Phishing attacks continue to grow in scale and sophistication, causing substantial financial losses and privacy breaches worldwide. Recent advances in large language models (LLMs) have brought significant changes to the generation and detection of phishing content. This study systematically investigates the dual role of LLMs in facilitating phishing attacks and strengthening countermeasures. Using the PRISMA methodology, authors screened 142 records published between January 2023 and April 2025 and identified 36 eligible studies from major academic databases, including IEEE Xplore, ScienceDirect, ACM Digital Library, Web of Science, and Scopus. A comprehensive and rigorous analysis was conducted of research trends/themes over time, dataset characteristics, and the LLM architectures/models employed. The findings reveal that most studies relied on manually generated datasets rather than publicly available benchmark datasets, and that GPT-based models received considerably more attention than other LLM architectures. The review demonstrates that LLMs substantially enhance the generation of phishing content by producing coherent, contextually relevant, and persuasive email and website content. This capability lowers the technical barrier for attackers and potentially increases attack effectiveness. Conversely, LLMs also strengthen defensive strategies by enabling more effective analysis of textual and visual content for phishing detection. In many cases, LLM-based approaches outperform traditional machine learning and deep learning methods and, in certain contexts, approach or match human-level performance. Overall, the findings suggest that LLMs have accelerated and automated phishing-related processes, simultaneously intensifying the threat landscape and advancing defensive capabilities. • The first in-depth study to review LLMs usage in Phishing attack generation and detection. • The study reveals LLMs have accelerated and automated phishing-related processes, elevating both threats and defence mechanisms. • GenAI-based multimodal phishing attacks are on the rise due to the wider adoption of GenAI tools in general.

ABSTRACT No existing studies have empirically investigated how knowledge of AI use, together with appropriate regulations, influences fear and negative attitudes toward AI. This study examines how AI regulation influences AI’s individual factors (perceived AI trust, privacy, risk, and security) and how AI usage knowledge moderates these effects. The results indicate that perceived AI regulation increases perceived AI trust, privacy, and security, and reduces perceived AI risk. Additionally, the results show that AI usage knowledge moderates the relationships among perceived AI regulation, perceived AI trust, risk, and security. However, AI usage knowledge does not moderate the relationship between perceived AI regulation and perceived AI privacy. Users with knowledge of AI usage seek constant regulations to mitigate risks, enhance trust, and ensure security. Users with knowledge of AI usage do not need AI regulation to protect them from AI privacy issues. Users perceived that knowing how to use AI prevents them from AI-related privacy breaches.

Adolescents face significant barriers in accessing reproductive health services due to fears of privacy breaches and social stigma. In primary healthcare facilities, healthcare professionals are often trapped in a dilemma between the obligation to maintain medical confidentiality based on professional ethics and national regulatory demands requiring parental involvement for underage patients. This study aims to analyze the practice of protecting adolescent patient data privacy at Mardi Saras Primary Clinic and identify the gap between practical implementation and the norms of medical ethics and applicable legal regulations. This study employs a socio-legal research method with a qualitative approach. Data were collected through in-depth interviews with doctors and nurses, observation of service procedures, and study of the clinic's Standard Operating Procedures. The results indicate that although Mardi Saras Primary Clinic has implemented basic confidentiality protocols such as closed consultation rooms, there are substantial weaknesses in informed consent management, which still heavily relies on parental presence for all adolescent cases. This practice is driven by healthcare professionals' fear of legal risks, thereby ignoring the principle of developing autonomy in adolescents. These findings indicate a disparity between rigid administrative compliance and the spirit of protecting adolescent health rights within national regulations. The implication of this study underscores the urgency of developing specific SOPs that are sensitive to adolescent rights, as well as the need for continuous training for healthcare professionals regarding the legal and ethical boundaries of maintaining confidentiality for underage patients without compromising legal safety aspects.

ABSTRACT With increasing sophistication of Artificial Intelligence (AI) technology, they have evolved from simple task-facilitating tools to social actors within the workplace. In this article, we investigate the psychological contract – perceived mutual obligations and expectations in a social exchange relationship, that employees form with Generative-AI (G-AI) and the influence of breach or fulfilment of such contracts on the job outcomes, particularly innovative work behaviour and wellbeing. We focus on digital natives – younger employees who grew up in a technology-rich environment and are highly comfortable in using digital technology for work. We conducted our study using survey data from 415 digital natives from the high-tech industries in India. Our findings suggest that psychological breach, reflected through experiences of biasness, privacy breach, and opacity, has a negative influence on the job outcome. Psychological contract fulfilment buffers this negative influence, albeit, only for a lower level of breach. By exploring these dynamics, this study connects the broader ethical tensions in the implementation of G-AI to the individual employees’ experiences and perceptions. The findings have practical implications for designing AI systems for the workplace.

ABSTRACT As artificial intelligence (AI) and smart technologies are being increasingly implemented in cities around the world, examining the issue of privacy has become even more important – especially for the homeless. The homeless may be especially vulnerable to changes created by such technologies because of their inability to escape public and collective spaces. This article draws on Helen Nissenbaum’s theory of privacy as “contextual integrity” to detect privacy breaches and to explore the changes that AI and smart technologies are creating in three different contexts for the homeless. These contexts are: in public and collective spaces, when using personal technologies, and in spaces of aid. In all three contexts, AI and smart technologies are found to change key aspects of previous information-sharing norms by increasing the ease of information transfers, especially for more intimate information, and altering interpretative and decision-making processes. These changes may create new dangers for the homeless, by producing new risks of punishment and decreasing their agency, as well as new opportunities, by increasing their protection and agency in other ways. Such findings suggest a need for further investigation into the ethics of such changes to privacy and into methods for the homeless to exert more agency.

With the rapid growth of mobile application usage on smartphones, personal information is being increasingly collected and processed, often without sufficient user consent or awareness. The vast amounts of personal data – ranging from location information to contacts and messages – are vulnerable to unauthorized access, creating significant privacy concerns. As a result, detecting privacy breaches in mobile traffic is essential for protecting user data and ensuring that applications adhere to privacy standards. While existing machine learning techniques for traffic monitoring have made strides in identifying privacy leaks, many still struggle with detecting obfuscated or undefined data types, which are often used to bypass traditional detection methods. This paper proposes a novel approach to detecting privacy leaks in mobile network traffic by leveraging statistical features such as flow patterns, packet sizes, and transmission frequencies. The model employs Extreme Gradient Boosting (EGB) to classify traffic patterns and identify instances of privacy violations. EGB, known for its high accuracy and scalability, is trained to detect various traffic patterns, including those associated with obfuscated or encrypted data. Despite the inherent variability in statistical features due to individual user behaviors, the proposed method proves highly effective in identifying privacy leaks. Extensive simulation results validate the performance of the approach, demonstrating its ability to scale across different datasets while maintaining high accuracy. This method provides a robust and scalable solution for detecting privacy breaches, ensuring the protection of personal data and enhancing user privacy on mobile platforms. HIGHLIGHTS This work focuses on detecting privacy breaches with the utilization of statistical features such as transmission frequency, flow patterns including global and local patterns, and packet size. Extreme Gradient Boosting (EGB)-based traffic monitoring method is used. The detector used for detection is trained using EGB to detect different traffic patterns. The proposed work detects obfuscated and undefined privacy leakages. Simulation is effectuated to analyze various performances of the proposed work.

The documentary credit has long been regarded as the lifeblood of international commerce, but it is now facing two distinct and growing structural pressures. Within private law, there are institutional blind spots in the provisions on payment exceptions in the framework of English private law. The fraud exception, as construed in United City Merchants, leaves banks institutionally exposed to third-party fraud by requiring beneficiary complicity, while the judicial refusal to recognise a nullity exception in Montrod compels banks to honour instruments devoid of legal existence. On the financial regulatory front, the rapid expansion of financial crime regulation, represented by economic sanctions and anti-money laundering, requires banks to undertake the obligation to investigate underlying transactions at the precise point when the principle of autonomy strictly limits the obligations of banks to the facial examination of documents. In view of the fragmented and unprincipled manner in which the English judicial practice has responded to this double pressure, this article proposes a two-way reform path. First, regard legal nullities as the front threshold for compliance review, and establish more objective fraud identification standards; secondly, build a structured regulatory intervention framework to ensure that banks cannot abuse sanctions or anti-money laundering reasons, and their refusal decisions must be based on objective evidence and subject to judicial review. This structured approach seeks to restore commercial certainty to cross-border trade finance by reconciling the mandatory obligations of public regulatory compliance with the foundational trust of private commercial instruments.

Abstract Türkiye enacted a major transformation in its legal framework on crypto-assets through the enactment of Law No. 7518 amending the Capital Markets Law in 2024. While this reform introduced the first comprehensive regulatory structure governing crypto-asset service providers and trading platforms, fundamental questions concerning the legal nature of crypto-assets remain unresolved within Turkish private law. This article examines the evolving legal landscape governing crypto-assets in Türkiye by analysing regulatory developments, scholarly debates and comparative perspectives. It argues that Türkiye has adopted a regulatory model that combines strong financial market supervision with reliance on traditional private-law doctrines to address unresolved issues. While this approach provides regulatory stability in the short run, it also produces structural inconsistencies and uncertainties, particularly in relation to property law, payment systems and taxation. The article concludes by assessing future projections for the regulation of crypto-assets in Türkiye.

Abstract Healthcare institutions face a growing demand to use machine learning to improve patient outcomes while adhering to strict privacy laws and data security measures. Although data heterogeneity, institutional privacy restrictions, and different contribution values across participating institutions pose challenges for current methodologies, cross-silo federated learning offers a viable alternative for collaborative healthcare analytics. In this paper, a novel paradigm for privacy-preserving healthcare collaboration in crosssilo environments is presented: adaptive contribution-based federated learning (ACFL). By modifying both compression rates and differential privacy measures according to each participant's contribution to the global model, resource availability, and data characteristics, ACFL overcomes the drawbacks of conventional federated learning. The framework introduces several important innovations: A feature importance-based differential privacy approach that applies different noise levels to model parameters based on their clinical significance, a comprehensive contribution tracking mechanism that uses exponential moving average smoothing to evaluate both parameter update magnitude and performance impact, and adaptive sparsification that maximizes communication efficiency while maintaining valuable updates. Through an experimental evaluation on the MIMIC-IV prescription dataset, adaptive compression and privacy methods of ACFL maintain to treat important characteristics while lowering communication overhead.

The digital technology landscape together with online platforms and data-driven business models has reached an advanced state of development which creates serious privacy and cybersecurity problems for personal data protection in India. The Government of India established the Digital Personal Data Protection Act DPDP Act 2023 to control personal data handling practices because of the increasing volume of digital transactions and incidents of data abuse. The legislation establishes new digital governance frameworks which protect user privacy rights while creating systems that hold organizations accountable for their personal data handling practices. The present study examines the impact of India’s Digital Personal Data Protection Act on corporate compliance requirements and business operations. The research focuses on analyzing how organizations are adapting to new legal obligations related to consent management, data processing, cybersecurity measures, grievance redressal systems, and data protection responsibilities. The study also evaluates the operational and financial challenges faced by companies in implementing compliance frameworks. The research team used a descriptive research design to collect data which they obtained from secondary sources that included government reports and legal documents and industry publications and research studies. The research findings demonstrate that the DPDP Act requires businesses to take greater responsibility for managing data and protecting consumer privacy rights. Organizations need to develop more effective security systems and create clear consent processes and establish methods for monitoring their adherence to laws. The research results show that large companies with sophisticated technology systems can meet regulatory requirements more easily than small and medium-sized businesses which struggle with their operational and financial operations. The study reveals that businesses face significant difficulties due to their need to spend money on compliance requirements and employee training and technology updates. The Act will achieve its goal of increasing consumer trust while establishing digital business credibility and promoting responsible data management practices. The study shows that organizations need to develop awareness about the DPDP Act and prepare their legal systems and invest in technology and control their regulatory activities for effective implementation. The research helps explain how digital privacy laws interact with corporate governance practices and business sustainability in India's digital economy.

ABSTRACT This article analyses the political economy of state ownership and privatisation in Spain through the lens of strategic selectivity [Jessop, B. (2002). The future of the capitalist state. Polity Press] and recent theories of hybrid state capitalism. It argues that the creation and endurance of the Sociedad Estatal de Participaciones Industriales (SEPI) reflect not a withdrawal of the state from the economy but its strategic adaptation. By adopting a hybrid holding structure, the Spanish state developed a mechanism that provided managerial autonomy and economic flexibility while maintaining long-term strategic influence. SEPI can be understood as a state holding company responsible for managing the Spanish state's portfolio of corporate shareholdings, although legally it is constituted as a public law entity operating largely under private law. This selective institutional design allowed the state to navigate the constraints of European integration and fiscal discipline, transforming its role from a direct producer to a sophisticated strategic shareholder.

A growing suite of neurotechnologies that capture brain activity, ranging from wearables to implanted devices, is rapidly transforming practice and research in the clinical neurosciences. States such as Colorado and California have incorporated "neural data" into their privacy laws. In addition, in September 2025, two senators introduced federal legislation, the Management of Individuals' Neural Data (MIND) Act of 2025, which defined "neural data," addressed ethical concerns about its collection and use, and directed the Federal Trade Commission to study how to regulate it. Legislative actions such as these recognize that neural data can potentially reveal unusually sensitive details about identity, cognition, and capacities that ordinary health information does not. In practice, however, neural data are heterogeneous, requiring careful consideration of their varying forms, degrees of sensitivity, and the clinical or nonclinical contexts in which they are generated. We describe the difficulties of using common tools, including data privacy and intellectual property, to regulate neural data and examine how clinicians can complement these efforts through deliberate, ethically informed safeguards in clinical practice even before regulatory frameworks are finalized.

ABSTRACT This article explores the influence of Campbell v Mirror Group Newspapers Ltd (2004) on Australian protections of privacy. A central legacy of Campbell is its recognition that privacy and confidentiality, while related and overlapping, should be protected through distinct causes of action. The tort of misuse of private information, first proposed by Lord Nicholls in Campbell, is now firmly established in the United Kingdom but has not been recognised in Australia. Instead, Australia recently enacted a statutory privacy tort that takes some cues from the UK jurisprudence, yet specifically exempts privacy invasions in the course of journalism. This effectively subverts Campbell’s influence as a case about balancing privacy and media free speech. This article also considers another legacy of Campbell: namely the support it provided for Australian courts to rely on breach of confidence when addressing misuses of information that is both private and confidential, especially where the wrong involvesa breach of trust. Although this creative judicial approach has stalled in Australia in recent years, we argue that it remains useful in today’s media environment, in keeping with Campbell’s reformist spirit.

Membership Inference Attacks (MIAs) are the current standard for auditing the privacy of synthetic medical data. A high attack score is widely interpreted as a significant privacy leak, but this interpretation assumes the MIA is learning a true membership signal. We argue that these attacks may instead be learning experimental artefacts, specifically data split bias. To test this, we conduct experiments on synthetic brain MRI images from a StyleGAN3 model. We design a Primary MIA (member vs. non-member data) and a critical Control Experiment (disjoint subsets of member data alone). This member-only setup lacks any genuine membership distinction between classes, leaving only data split bias. Our results show the Control Experiment's AUCs match or exceed the Primary MIA's (+0.0205 on the 5k-pool Small corpus and +0.0113 on the 30k-pool Big corpus). This compelling evidence demonstrates that a high MIA score can be a false positive for a privacy breach, as the classifier is simply learning statistical artefacts. We conclude that MIA results are unreliable without rigorous control experiments to validate that they are detecting genuine privacy risks, not experimental bias.

BackgroundDespite the notable proliferation of smoking cessation mobile apps, to date, no validated, Spanish-language, culturally tailored mobile intervention exists for Spanish speakers in the United States.ObjectiveThe aim of this study was to conduct formative research to inform the adaptation of an evidence-based smoking cessation intervention developed for Spanish-speaking Hispanic and Latino individuals from a printed format into a mobile app.MethodsGuided by a user-centered approach and in collaboration with product design industry experts, wireframes were developed to present the app’s layout and functionality. Focus groups were conducted over Zoom (Zoom Communications) with Spanish-speaking individuals who currently smoke to assess their previous mobile app experience, attitudes toward mobile apps, and feedback on app architecture and design. Two independent reviewers (RB in collaboration with another member from the qualitative core) trained in qualitative methods coded the focus group data using a thematic analysis approach and identified emerging themes.ResultsThe app wireframes included 4 navigation buttons on the home screen to organize and deliver evidence-based intervention content—Home (Inicio), Learn (Aprende), My Coach (Mi Couch), and Profile (Perfil). Different wireframe designs were generated in distinct color palettes. Data saturation was reached after three focus groups. Participants were 54% (7/13) women, had a mean age of 56 (SD 14.9) years, 39% (5/13) had an education ≤high school, and 31% (4/13) were married or cohabitating. All participants smoked daily, a mean of 14 (SD 7.8) cigarettes per day, for 32 (SD 16.9) years, and 54% (7/13) smoked ≤30 minutes of waking. Participants reported using social media, news, shopping, and gaming apps, but few used mobile health apps. Salient barriers for app use included worries regarding privacy breaches and fears about misinformation. Desired features included community-building elements, personalization, reward badges, knowledge checks, and audiovisual presentation of content within the app. Participants disliked having a countdown to quit date, preferring an “I quit” button to initiate monitoring progress. They also viewed sharing progress with support networks as a source of unwanted pressure, although a few saw it as motivational. Overall, participants liked the app design and indicated willingness to use it.ConclusionsThis formative research provides critical insights into preferences related to the development of culturally tailored mobile smoking cessation interventions for Spanish-speaking individuals. Key findings highlighted enthusiasm for a smoking cessation app and the importance of including features that foster social connection and allow for personalization.

This paper presents results from a key informant survey exploring ethical, legal, and social issues (ELSI) as perceived by professionals working in the U.S.-based private sector human genomics industry. Drawing on a structured survey of 111 participants-including researchers, executives, policy leads, and communications specialists-this study examines how industry insiders assess emerging ethical concerns across domains such as data privacy, race and ancestry, sociogenomics, commercialization, and government partnerships. The survey instrument was developed based on a prior interview phase and reflects concerns raised directly by professionals in the field. Quantitative responses were analysed for levels of concern and consensus, while open-text responses provided further insight into areas of divergence and organizational context. Respondents expressed high concern and consensus about lack of diversity in datasets, fragmented privacy regulation, and potential genomics collaborations with governments implicated in human rights abuses, though significant disagreement emerged around the appropriate use of race categories and socio-genomic applications. This preliminary exploration offers a glimpse into perspectives from a difficult sample population, and suggests entry points for future collaboration, policy, and critical scholarship.

ABSTRACT This article considers three questions: What was it like to practice in the law of privacy before Campbell v MGN Ltd? What made both necessary and possible the development of the common law that occurred in Campbell? What does Campbell now stand for? It demonstrates that there were many legal means for prohibiting the misuse of private information before 2004 under the common law and statute law. It shows that Campbell was a development of the common law that judges made to address technical and societal changes in modern life, and that it was the common law itself, not the Human Rights Act 1998, that required judges to develop the common law in this way.

ABSTRACT The open justice principle continues to interrelate with and affect the development of privacy torts. Against this backdrop this article considers the privacy/open justice dynamic in decisions on access to court documents – focusing on those which have featured in open court. In this context privacy can and has been broadly construed to outweigh open justice reasons favouring disclosure, with the relevant principles developed pre-Campbell v MGN Ltd, when fewer privacy protections existed. Now, Campbell-type methodology offers a more structured way to assess privacy considerations when considering access. It might also provide greater backstop privacy protection, justifying less intensive scrutiny at the earlier access stage, or even proactive publication. If so, it would become important to consider the extent of reasonable expectations of privacy in material made accessible by courts. This might usefully draw on freedom of information principles, and defences applicable to court reporting.

ABSTRACT Can surveillance of protest ever amount to an interference with individual privacy? This paper argues that a right to privacy can, in principle, arise in protest, based upon a refined normative understanding of privacy as important to individuals’ preparedness to protest, and a conception of protest as a manifestation of freedom of conscience, rather than merely public action. By interrogating the normative relationship between privacy and protest, and examining whether the normative underpinnings of privacy are compatible with so public an activity as protest, this paper disambiguates the normative relationship between privacy and protest, to suggest that privacy protection is not necessarily always in contradiction with protest activities. Analysing Anglo-European privacy jurisprudence, we see that this normative position can be accommodated doctrinally, as the courts have articulated privacy law principles that mean a reasonable expectation of privacy could, as a legitimate starting point, be recognised in the context of protest.

Deep learning on medical images classification intervention needs to use large data on multi-institutional datasets but privacy laws inhibit sharing of data (GDPR, HIPAA). Federated Learning (FL) facilitates collaborative training without data transfer; until now, the known methods can only address privacy, personalisation, and accuracy not at the same time in a multi-modal environment. We present MM-PFL-ADP, a framework that combines Vision Transformer (ViT) based multi-modal feature extraction in four new elements: (i) privacy budget allocation (independent of number of samples): Fisher information-based adaptive per-parameter privacy budget allocation ([Formula: see text]); (ii) personalisation masks: dynamic KL divergence based personalisation masks; (iii) respect The framework gives formal client-level [Formula: see text]-DP guarantees on transmitted gradient updates, in [Formula: see text] simulated medical institutions. On the MRI-MS dataset, MM-PFL-ADP achieves [Formula: see text] accuracy (95% CI: 96.9-[Formula: see text]) at [Formula: see text], outperforming FedAvg ([Formula: see text]) and DP-FedAvg ([Formula: see text]) by large margins ([Formula: see text]). The framework is [Formula: see text] faster than FedAvg (47 vs. 85 rounds), has [Formula: see text] less total communication and keeps [Formula: see text] accuracy in case of extreme heterogeneity in data ([Formula: see text]). The probability of membership inference attack has decreased to 52.1 which was close to the random baseline ([Formula: see text]). MM-PFL-ADP shows that the concepts of privacy, personalisation, and accuracy are synergistic, but not oppositional to federated medical AI. The single-system Fisher information framework greatly simplifies the hyperparameter tuning problem and can meet formal privacy criteria. Before being deployed, prospective validation against the performance of expert radiologists is desired.