Data Protection Problems Research Articles

Problems of protection of labor rights during hiring with the use of artificial intelligence algorithms

Abstract In recent years, artificial intelligence has found wide application in labor law, including in hiring processes. Artificial intelligence algorithms are used to automate recruiting, skills assessment and decision making. Although this can provide certain advantages and efficiency in the selection of candidates, the use of artificial intelligence algorithms in hiring also creates new legal problems and challenges, in particular in the context of the protection of labor rights in hiring: discrimination, transparency of artificial intelligence algorithms, protection of personal data. The problems caused by the use of artificial intelligence in labor law create challenges for lawyers in the context of creating ethical criteria and legal frameworks that regulate the use of artificial intelligence in the hiring process. The purpose of this article is to outline the main legal issues related to the violation and protection of labor rights in the case of the use of artificial intelligence algorithms in hiring. To achieve the goal of the research, methods of analysis, generalization, formal-logical, comparison, forecasting, dialectical and others were used. The current state of Ukrainian legislation and the experience of foreign countries are considered. The signs by which the artificial intelligence system can be classified as high-risk are highlighted. The problems of personal data protection during recruitment using artificial intelligence algorithms are analyzed. The definition of discrimination contained in international legal acts has been studied. Insufficient legal regulation of discrimination with the use of artificial intelligence algorithms has been established, which in turn creates problems in law enforcement. The criteria necessary to prevent manifestations of discrimination during recruitment with the use of artificial intelligence algorithms are highlighted. On the basis of the conducted research, a conclusion was made about the insufficient legal regulation of the use of artificial intelligence algorithms in domestic legislation, criteria that should become key for the protection of labor rights during employment with the use of artificial intelligence algorithms.

REFORMULASI PENETRATION STRESS TEST SEBAGAI PERLINDUNGAN HUKUM DATA PRIBADI KONSUMEN DI ERA BISNIS DIGITAL

This research focus on consumer personal data protection as a part of invention from privacy right in digital era. The high number of consumer personal data utilization by electronic system operator not accompanied with decent penetration stress test (PST) regulation. The purpose of this research is to give solution to clear personal data protection problem through PST testing method. The method that used by this research is normative research through statutory approach and conceptual approach. The result from this research concludes that there are still many problematic PST regulation. The problem can be seen from personal data protection that shattered in 30 statutory from different sector with no one arrange PST comprehensively. This dispute culminates to emergence dissimilarity definition, overlapping authority between receiver of System Management Security Information certification annual report, and PST operator polemic. As the result, it causes rampant of personal data breach that inflict consumer by matter, along with specific data exploitation that lead to sluggish business and economic country. Therefore, PST testing reformulation is needed as prevention step to protect consumer personal data in digital business era.

Blockchain based general data protection regulation compliant data breach detection system

Context Data breaches caused by insiders are on the rise, both in terms of frequency and financial impact on organizations. Insider threat originates from within the targeted organization and users with authorized access to an organization’s network, applications, or databases commit insider attacks. Motivation Insider attacks are difficult to detect because an attacker with administrator capabilities can change logs and login records to destroy the evidence of the attack. Moreover, when such a harmful insider attack goes undetected for months, it can do a lot of damage. Such data breaches may significantly impact the affected data owner’s life. Developing a system for rapidly detecting data breaches is still critical and challenging. General Data Protection Regulation (GDPR) has defined the procedures and policies to mitigate the problems of data protection. Therefore, under the GDPR implementation, the data controller must notify the data protection authority when a data breach has occurred. Problem Statement Existing data breach detection mechanisms rely on a reliable third party. Because of the presence of a third party, such systems are not trustworthy, transparent, secure, immutable, and GDPR-compliant. Contributions To overcome these issues, this study proposed a GDPR-compliant data breach detection system by leveraging the benefits of blockchain technology. Smart contracts are written in Solidity and deployed on a local Ethereum test network to implement the solution. The proposed system can generate alert notifications against every data breach. Results We tested and deployed our proposed system, and the findings indicate that it can accomplish the insider threat mitigation objective. Furthermore, the GDPR compliance analysis of our system was also evaluated to make sure that it complies with the GDPR principles (such as right to be forgotten, access control, conditions for consent, and breach notifications). The conducted analysis has confirmed that the proposed system offers capabilities to comply with the GDPR from an application standpoint.

ЗАХИСТ ДАНИХ В ІНФОРМАЦІЙНІЙ МОДЕЛІ МОДУЛЯ «КАФЕДРА» АВТОМАТИЗОВАНОЇ ІНФОРМАЦІЙНОЇ СИСТЕМИ УНІВЕРСИТЕТУ

This paper presents the results of a study on the creation of an information model of the "Department" module of an automated information system in a higher education institution, which makes it possible to ensure the proper quality of the educational process in a higher education institution. The revolution in personal computing and the spread of the Internet have brought the solution to the problem of automating information processes at the departmental level much closer, but it takes a long time to improve and disseminate technologies that would support the digitalisation of the entire educational process of the department, meeting the requirements and needs of all its participants. At present, due to the technological capabilities and a significant increase in the methodological level of building information systems for higher education institutions, the conditions have already been created to meet these needs within the automated information system of higher education institutions. However, there are still a number of problems to be solved, such as the development of an information model of the "Department" module. The article presents an information model of the module "Department", which reflects the information processes that support the educational process, shows the possibilities of using this model in the information environment of a higher education institution. In the presented model, special attention is paid to the problem of data protection, which has become more acute in recent years and is a general educational issue. According to Ukrainian and foreign researchers, the educational sector is one of the first in terms of information threats. It is noted that data protection should be taken into account through RBAC (Role Base Access Control) roles, whose policy is more flexible. In addition, the "Department" module can be implemented as a web application "Operational Management Unit", which will not only attract the attention of users but also help them to quickly and easily find the necessary information and perform the necessary actions. The presented example clearly demonstrates the effectiveness of the presented model for the tasks of managing the educational process at the level of a department of a higher education institution.

ЗАХИСТ ДАНИХ В ІНФОРМАЦІЙНІЙ МОДЕЛІ МОДУЛЯ «КАФЕДРА» АВТОМАТИЗОВАНОЇ ІНФОРМАЦІЙНОЇ СИСТЕМИ УНІВЕРСИТЕТУ

This paper presents the results of a study on the creation of an information model of the "Department" module of an automated information system in a higher education institution, which makes it possible to ensure the proper quality of the educational process in a higher education institution. The revolution in personal computing and the spread of the Internet have brought the solution to the problem of automating information processes at the departmental level much closer, but it takes a long time to improve and disseminate technologies that would support the digitalisation of the entire educational process of the department, meeting the requirements and needs of all its participants. At present, due to the technological capabilities and a significant increase in the methodological level of building information systems for higher education institutions, the conditions have already been created to meet these needs within the automated information system of higher education institutions. However, there are still a number of problems to be solved, such as the development of an information model of the "Department" module. The article presents an information model of the module "Department", which reflects the information processes that support the educational process, shows the possibilities of using this model in the information environment of a higher education institution. In the presented model, special attention is paid to the problem of data protection, which has become more acute in recent years and is a general educational issue. According to Ukrainian and foreign researchers, the educational sector is one of the first in terms of information threats. It is noted that data protection should be taken into account through RBAC (Role Base Access Control) roles, whose policy is more flexible. In addition, the "Department" module can be implemented as a web application "Operational Management Unit", which will not only attract the attention of users but also help them to quickly and easily find the necessary information and perform the necessary actions. The presented example clearly demonstrates the effectiveness of the presented model for the tasks of managing the educational process at the level of a department of a higher education institution.

Privacy by design. User-held data model as a basis for Privacy and Personal Data protection in social networks

The article reveals the concept and features of privacy by design approach. An analysis of the legislation of the European Union, which regulates the obligation to comply with mentioned concept, namely the provisions of the General Data Protection Regulation, was carried out. Within the framework of the concept of privacy by design, the concepts and pecularities of using user-held data model are studied, which aims to change the legal regulation and technical support of information security as well as the security of personal data in social networks.
 In order to achieve the goal of the research, the need to introduce the specified model of data protection was analyzed – namely practical problems of personal data protection within the peculiarities of the market of social network service providers. The need of the interpretation of personal data as an object of property right was outlined, as well as the interpretation of the purpose of the meta data itself as personal information about a person that can be used to recognize or track a person separately or in combination with other information, which is directly stated in the OMB Act No. A-130, however, is neither interpreted similarly in the Data Protection Regulation nor in the legislation of Ukraine. The main advantages of implementing a user-held data model are presented, namely the advantages for data owners, businesses, the state, and cloud service providers for providing and maintaining the model.
 Legislation in the field of personal data protection in the EU, in particular in the field of social networks, is more complex at the supranational and national level. It is provided with a separate regulatory and organizational mechanisms, which are different from the one that exists today in Ukraine. The mechanism for the protection of personal data in the European Union provides the creation of independent public authority that is responsible for the implementation and compliance with the requirements of the General Data Protection Regulation. The article highlights the need to create a single separate body in the field of personal data protection in Ukraine, which will be able to perform the function of monitoring and ensuring compliance with the requirements of the relevant legislation, in particular, compliance with privacy by design.

Analysis of cryptographic authentication and manipulation detection methods for big data

The emergence of Big Data has made it possible to obtain more information about the customer and competitive base, as well as about market trends. Therefore, the desire of criminals to gain unauthorized access to this data also increases in direct proportion. However, not enough attention is paid to security issues of Big Data systems and their creation does not take into account the information security component. The purpose of the article is to develop approaches to the cyber protection of Big Data, which are stored and transmitted by telecommunication communication channels when responding to a request, namely their integrity and authentication. The main problems when working with Big Data are analyzed. Based on the results of the analysis of Big Data protection problems, a cryptographic transformation of data indexes when they are stored in the database and when transmitted in the form of hash codes is proposed to increase the efficiency of search by user requests. The expediency of using crypto-code constructions on elliptic curves of various types of modifications to form a pseudo-random substrate in order to increase the crypto-resistance of transmitted messages is proven. When forming hash codes, it is advisable to use modified elliptical codes, and under stricter conditions, the level of cryptographic resistance of authentication codes can be increased due to hybrid crypto-code constructions. A pseudo-random substrate can be represented by varieties that must equally ensure the necessary transformations and preservation of universality properties by the UMAC algorithm.

Problems of personal data protection in the banking sector

The urgency of the problems of personal data protection has recently acquired particular importance due to the rapid introduction of digitalization into the global and national economies, including digital technologies are gaining increasing influence in the financial and banking sector. The article discusses the problems of personal data protection in banking relations, analyzes the closely interrelated concepts of “personal data” and “banking secrecy”. The author notes the need to improve the process of personal data protection, further development of legislation and the development of strict standards for ensuring the security of personal data of bank customers. Examples of the legislative experience of the People’s Republic of China in the field of personal data protection are given.

Problems of personal data protection in the context of digital transformation

The article presents an analysis of domestic legislation regulating the protection of personal data; the problems of personal data protection in the context of increasing the role of digital resources, the use of tracking technology and digital technologies that allow recording, collecting and processing personal data of individuals are considered; the argumentation is given to substantiate the need to develop modern effective methods, technical means of detecting and preventing unauthorized use of personal data, additional legal regulation of the institute of personal data protection, and certain provisions of the law – in discussion and subsequent correction.

Results of the round table “Current issues of personal data protection and cybersecurity in the digital era”

On April 13, 2023, the Institute of Philosophy and Law of Novosibirsk National Research State University hosted a round table “Current problems of personal data protection and cybersecurity in the digital age”. Representatives of the leading higher educational institutions of Siberia took part in its work. The round table discussed a wide range of issues related to the difficulties of interpretation and application of legislation on the protection of personal data, ensuring security in cyberspace. Special attention was paid to the influence of modern achievements of science and technology on these processes, as well as the widespread use of digital technologies.

Problems of personal data protection in Russia and China: Comparative legal Analysis

The article analyzes the legislation on personal data of Russia and China, the judicial practice of the People’s Republic of China on the protection of personal information. It is demonstrated that the legislation of Russia and the People’s Republic of China enshrines the concept of personal data, contains the principles and mechanism of protection of personal data of citizens, provides for liability measures for violation of the rights of citizens in the illegal use of their personal data. The considered examples of judicial practice of the People’s Republic of China demonstrate the application of legislation on personal data, bringing violators to civil, criminal and administrative responsibility. The conclusion is formulated that the development of Internet technologies, artificial intelligence technologies, deep synthesis generates a lot of problems related to the illegal use of personal information about citizens, which requires constant improvement of legislation on personal data protection.

Protection of personal data under martial law in Ukraine

The article is devoted to the issue of personal data protection under martial law in Ukraine. A detailed study of this issue has been carried out, aspects of the regulatory environment and levels of personal data protection in such difficult conditions have been considered.
 In the context of martial law, the violation of the personal data confidentiality may pose serious threats. It has been highlighted that the disclosure of such data can lead to a risk to the personal safety of people, including those involved in the conflict. This can become the basis for blackmail and manipulation, which negatively affects the situation of individuals and the overall situation.
 The recommendations aimed at preventing such threats and improving the level of personal data protection during martial law have been provided. Particular attention has been paid to the need to develop and implement specialised legal acts that would regulate the protection of personal data in such emergency situations. The possibilities of using modern technologies, in particular data encryption and multi-level authentication, to enhance the security and confidentiality of personal data have also been considered.
 Implementation of effective personal data protection measures during martial law is an important task to ensure the security and privacy of people. Compliance with regulatory requirements, development of data protection technologies and raising awareness of this issue among the population can help reduce risks and maintain the confidentiality of personal data even in the context of a military conflict.
 The conclusions presented in this article can be a valuable source of information for legislators and information security professionals dealing with personal data protection under martial law. The results of the study may contribute to the development and implementation of effective data protection strategies aimed at ensuring the security and privacy of participants to the conflict and citizens in general. Significant aspects of the problem of personal data protection under martial law have been considered and recommendations for improving the situation in this area have been provided.

Data economy: legal and ethical aspect

The article formulates the ethical issues of the data economy and outlines the problems of data ethics research. The concept of digital and gig economy was analyzed and the concept of data economy was formulated. The concept of “information sovereignty” was studied in the context of the problem of personal data protection. GDPR and DGA regulations were analyzed and the dynamic attribute of data was established. The legal uncertainty of the regime of personal and non-personal metadata under these acts is demonstrated on the example of specific data sets. Scientific approaches to determining the price of data have been studied From an economic perspective, the value of data collection and processing depends on the volume, quality, timeliness and completeness of the data. Unit data cannot be considered in the economic sense as a unit of value, since it is not a scarce resource and does not reflect a constant value (price) at a certain point in time. From a legal point of view, an object of law (information resource, information service, personal data, industrial sets of non-personal data, open data, metadata, big data) can have an economic value, even taking into account the immaterial and dynamic attribute of data.

JURIDICAL REVIEW LEGAL PROTECTION ON THE USE OF CUSTOMER DATA BY BRI BANK KC GORONTALO CITY

The use of customer data is crucial in the banking world, especially in the increasingly advanced digital era. The purpose of this study is to find out how the scheme of using customer data by banks and how to overcome if there is a data leak. The method used is to use sociological juridical research methods, using descriptive qualitative research approaches and interactive analysis techniques. The results of this study are: Problems arise because the issue of data protection problems and customer information in Indonesia has become a new problem in the banking world. On the other hand, adequate forms of protection for a customer's right to privacy have not been implemented into legal instruments. Similarly, the existence of various laws that have the authority to manage a person's data and information is not given a limit to avoid violations that result in unprotected data and information of a person.

Protection of Personal Data in the Digital Space

The protection of personal data is one of the most important tasks at the present stage of the development of states. This need is determined by digitalization, the transition of most human activities into the digital space, as well as an increase in the number of cyber-attacks and leaks of personal data in the digital environment. The purpose of the study was to analyze the causes and conditions of increased risks in relation to personal data, to analyze the current legislation of the Russian Federation regarding the system of personal data protection in the digital environment, to analyze the experience of foreign countries in relation to this issue. The article draws conclusions about the main problems of personal data protection in the digital space, and also identifies the main areas that require improvement to ensure the protection of personal data.

Personal Data Protection Issues in the Realm of Telemedicine. Blockchain, Civil Liability and other Methods to Overcome Them.

The subject of this article is the legal regulation of personal data protection in the field of medical care with the use of telemedicine technologies and digital healthcare. Its purpose is to identify and analyze the problems of personal data protection and to find ways to overcome them. The relevance of the work is due to the presence of a large number of leaks of personal data, gaps in regulation, and the lack of an effective system of norms aimed at preventing the compromise of patient information. The author examines the main aspects of regulating the procedure for working with the patient's consent to the processing of personal data. Much attention in the article is paid to blockchain technology, traditionally considered in the Russian legal literature only within the framework of the use of cryptocurrencies. The article also analyzes the issues of the application of civil liability measures for offenses in the field of personal data protection of recipients of telemedicine services.The author criticizes the unreasonably strict regulation of the procedure for obtaining the patient's consent to the processing of personal data by a medical organization, emphasizes the need to introduce a flexible form of consent. This will reduce the amount of information at risk of leakage. In addition, the idea of creating a mechanism for revoking the patient's consent to the processing of personal data and securing the patient's right to demand from the medical organization the termination of their processing is put forward. The paper points to the prospects for the use of blockchain in the field of telemedicine, including for the protection of personal data. A regulatory division of blockchain systems into centralized and decentralized ones is proposed, suggesting their different regulation in relation to the protection of confidential information. In addition, the article notes the lack of elaboration of the norms on civil liability for offenses in the field of working with personal data in telemedicine, it is proposed to tighten regulation in order to increase the level of protection of patients' rights.

Anatomy of web data scraping: ethics, standards, and the troubles of the law

The paper examines the ethical and legal issues raised by web scraping technology. Attention is drawn to some landmark rulings to emphasize that jurisdictions such as the US and the EU Member States tackle issues of scraping from different perspectives. Although most litigation involves IP law, in particular copyright and the rights of database producers, scraping can also raise problems of data protection, unfair competition, and public or criminal law. Besides, many of such issues may fall into the gaps of the legal system. Accordingly, the paper aims to provide an overall framework for the ethical and legal issues of scraping, to take sides between ‘good’ and ‘bad’ uses of technology and, on this basis, flesh out the legal hard cases of the field.

A Review on Cloud Data Security Challenges and existing Countermeasures in Cloud Computing

Cloud computing (CC) is among the most rapidly evolving computer technologies. That is the required accessibility of network assets, mainly information storage with processing authority without the requirement for particular and direct user administration. CC is a collection of public and private data centers that provide a single platform for clients throughout the Internet. The growing volume of personal and sensitive information acquired through supervisory authorities demands the usage of the cloud not just for information storage and for data processing at cloud assets. Nevertheless, due to safety issues raised by recent data leaks, it is recommended that unprotected sensitive data not be sent to public clouds. This document provides a detailed appraisal of the research regarding data protection and privacy problems, data encrypting, and data obfuscation, including remedies for cloud data storage. The most up-to-date technologies and approaches for cloud data security are examined. This research also examines several current strategies for addressing cloud security concerns. The performance of each approach is then compared based on its characteristics, benefits, and shortcomings. Finally, go at a few active cloud storage data security study fields.

Development of Quantum Protocol Modification CSLOE–2022, Increasing the Cryptographic Strength of Classical Quantum Protocol BB84

Quantum cryptography protocols make it possible not only to ensure the protection of data transmitted in a communication channel from unauthorized access by intruders, but also to detect the existence of any attempted interception. This scientific direction is currently relevant, since it is related to the problem of security and data protection in current information and communication networks. The article is devoted to quantum cryptography; it describes the development of quantum protocols as quantum key distribution systems. Grounded on the laws of quantum mechanics, the elaboration of modifications of secure data transfer protocols is shown. The authors considered the best-known protocol to be BB84 of quantum key distribution; a more modern modification of this protocol is BB84 Info-Z. Comparative analysis of these has also been carried out. It has been established that the BB84-Info-Z quantum protocol works more efficiently than BB84 since its lower error threshold allows the interceptor to obtain much less information about the secret key. The authors put forward a new idea to improve the BB84 protocol (which has been quite outdated for almost 40 years), due to the increase in modern requirements for quantum cryptography protocols. The modification is called CSLOE-2022. It enables significant intensification of cryptographic strength and the entanglement degree of the interceptor (cryptanalyst), which greatly complicates the very possibility of intercepting information. The ultimate goal of the CSLOE-2022 modification is to complicate the eavesdropping process so much that it can be considered completely useless for an attacker in terms of wasting time and resources. The modification allows exceeding the known speed limit of key generation without repeaters since it uses two sources, the phases of which, in addition to the hundreds of kilometers of fiber between them, are very difficult to stabilize. Comparison of the protocols by working distance showed that for BB84, this distance does not exceed 70 km; for BB84-Info-Z it is similar, at no more than 70 km, and the modification of CSLOE-2022 proposed by the authors theoretically allows increasing the working distance of the quantum protocol to 511 km (7.3 times).

Binary Symmetric Polynomial-Based Protected Fair Secret Sharing and Secure Communication over Satellite Networks

The rapid establishment of the low Earth orbit (LEO) satellite network in orbit has promoted the development of satellite communication technology. However, with the reduction of access conditions of satellite networks, the problems of data protection and secure communication have attracted extensive attention. A secret sharing scheme is a cryptographic technology that can disperse risks and tolerate intrusion by dividing and storing secrets. Using secret sharing technology in satellite communication can realize information security and data confidentiality. However, if there are cheaters among the participants, existing secret sharing schemes cannot prevent cheaters from sharing secrets exclusively, even if they can detect attacks. For this reason, this paper proposes a satellite based on binary symmetric polynomials protected fair secret sharing and secure communication scheme. In satellite secret refactoring, this scheme can produce a shared session key between two participants, no other key agreement processes, and reduce the scheme in the shared secret and the actual communication satellite application complexity. Users use the session key to encrypt communication to improve security and resist external attacks. The safety and fairness of the scheme are proved against the four attack models. Compared with the existing schemes, the scheme has a lower cost of deception identification on the premise of satisfying security and fairness. This scheme does not require any cryptographic assumptions and is unconditionally secure.