyzed, including 4 scientific articles, including those on the introduction of artificial intelli- gence in combating money laundering and terrorism financing, 5 websites of regional organizations like the FATF. The study iden- tified barriers to the introduction of digital innovations in the field of AML/CFT for both commercial organizations and supervisory authorities: the difficulties and costs associ- ated with replacing or updating outdated sys- tems, difficulties associated with the explain- ability and interpretability of digital solutions. It is concluded that, when used responsibly and proportionately, innovative AML/CFT technologies can help identify risks and fo- cus efforts on existing and emerging issues,while manual verification and human partici- pation remain critical, while developing, im- plementing and regulatory oversight of inno- vative technologies should reflect both threats and opportunities, and the use of innovative tools should be compatible with international data protection, privacy and cybersecurity standards.

3D MODELING AS FORENSIC METHOD – SCOPE, LIMITS AND RELIABILITY. LITHUANIAN PRACTICES

The article introduces a new 3D simulation method developed and validated by the Forensic Science Centre of Lithuania, the purpose of which is to automate crime scene investigation and facilitate the performance of expert examination by ensuring the recording of appropriate, reliable and high-quality data and to ensure a clearer visualisation of the case situation. The authors of the articl e present not only the possibilities and the mechanism of applicat ion of the method, but also discuss its compliance with the to international and national standards and data protection requirements applicable for methods of expert investigation. Keywords: forensic examination, forensic examination method, validation of the forensic method, 3D modelling, data protection.

ADEQUACY OF PRIVACY REGIME IN BANGLADESH: KEY CHALLENGES AND POTENTIAL POLICY MEASURES

Privacy is one of the most desired human rights in this ubiquitous computing era - when a vast majority of our work is done online using personal data. Numerous actors are continually monitoring our activities, and consequently, user privacy came under tremendous threats. In response, various legal and policy measures have been adopted at national, regional, and international levels. The citizens of Bangladesh are also experiencing diverse privacy threats, and hence, they deserve to have adequate legal protections. This context requires a study to search for answers to the question - whether there are any legal protections for privacy in the existing legal regime of Bangladesh comparable with international data protection standards. This study aims to fill the gap using doctrinal legal research methodology. The findings of this study reveal that although there is no privacy or comprehensive data protection law in Bangladesh, privacy is conditionally recognised in the Constitution. There are numerous isolated privacy provisions in some other subsidiary legislation and references to privacy in several case laws as well. The results of this study will enlighten all stakeholders regarding privacy issues and facilitate them to map and design future policy strategies. This eventually contributes to establishing a safer online ecosystem in Bangladesh.

Digital Services Tax: Challenge of International Cooperation For Harmonization

The spread of the digital economy brings about many benefits, for example in terms of growth, employment and well-being more generally. These challenges extend well beyond domestic and international tax policy and touch upon areas such as international privacy law and data protection, as well as accounting and regulation, a strategic tax policy perspective, the uptake of digital technologies may potentially constrain the options available to policymakers in relation to the overall tax mix. Technological innovation and the growth of the Internet have profoundly affected trade relations, production processes and products, and the organization of companies. The digital economy is characterized by several key elements, such as the massive expansion of intangible assets; intensive use of data (especially personal data), and widespread adoption of multi-faceted business models that exploit the value externalities of free assets. As the digital economy brings us into new territory, is fair taxation fiction or reality? Although overcoming the numerous ch a l l en g es will be a difficult task for policy makers , fair taxation of the digital e c o n o m y is a reality. A prerequisite to making real sustainable change is enthusiastic country commitment and international cooperation. Asia and the Pacific region need to pull together and push forward the necessary reforms, innovate tax structures and administration, and continue to learn from each other’s experiences. Other key enablers include a coherent strategy and strong evidence-based communication and knowledge.

Dubai International Financial Centre’s Updated Data Protection Law, Part 2: Implementing a modern, global law in a UAE financial free zone

The Dubai International Financial Centre (DIFC), purveyor of Data Protection Law, DIFC Law No. 5 of 2020, is the result of a legislative overhaul aimed at creating an environment of ethical data management. The Updated DP Law combines international data protection standards of the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act and others with innovative, new concepts that work for the DIFC’s FinTech/X-tech incubator. Ultimately, the goal is to obtain adequacy recognition by the European Commission. This paper is Part 2 in a series that tells us how such a law was created and how a small jurisdiction in the United Arab Emirates is making big strides in data protection.

“Naturaleza intrínseca”, “contexto” o “finalidad” en la determinación del carácter sensible de los datos personales

El presente artículo expone tres posibles respuestas a la pregunta de investigación siguiente: ¿qué hace que los datos personales sean considerados datos personales sensibles? Esta aportación tiene como objetivo contribuir a la revisión crítica del concepto de “datos personales sensibles” o “categorías especiales de datos”, destacando algunos de los problemas implícitos en la construcción e interpretación de su definición jurídica, teniendo como marco de referencia diversos ordenamientos internaciona¬les de protección de datos personales. En particular, el texto analiza los enfoques siguientes: 1) la concepción de la naturaleza intrínsecamente sensible de los datos personales; 2) la aproximación del carácter sensible en función del contexto de su procesamiento, y 3) la propuesta que considera la finalidad del tratamiento de los datos personales.

Оценка степени влияния General Data Protection Regulation на безопасность предприятий в российской федерации

Abstract The purpose of the study is to analyze the existing requirements for personal data security and assess the impact of these requirements on the enterprises security in the Russian Federation. Research method: the problem of ensuring the security of personal data in accordance with the requirements of the Federal law of the Russian Federation FZ-152 and the international General Data Protection Regulation is investigated. The article analyzes the possible risks of interrupting the normal activities of enterprises in the Russian Federation due to violations of these requirements for personal data protection and the imposition of significant fines by international regulators. Numerical relationships are estimated between the amount of fines for violations of established requirements, including General Data Protection Regulation, and the cost of creating an effectiveness personal data protection system. Estimates of the permissible degree of influence of the General Data Protection Regulation requirements on the enterprises security in the Russian Federation are obtained. Research result: a study and comparison of possible penalties for violation of compliance with the requirements of the Federal law of the Russian Federation FZ-152 and the international General Data Protection Regulation was performed. Risk assessments of sanctions for violation of the established requirements for personal data protection were obtained. The analysis of the cost of preparing a personal data protection system for compliance with the requirements of the General Data Protection Regulation was performed. Based on the data obtained, examples of calculating the degree of maturity of the security system are presented – based on the ratio of the share of the budget allocated for security in relation to the cost of creating an effectiveness personal data protection system and based on the ratio of the amount of the fine for violation of the established requirements. The importance of accounting for the costs of personal data security to ensure the security of enterprises in the Russian Federation, taking into account the requirements of the General Data Protection Regulation, is shown

Preserving privacy in speaker and speech characterisation

Speech recordings are a rich source of personal, sensitive data that can be used to support a plethora of diverse applications, from health profiling to biometric recognition. It is therefore essential that speech recordings are adequately protected so that they cannot be misused. Such protection, in the form of privacy-preserving technologies, is required to ensure that: (i) the biometric profiles of a given individual (e.g., across different biometric service operators) are unlinkable; (ii) leaked, encrypted biometric information is irreversible, and that (iii) biometric references are renewable. Whereas many privacy-preserving technologies have been developed for other biometric characteristics, very few solutions have been proposed to protect privacy in the case of speech signals. Despite privacy preservation this is now being mandated by recent European and international data protection regulations. With the aim of fostering progress and collaboration between researchers in the speech, biometrics and applied cryptography communities, this survey article provides an introduction to the field, starting with a legal perspective on privacy preservation in the case of speech data. It then establishes the requirements for effective privacy preservation, reviews generic cryptography-based solutions, followed by specific techniques that are applicable to speaker characterisation (biometric applications) and speech characterisation (non-biometric applications). Glancing at non-biometrics, methods are presented to avoid function creep, preventing the exploitation of biometric information, e.g., to single out an identity in speech-assisted health care via speaker characterisation. In promoting harmonised research, the article also outlines common, empirical evaluation metrics for the assessment of privacy-preserving technologies for speech data.