Privacy Compliance Research Articles

Privacy-aware Big Data Analytics as a service for public health policies in smart cities

Smart cities make use of a variety of technologies, protocols, and devices to support and improve the quality of everyday activities of their inhabitants. An important aspect for the development of smart cities are innovative public policies, represented by requirements, actions, and plans aimed at reaching a specific goal for improving the society's welfare. With the advent of Big Data, the definition of such policies could be improved and reach an unprecedented effectiveness on several dimensions, e.g., social or economic. On the other hand, however, the safeguard of the privacy of its citizens is part of the quality of life of a smart city. In this paper, we focus on balancing quality of life and privacy protection in smart cities by providing a new Big Data-assisted public policy making process implementing privacy-by-design. The proposed approach is based on a Big Data Analytics as a Service approach, which is driven by a Privacy Compliance Assessment derived from the European Union's GDPR, and discussed in the context of a public health policy making process.

Athletic Training Students' Knowledge of Ethical and Legal Practice with Technology and Social Media

Context:Technology, social media, and access to health care continue to grow simultaneously. There is limited research on the knowledge of athletic training students regarding the ethical and legal practice of protected health information using technology and social media.Objective:To explore social media use of athletic training students and to determine their knowledge of patient privacy regulations within social media and technology.Design and Setting:Online survey instrument and knowledge assessment.Patients or Other Participants:A total of 652 athletic training students.Intervention(s):A knowledge assessment of 12 items based on the governance and use of patient privacy compliance in health care within the context of athletic training students' clinical experiences.Main Outcome Measure(s):An instrument of 26 questions, including 14 demographic and 12 knowledge items, was developed and content validated using a Delphi panel of experts in athletic training, health care information technology, and risk management lawyers. Descriptive statistics and independent t tests were calculated.Results:Athletic training students stated they had received previous education (n = 587 of 637, 92.2%) regarding Health Insurance Portability and Accountability Act (HIPAA) regulations, and had an average of 6.81 ± 2.75 active social media accounts. Only 24.2% (n = 154 of 636) of respondents stated their professional athletic training program had a social media policy that was strictly enforced. We identified a lack of knowledge of best practice by athletic training students, with an average knowledge assessment score of 4.92 ± 1.7 out of 13 (37.8%). Total knowledge scores were significantly different (P = .008) if the respondent had previous HIPAA education.Conclusions:The respondents scored poorly on the knowledge assessment despite previous education related to HIPAA regulations. Athletic training educators should seek out strategies to adapt professional or preprofessional curricula to incorporate health care informatics and ethics to adapt to the current culture of technology and social media.

Blockchain and the European Union's General Data Protection Regulation: A Chance to Harmonize International Data Flows

Future economic growth is dependent on global data sharing. With the EU’s GDPR going into effect May 25, 2018, data privacy law in the EU will be uniform in text. The GDPR applies extraterritorially to any organization that can reach the EU market in terms of access by an EU citizen. While a consistent and coordinated interpretation of the GDPR provides organizations with the requisite assurances needed when operating in an international environment, stricter standards and higher fines require the organizations to rethink their international privacy compliance protocols. Trust-failures in society are the driving force behind such comprehensive regulatory frameworks, but emerging technology like blockchain can aid in minimizing these privacy concerns. Among other things, blockchain properties include decentralization, authentication, confidentiality, accountability, and access control management. By treating data flows as transactions, blockchain applications can work with regulations to facilitate the secure transfer of information. The purpose of this paper is to begin a conversation around utilizing blockchain technology and reducing harmonizing regulations like the GDPR to an automated protocol.

An Accounting Information Systems Perspective on Data Analytics and Big Data

ABSTRACT Forty-six academics and practitioners participated in the second Journal of Information Systems Conference to discuss data analytics and Big Data from an accounting information systems perspective. The panels discussed the evolving role of technology in accounting, privacy within the domain of Big Data, and people and Big Data. Throughout all three panels, several topics emerged that impact all areas of accounting—developing enhanced analytical and data handling skills; evaluating privacy, security requirements, and risks; thinking creatively; and assessing the threat of automation to the accounting profession. Other topics were specific to a segment of the profession, such as the growing demand for privacy compliance audits and the curriculum adjustments necessary to develop data analytic skills. This commentary synthesizes and expands the discussions of the conference panels and suggests potential areas for future research.

How the GDPR Stacks Up to Best Practices for Privacy, Accountability and Trust

The European Commission’s General Data Protection Regulation (GDPR) encompasses perhaps the most monumental pan-European regulation in the last decade and may well become a de facto world standard. The regulation is described as a means to regulate the processing of personal data, the protection of which is a fundamental EU right. The regulation declares, “The processing of personal data should be designed to serve mankind.” The European Commission states that the goals are to give users control of their data and to ease the ability to conduct business. The paper reflects a preliminary investigation to whether and to what degree the choice of instruments of the GDPR conform to the European Union’s research and best practices found in the report “Privacy, Accountability and Trust- Challenges and Opportunities” by the European Union Agency for Network and Information Security (ENISA). The GDPR consists of a set of provisions including Consent, Right to Object to Profiling, Data Portability, Right to be Forgotten/Erasure, One Stop Shop for Privacy Compliance, Data Protection Officers, Data Breach Notification, and Punishments. Meanwhile the four inputs to maximize privacy as defined by ENISA are (1) the user’s knowledge of online privacy, (2) the technology design, (3) the practices of providers, and (4) the institutions governing the system. The investigation shows that there is a deficiency between the provisions and instruments of the GDPR and the inputs recommended by ENISA. While the GDPR stipulates strict regulation (4) and mandates specific business practices (3), it does not discuss how to improve the users’ knowledge of privacy and privacy enhancing behaviors (1), which the Eurobarometer reports are low. This omission is notable as the GDPR claims its key goal is to give users control of their data and to create trust in the society so that the digital economy can grow. Moreover, technology design (2) gets only a brief mention in a paragraph about privacy by design and default. This paper investigates the discrepancy between best practices and policymakers’ choices and proposes some explanations based upon the literature.

Examining the intended and unintended consequences of organisational privacy safeguards

Research shows that despite organisational efforts to achieve privacy compliance, privacy breaches continue to rise. The extant studies on organisational privacy compliance concentrate on the extent to which privacy threats can be alleviated through a combination of technical and human controls and the positive (and often intended) influences of these controls. This focus inadvertently neglects unintended consequences such as impeded workflow in medical practices. To address this research conflict, this study uses an interpretive grounded theory research approach to investigate the consequences of privacy safeguard enactment in medical practices, including whether it influences their ability to meet privacy requirements and whether workflows are impeded. Our central contribution is a theoretical framework, the unintended consequences of privacy safeguard enactment (UCPSE) framework, which explicates the process by which privacy safeguards are evaluated and subsequently bypassed and the resulting influence on organisational compliance. The UCPSE highlights the importance of the imbalance challenge, which is the result of unintended consequences outweighing the intended consequences of privacy safeguard enactment. Failure to address the imbalance challenge leads to the adoption of workarounds that may ultimately harm the organisation’s privacy compliance. Despite several research calls, the consequences and effectiveness of organisational privacy efforts are largely missing from both information systems and health informatics research. This study is one of the first attempts to both systematically identify the impacts of privacy safeguard enactment and to examine its implications for privacy compliance in the healthcare domain. The findings also have practical implications for healthcare executives on the UCPSE and how they could alleviate the imbalance challenge to thwart workarounds and the subsequent negative effects on privacy compliance.

Cloud Software: How to Validate Third‐Party Vendors

The increased outsourcing of applications and data processing by firms raises an important issue: How should you validate the actions of the third‐party vendors? The Sarbanes‐Oxley Act and other compliance issues require some form of judgment of those actions. This article explains the authoritative guidance for reporting on such service organizations. The author looks at assessing the validity of the service provider's internal control, privacy compliance, and other aspects from both the user's and deliverer's point of view.

Evaluating and enriching information and communication technologies compliance frameworks with regard to privacy

PurposeThe aim of the paper is to highlight gaps in compliance environments regarding information privacy and provide recommendations for global information privacy standards.Design/methodology/approachThe paper draws conceptually upon an existing security standard's framework and omissions in information privacy compliance frameworks are recognized. As a result, an extended framework of information security and privacy standards is developed. Moreover, taking into account the different attributes and focus of information privacy as compared to information security, the elicitation of usability criteria for web applications and interfaces that will assist users to protect their privacy, is being proposed.FindingsWithin ICT standards numerous information security standards exist, which enable a common understanding of security requirements and promote global rules and practices for security mechanisms. Through their usage, designed information systems ultimately reach a commonly accepted security level and interoperate with other systems in an efficient and secure way. Nevertheless, a similar compliance environment is missing with regard to information privacy. Often security controls are seen as the solution to privacy protection and security compliance frameworks are regarded as guidance to information privacy as well. This is clearly the wrong approach since the main security and privacy attributes are different; information security refers to information stored, processed and transmitted for completing the information system's functions and purpose, while information privacy is the protection of the information's subject identity.Research limitations/implicationsThe identified gaps in compliance environments are based on extensive literature review, while the proposed enhancements for the information privacy standards are, at this stage, an opinion‐based piece of work.Originality/valueCurrently, information privacy is treated mostly as a legal compliance requirement and thus is not adequately handled by security standards. The paper provides recommendations and further guidance in managerial, procedural and technical level for handling information privacy.

The business of privacy

Over the last decade, privacy has become big business. Company executives hobnob with data protection regulators at conferences held all over the world; associations of privacy officers are experiencing exponential growth in membership; data protection has become a money-maker for consultancies and law firms (as well as for academics who provide consulting services); and lobbyists engage policy-makers in an effort to influence data protection and privacy regulation. In the past, data protection was seen mainly as a cost factor, but now it is increasingly becoming a way to make money, and to ensure the continued trust of customers, employees, and business partners. The economic importance of data processing makes it natural that the business of privacy would expand as well. Viewing privacy as a business opportunity can result in increased attention and resources being devoted to its protection. In recent years, governments and regulators have emphasized that respect for data protection and privacy should be seen as a way to strengthen confidence in online commerce, and have encouraged the growth of the professional side of privacy; indeed, there is evidence that viewing privacy as a business enabler can itself be a powerful factor to encourage respect for regulation. All of this has led more and more companies to take steps to protect privacy as a way to strengthen their brands and enhance customer confidence through measures such as appointing internal privacy compliance officers and taking the impact of business decisions on privacy into account before they are implemented, developments that are all to the good. At the same time, these developments raise questions. Most countries with data protection laws regard privacy as a fundamental right, and viewing the protection of a fundamental right as a money-making opportunity may seem distasteful. The number and cost of conferences and seminars covering privacy issues often seems excessive (not to mention the environmental implications of privacy experts travelling all over the world to attend them). The increasing number of professional firms offering consulting or legal services may have contributed to the emerging view of privacy compliance as a complex and costly exercise. And many smalland medium-sized companies struggle to afford the high cost of the privacy compliance industry, with the result that many simply ignore compliance altogether. It would be hypocritical for the editors to paint the ‘privacy industry’ in too negative a light, since each of us is involved in it in one way or another. On the contrary, we believe that creating economic incentives is one of the most effective ways to further privacy and data protection, and that the growth of privacy as a business area holds the potential to motivate compliance with privacy regulation and individual expectations not just as a matter of law, but for pragmatic economic reasons as well. We see nothing wrong per se with making money from data protection and privacy, as long as the monetary rewards are kept in proportion to the reasons that privacy is protected in the first place. Data protection is not purely a money-making activity like investment banking, but exists to protect fundamental values cherished by societies around the world. This means that everyone involved in the business of data privacy should ask not just how to make it more profitable for themselves, but also how they can use it to give something back to society. Making such contributions need not be a grandiose endeavour, and can include things such as writing articles to explain complicated legal issues to a wider audience; teaching data privacy law to students; and engaging in pro bono activities on behalf of individuals and small organizations. Indeed, we regard IDPL as a forum for discussing important issues of data protection and privacy law, and thus as a way to give something back to what we regard as one of the most fascinating and important areas of law.

Abstract TP408: Availability and Efficacy of Mobile Health Technology Targeting Patients: A Systematic Evidence-based Review

BACKGROUND: There are approximately 14,000 health/medical iPhone apps with a relative lack of both stroke-specific content and studies on effectiveness, usability, and usefulness. OBJECTIVE: Systematic, evidence-based literature search to determine the current availability, usefulness, and efficacy of mobile apps targeting stroke survivors or management of vascular risk factors. METHODOLOGY: Repetitive search study in PubMed and EMBASE using pre-specified medical subject headings (MeSH) terms, Boolean logic, and Preferred Reporting items for Systematic Reviews and Meta-analysis (PRISMA) guidelines (last updated 8/12/12). Publications were screened for inclusion using the following criteria: (1) potential usefulness of smartphones in daily patient care, (2) meta-analyses of stroke/vascular risk factor smartphone applications, (3) trials of smartphone-based patient care tools. RESULTS: We retrieved 73 articles from 2005-12 from 77 identified; 40/73 were duplicates. The remaining 33 abstracts were reviewed independently by 3 reviewers for relevance. Upon final evaluation/adjudication: 13 articles addressed potential usefulness of smartphones, 3 were on traditional specific stroke risk factors (none for stroke itself), and 8 on the results of trials of smartphone-based patient care tools. Sample sizes ranged from 3 to 3,001. Four articles addressed diabetes, two hypercholesterolemia, three weight loss, three diet/activity, one heart disease, and none addressed hypertension specifically. Of these, 8 were clinical trials on effectiveness or usefulness (3 for patient evaluation/monitoring, 2 for rehabilitation, 1 each for diet/activity, imaging, and drug infusion). Only one study evaluated risk analysis of information security with no studies evaluating strict regulation and critical appraisal. CONCLUSION: Despite rapid growth of mobile health applications, there is a paucity of linguistically relevant and culturally sensitive and sustainable stroke-specific apps. There is also a significant lack of studies in general that rigorously test mobile apps for their efficacy, usefulness, and sustainability with specific attention to patient privacy and regulatory compliance.

Improving data quality using a cross layer protocol in wireless sensor networks

Wireless sensor networks (WSNs) in which the location of sensors is a key information are becoming more and more important. Moreover, in many cases privacy is a key issues for such network which can be the target of different kind of security attacks. In this paper we present an approach, named Cross Layer Protocol (CLP), for improving data quality based on an integrated solution that considers a sound privacy management policy coupled with a secure localization protocol. More specifically, CLP exploits consistency between the information on nodes behavior gathered during localization phase and privacy compliance verification to evaluate nodes reputation. Finally CLP effectiveness is evaluated by means of a set of simulations.

Privacy Compliance Risks for Facebook

Facebook is an Internet and societal phenomenon. In just a few years it has claimed a significant proportion of the world's population as regular users, becoming by far the most dominant Online Social Network (OSN). With its success has come a good deal of controversy, especially over privacy. Does Facebook and its kin herald a true shift in privacy values, or despite occasional reckless revelations, are most users actually as reserved as ever? We argue it's too early to draw conclusions about society as a whole from the OSN experience to date. However, Facebook in particular brings a number of compliance risks in jurisdictions that have enacted modern Information Privacy Law.

A dynamic logic for privacy compliance

Knowledge based privacy policies are more declarative than traditional action based ones, because they specify only what is permitted or forbidden to know, and leave the derivation of the permitted actions to a security monitor. This inference problem is already non trivial with a static privacy policy, and becomes challenging when privacy policies can change over time. We therefore introduce a dynamic modal logic that permits not only to reason about permitted and forbidden knowledge to derive the permitted actions, but also to represent explicitly the declarative privacy policies together with their dynamics. The logic can be used to check both regulatory and behavioral compliance, respectively by checking that the permissions and obligations set up by the security monitor of an organization are not in conflict with the privacy policies, and by checking that these obligations are indeed enforced.

VOIP for Telerehabilitation: A Risk Analysis for Privacy, Security and HIPAA Compliance: Part II.

In a previous publication the authors developed a privacy and security checklist to evaluate Voice over Internet Protocol (VoIP) videoconferencing software used between patients and therapists to provide telerehabilitation (TR) therapy. In this paper, the privacy and security checklist that was previously developed is used to perform a risk analysis of the top ten VoIP videoconferencing software to determine if their policies provide answers to the privacy and security checklist. Sixty percent of the companies claimed they do not listen into video-therapy calls unless maintenance is needed. Only 50% of the companies assessed use some form of encryption, and some did not specify what type of encryption was used. Seventy percent of the companies assessed did not specify any form of auditing on their servers. Statistically significant differences across company websites were found for sharing information outside of the country (p=0.010), encryption (p=0.006), and security evaluation (p=0.005). Healthcare providers considering use of VoIP software for TR services may consider using this privacy and security checklist before deciding to incorporate a VoIP software system for TR. Other videoconferencing software that is specific for TR with strong encryption, good access controls, and hardware that meets privacy and security standards should be considered for use with TR.

Beating the privacy challenge

Organisations today need to address the multiple elements of privacy compliance as an urgent priority if they are not to fall foul of privacy legislation or disclosure obligations – and potentially suffer fines, penalties, reputational damage and loss of customer confidence. Some recent high-profile cases have drawn attention to the often competing desires for personal privacy by individuals, better-targeted product and service offerings by organisations, and access to personal information in the fight against terrorism and cybercrime by governments. Grega Vrhovec of the Information Security Forum (ISF) believes that putting a structured data privacy compliance framework in place will help organisations ensure – and demonstrate – that they are meeting data privacy obligations.

A Model-driven Privacy Compliance Decision Support for Medical Data Sharing in Europe

Clinical practitioners and medical researchers often have to share health data with other colleagues across Europe. Privacy compliance in this context is very important but challenging. Automated privacy guidelines are a practical way of increasing users' awareness of privacy obligations and help eliminating unintentional breaches of privacy. In this paper we present an ontology-plus-rules based approach to privacy decision support for the sharing of patient data across European platforms. We use ontologies to model the required domain and context information about data sharing and privacy requirements. In addition, we use a set of Semantic Web Rule Language rules to reason about legal privacy requirements that are applicable to a specific context of data disclosure. We make the complete set invocable through the use of a semantic web application acting as an interactive privacy guideline system can then invoke the full model in order to provide decision support. When asked, the system will generate privacy reports applicable to a specific case of data disclosure described by the user. Also reports showing guidelines per Member State may be obtained. The advantage of this approach lies in the expressiveness and extensibility of the modelling and inference languages adopted and the ability they confer to reason with complex requirements interpreted from high level regulations. However, the system cannot at this stage fully simulate the role of an ethics committee or review board.

Privacy compliance and enforcement on European healthgrids: an approach through ontology

The sharing of medical data between different healthcare organizations in Europe must comply with the legislation of the Member State where the data were originally collected. These legal requirements may differ from one state to another. Privacy requirements such as patient consent may be subject to conflicting conditions between different national frameworks as well as between different legal and ethical frameworks within a single Member State. These circumstances have made the compliance management process in European healthgrids very challenging. In this paper, we present an approach to tackle these issues by relying on several technologies in the semantic Web stack. Our work suggests a direct mapping from high-level legislation on privacy and data protection to operational-level privacy-aware controls. Additionally, we suggest an architecture for the enforcement of these controls on access control models adopted in healthgrid security infrastructures.

Influence of the Privacy Issue in the Deployment and Design of Networking Robots in European Urban Areas

In this paper we analyze how the privacy issue will affect the deployment and design of networking robots in European urban areas. Privacy means the way to guarantee self control on private data that can be processed by networked robots. We start by analyzing the technical capabilities of networked robots in public and private spaces, the legal framework and technical solutions. Then, we present the main European Directives and how they affect networked robots. Next, we discuss the legal criteria for privacy compliance, analyzing the surveillance utilities and the wireless communication systems. We also discuss the current legal framework for ubiquitous computing and analyze the anonymous processing for mobility management purposes using a Bluetooth scanning sensor. Finally, we present some open questions.

Privacy Aware Engineering: A Case Study

Privacy is a complex social process that will persist in one form or another as a fundamental feature of software engineering. For successful privacy aware engineering, it is critical to guarantee the alignment and compliance among privacy artifacts emerging during software development process. In this paper, we propose a privacy compliance engineering flow in which we investigate the involved necessary privacy artifacts and discuss their alignment, refinement, and compliance verification. Within an exemplary case study, we identify the privacy artifacts introduced in the refinement process and analyze their compliance verification.

Information privacy compliance in the healthcare industry

PurposeThe Health Insurance Portability and Accountability Act (HIPAA) is US legislation aimed at protecting patient information privacy, but it imposes a significant burden on healthcare employees, especially since the privacy provisions are still evolving and healthcare organizations are still struggling to meet compliance criteria. This study seeks to illuminate characteristics of both the environment (organization) and the individual (healthcare professional) and their relevant influence on compliance intentions by leveraging theories from the domains of social psychology, management, and information systems.Design/methodology/approachA study of 208 healthcare professionals located at healthcare facilities throughout the USA were surveyed as to their perceptions regarding HIPAA compliance and the underlying organizational and individual factors that influence said compliance.FindingsThe findings indicate that perceptions of organizational support and self‐efficacy (SE) leading to HIPAA compliance vary based on organizational and occupational characteristics. Furthermore, these perceptions of organizational support and SE explain some of the differences in their intent to comply with this legislation.Research limitations/implicationsFor healthcare managers, the findings of this research may serve to validate HIPAA compliance initiatives. Through increased attention and resources dedicated to providing a supportive environment for HIPAA compliance, healthcare managers can increase the likelihood of compliance success by improving employee SE.Originality/valueThis paper represents the first empirical study to account for environmental factors and their influence on individual intentions to comply with HIPAA.