Processing Of Personal Information Research Articles

Research on the legal framework of personal information privacy protection in automated administrative environment: centered on data security and rights balance

In the digital age, with the increasing importance of personal information, especially in the field of automated administration, the protection of personal information is particularly urgent. Ensuring the security of personal information in automated administration not only helps to safeguard the realization of individual dignity rights and meet the inherent requirements of the principle of proportionality, but also regulates the use of algorithms to avoid discrimination. However, although the legislation on the protection of personal information in automated administration has made some progress, there are still some shortcomings: the legislation is not directly specified, the law is not operable, the supervision and management mechanism is not perfect; There are also problems at the law enforcement level: improper use of immunity in administrative procedures, excessive expansion of the scope of personal information processing; In the relief aspect, there are also challenges: the provisions of administrative public interest litigation are vague, and there are loopholes in the way of liability. In order to improve the protection mechanism of personal information in automated administration, it is necessary to expand the direct regulation of automated administration in legislation, enhance the operability of laws, and improve the supervision and management mechanism of personal information. At the same time, it is also necessary to amend the administrative due process and strictly implement the principle of least necessity at the level of law enforcement. In terms of relief, the applicable rules of administrative public interest litigation should be clarified, and more targeted ways of assigning blame should be established.

Plugins and POPI: A Critical Discussion into the Legal Implications of Social Plugins and the Protection of Personal Information

Social plugins are one of the many trackers used by companies with an online presence. However, under the Protection of Personal Information Act 4 of 2013 (POPI), these trackers have certain legal consequences for internet users. The main reason for this is that trackers tend to process personal information without informing internet users that their data are being collected, the reason for the collection or processing thereof, or who the responsible parties are that are collecting and processing the personal information. The article looks at these issues, amongst others, in the light of a 2019 judgment from the Court of Justice of the European Union or CJEU, namely, Case C-40/17 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW e.V. EU:C:2019:629. Due to the fact that it has had data protection legislation for much longer than other countries or legal jurisdictions, including South Africa, the European Union (the EU) has a substantial body of case law interpreting the data protection legislation of the EU itself as well as that of the individual member states. One of the main instruments used as guidance by the drafters of POPI was Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (hereafter Directive 95/46). Directive 95/46 was previously considered the gold standard, before Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation) (hereafter the GDPR) was enacted and Directive 95/46/EC was finally repealed. Since Directive 95/46 was one of the main guiding documents used in drafting POPI, one may expect that the South African courts may turn to the EU and consider how the CJEU has interpreted the similar provisions contained in Directive 95/46, especially since there is very little South African jurisprudence available on POPI. The four main issues under discussion are: who, other than the internet users, has the locus standi to bring an application in terms of POPI? Second, what are the responsibilities of joint responsible parties towards internet users? Third, where there are joint responsible parties, do both need a legitimate interest to process personal information? Lastly, who will be responsible for obtaining the necessary consent to process the personal data?

Safeguarding Minors' Personal Data: Legal Principles in Information Security in Ukraine and Eurupean

The research aims to uncover the legal regulations pertaining to the protection of minors' personal data, considered a crucial component of informational security. Through an analysis of Ukrainian and European legislation, in conjunction with the General Data Protection Regulation and the California Consumer Privacy Act, this study seeks to explore preventive measures against third-party abuse of children's information. The research highlights the responsibilities imposed on state authorities and legal entities, based on Ukrainian and European legislation, to safeguard personal data. The methodology employed in this article involves the utilization of both general scientific and specialized methods of scientific cognition. The specificity of the research subject, along with its purpose and tasks, guided the selection of these methods. The research results reveal various problematic issues related to the collection, storage, use, and distribution of personal data of minors. The obligation to protect an individual's rights to the processing and preservation of personal data or private information is a responsibility placed on state authorities in accordance with the legislation of Ukraine and European countries (Germany, Switzerland, France, Italy, Norway, Great Britain), as well as on legal entities that own or store the specified personal data. In conclusion, the protection of personal data emerges as a fundamental right, integral to the broader rights of family and private life. The study also underscores the importance of international cooperation mechanisms in addressing this multifaceted issue.

A comparative study between zero-knowledge proof (ZKP) and ring signatures targeting the legal and regulatory implications with the general data protection law (GDPL) and general data protection regulation (GDPR)

Privacy protection ensures that individuals have control over personal data, preventing abuse and preserving trust in the use of online services. In the “Digital Era”, where the collection, storage and processing of personal information have become ubiquitous, data privacy emerges as a relevant topic. In this sense, laws were created, such as the General Data Protection Law (LGPD) in Brazil and the General Data Protection Regulation (GDPR) in Europe, to control privacy and the processing of personal data. The article presents a comparative analysis of 2 (two) data privacy mechanisms, the Zero-Knowledge Proof (ZKP) and Ring Signatures, used in Blockchain, aiming at the legal and regulatory implications with the LGPD and GDPR. The comparative study between ZKP and Ring Signatures highlights the flexibility of ZKP in various contexts, including voting and secure authentication systems, while Ring Signatures offer significant advantages in terms of scalability and efficiency in systems where subscriber anonymity is considered fundamental. Furthermore, the legal and regulatory implications of the ZKP are discussed, mainly in relation to LGPD and GDPR. Finally, the article concludes that the comparative analysis offers insights into applications, challenges and legal and regulatory implications, particularly in relation to data privacy and compliance with regulations such as LGPD and GDPR.

Simulation of cross‐pedestrian flow in intersection based on direction fuzzy visual field

AbstractPedestrian flow refers to the spatiotemporal distribution of people moving in a defined area. At crosswalks, pedestrian dynamics exhibit complex self‐organization patterns resulting from interactions between individuals. This paper proposes a novel crosswalk pedestrian flow model based on the concept of directional fuzzy visual field (DFVF) to capture pedestrian heterogeneity. The DFVF defines fuzzy distributions of personal space and information processing capabilities, enabling improved representation of diversity compared to previous models. Incorporating k‐nearest neighbour rules in the DFVF pedestrian network topology also better mimics real‐world interactions. Using a cellular automata framework, pedestrian self‐organization effects like stratification and bottleneck oscillation are simulated at intersections. The model replicates empirically observed dynamics of density, velocity, and evacuation time. Results demonstrate that controlling pedestrian conflicts can effectively enhance crosswalk flow efficiency. This research introduces new techniques for simulating pedestrian psychology and behaviour, providing a valuable contribution to pedestrian flow theory and supporting crosswalk design optimization.

Ensuring information security of Ukraine in the conditions of modern challenges and threats from the Russian Federation

The article examines the issue of ensuring information security of Ukraine in the conditions of modern challenges and threats from the Russian Federation. It is noted that the stability of the functioning of institutions of public authority, the preservation of law and order is a necessary prerequisite for the observance of human rights. In the conditions of technological development, ensuring information security is one of the most important guarantees of human rights. The basis of such guarantees is the observance of the principles of confidentiality, integrity and availability of information and information systems. In order to ensure the information security of the individual, special legal frameworks for the protection of the right to the inviolability of private life are being developed, as well as additional mechanisms for its protection related to the establishment of specific requirements in the field of collection and processing of personal information. In order to ensure national security and information security of the state as one of its components, the most important guarantee of human rights is the observance of the principle of proportionality when restricting them. Most states have responded to the threats to national security that have grown recently by expanding the authorities' powers to access, collect and process personal information, which are now not limited to any particular categories of information. At the same time, approaches to ensuring the proportionality of measures taken to ensure national security may also differ in different states. It is emphasized that the actions of modern terrorists go beyond elementary humanitarian principles (in this context, we can talk about the Russian Federation as the most dangerous terrorist of the modern period of human development). There is contempt for the basics of humanity. In the conditions of such a struggle, it is difficult to call for respect for human rights, to apply this message to those who completely ignore it. Almost every day, state institutions, mass media, critical infrastructure objects, and the life support system are exposed to powerful cyber attacks using advanced information technologies. All this is part of a coordinated informational aggression against Ukraine. It was concluded that special attention should be paid to the tasks of protecting the relevant resources of the executive authorities, including the Ministry of Foreign Affairs of Ukraine. It is necessary to constantly improve the measures taken for this purpose, to establish day-to-day control of the execution of relevant assignments of the Cabinet of Ministers of Ukraine. It is emphasized that in the conditions of geopolitical instability and transformation of the world order, modern cyber­attacks, which are characterized by non-standard methods, methods and means of their perpetration, require, at the legislative level, prompt work to prevent and prevent a destructive impact on domestic information resources and the information infrastructure of the public and private sector.

Broad consent for biobank research in South Africa - Towards an enabling ethico-legal framework

ABSTRACT Broad consent is permitted by the South African National Department of Health Ethics Guidelines but appears to be prohibited by section 13(1) of the Protection of Personal Information Act 4 of 2013. Additionally, the Act mandates that all personal data (including biobank sample data) be collected for lawful, explicit, and clearly defined purposes. There is possibility for ambiguity in interpretation because of this discrepancy between the two instruments. Given the association between the transfer of samples and data, the long-term nature of biobanking, which makes it impractical to provide too much or enough information because it is simply not available at the time of sample collection, and the various ways that the Protection of Personal Information Act 4 of 2013 have been interpreted, we aim to demonstrate that South Africa’s current regulatory framework should appropriately permit broad consent use for biobank research where the transfer of samples and their associated data are contemplated. In summary, the proposed amendments include removing regulatory ambiguity regarding broad consent use, ensuring adequate safeguards for research participants by specifying rules for data access and personal information processing, and incorporating consent form information requirements into the national Consent Template.

POPIA does indeed apply to health research: A response to Bronstein and Nyachowe

Bronstein and Nyachowe recently argued that the conditions for the lawful processing of personal information, as provided in the Protection of Personal Information Act 4 of 2013 (POPIA), do not apply to health research in South Africa. This article critically analyses the authors’ interpretation of section 3(2)(b) of POPIA and challenges two of its aspects.

Cooperative governance mechanisms for personal information security: an evolutionary game approach

PurposeThis paper aims to investigate the cooperative governance mechanisms for personal information security, which can help enrich digital governance research and provide a reference for the formulation of protection policies for personal information security.Design/methodology/approachThis paper constructs an evolutionary game model consisting of regulators, digital enterprises and consumers, which is combined with the simulation method to examine the influence of different factors on personal information protection and governance.FindingsThe results reveal seven stable equilibrium strategies for personal information security within the cooperative governance game system. The non-compliant processing of personal information by digital enterprises can damage the rights and interests of consumers. However, the combination of regulatory measures implemented by supervisory authorities and the rights protection measures enacted by consumers can effectively promote the self-regulation of digital enterprises. The reputation mechanism exerts a restricting effect on the opportunistic behaviour of the participants.Research limitations/implicationsThe authors focus on the regulation of digital enterprises and do not consider the involvement of malicious actors such as hackers, and the authors will continue to focus on the game when assessing the governance of malicious actors in subsequent research.Practical implicationsThis study's results enhance digital governance research and offer a reference for developing policies that protect personal information security.Originality/valueThis paper builds an analytical framework for cooperative governance for personal information security, which helps to understand the decision-making behaviour and motivation of different subjects and to better address issues in the governance for personal information security.

Rights of data subjects in the processing and use of personal information by automated decision-making systems

Rights of data subjects in the processing and use of personal information by automated decision-making systems

Unraveling the behavioral influence of social media on phishing susceptibility: A Personality-Habit-Information Processing model

Frequent and habitual engagement with social media can reinforce certain activities such as sharing, clicking hyperlinks, and liking, which may be performed with insufficient cognition. In this study, we aimed to examine the associations between personality traits, habits, and information processing to identify social media users who are susceptible to phishing attacks. Our experimental data consisted of 215 social media users. The results revealed two important findings. First, users who scored high on the personality traits of extraversion, agreeableness, and neuroticism were more likely to engage in habitual behaviors that increase their susceptibility to phishing attacks, whereas those who scored high on conscientiousness were less likely. Second, users who habitually react to social media posts were more likely to apply heuristic processing, making them more susceptible to phishing attacks than those who applied systematic processing.

Streamlining regulatory processes for health researchers: To what extent does POPIA apply?

Personal information in health research commands utmost protection while also preserving the growth of health research.This paper aims to establish which legislation applies when processing personal information for health research. South Africa regulates health research on human subjects through a network of Human Research Ethics Committees. The Protection of Personal Information Act No. 4 of 2013 (POPIA) has recently come into force. Section 2(3)(b) of POPIA provides that POPIA does not apply where other legislation creates 'more extensive'conditions for the lawful processing of personal information than Chapter 3 of POPIA does. We show that the provisions of the sectoral legislation on health aremore extensivethanthe conditions in Chapter 3 of POPIA and hence the sectoral legislation prevails.Thissimplifies the regulation of health research.One of theimplications of this finding is that the definition of broad consent in the sectoral legislation for health research should be applied to the exclusion of the consent provisions in POPIA.

Systematic construction of lawfulness of processing employees’ personal information under China's personal information protection law

With the rapid development and widespread use of digital technologies in the workplace in China, employers’ right to monitor and direct employees has often been abused, raising a number of disputes over the infringement of employees’ right to privacy in terms of their personal information. China must urgently develop an appropriate approach to balancing these two conflicting interests. However, there is currently no coherent and uniform regime governing the protection of employees’ personal information in China. The primary legal source on which employers can rely is the latest version of the Chinese Personal Information Protection Law (PIPL), which offers three lawful bases for employers’ processing of their employees’ personal information. These bases are employee consent; “necessity for the conclusion or performance of an employment contract”; and “necessity for conducting human resource management.” Concerns have been expressed regarding the reasonableness and effectiveness of the three lawful bases under the PIPL. First, it is both legally and practically problematic for the PIPL to rely so heavily on employee consent. Second, it is unclear whether the other two lawful bases relieve employers of the duty of notification and, if so, how to safeguard employees’ right to know. Third, the ambiguous standard of “necessity” requires clarification.This article argues that China should adopt many elements from EU law, while US law should be only followed in relation to the standard of “necessity”. In relation to employee consent, the EU approach is preferable to the US approach. As the EU approach does not generally regard employees’ consent as a lawful basis for the processing of their information and uses the other two lawful bases as alternatives to employee consent, this approach better reflects the customary practices of employee subordination and employer control in China. In contrast, US law deems employee consent to be an absolute general defense to the tort of privacy violation and adopts an employer favoritism approach to balancing these two conflicting interests, which is not appropriate in the Chinese context. In relation to the scope of necessity, three tests taken from the EU and US approaches should be considered by the Chinese courts. In addition, when processing personal information based on the other two lawful bases, employers should safeguard employees’ right to know through collective contracts concluded with labor unions or employee representatives under the Chinese Labor Contract Law, which would effectively address employers’ arbitrariness. Ultimately, these changes would produce a better balance between employees’ right to privacy in terms of their personal information and employers’ need to subordinate and control employees.

A novel privacy protection method of residents' travel trajectories based on federated blockchain and InterPlanetary file systems in smart cities.

The government does have to record and analyze the travel trajectories of urban residents aiming to effectively control the epidemic during COVID-19. However, these privacy-related data are usually stored in centralized cloud databases, which are prone to be vulnerable to cyber attacks leading to personal trajectory information leakage. In this article, we proposed a novel secure sharing and storing method of personal travel trajectory data based on BC and InterPlanetary File System (IPFS). We adopt the Hyperledger Fabric, the representative of Federated BC framework, combined with the IPFS storage to form a novel mode of querying on-chain and storing off-chain aiming to both achieve the effectiveness of data processing and protect personal privacy-related information. This method firstly solves the efficiency problem of traditional public BC and ensures the security of stored data by storing the ciphertext of complete personal travel trajectory data in decentralized IPFS storage. Secondly, considering the huge amount of information of residents' travel trajectories, the method proposed in this article can obtain the complete information under the chain stored in IPFS by querying the index on the chain, which significantly improves the data processing efficiency of residents' travel trajectories and thus promotes the effective control of the new crown pneumonia epidemic. Finally, the feasibility of the proposed solution is verified through performance evaluation and security analysis.

Digital Health Information Systems in the Member States of the Commonwealth of Independent States: Status and Prospects

This paper examines the status of the development of national digital health information systems (HIS) in Commonwealth of Independent States (CIS) member states. Data for research were collected using a questionnaire adapted from the questionnaire of the WHO’s Third Global Survey on eHealth. The results showed that the digital transformation of HIS was occurring in all seven CIS member states (participating in the study), which were financed by different resources. Laws and regulations on electronic medical records (EMR) use were present in almost all participating CIS member states. Various international standards and classifications were used to support development and the interoperability of digital health information system (d-HIS), including International Classification of Diseases (ICD), Digital Imaging and Communications in Medicine (DICOM), ISO 18308, Logical Observation Identifiers, Names, and Codes (LOINC), Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT), and ISO TC 215. Several CIS member states had adopted a national information security strategy for the safe processing of both personal data and medical confidential information. The digital transformation of healthcare and the Empowerment through Digital Health initiative are taking place in all CIS member states, which are at different stages of introducing electronic medical and health records.

Realistic Dilemma and Improvement of Sensitive Personal Information Processing Rules

The Personal Information Protection Law has a special chapter to stipulate the special pro-cessing rules of sensitive personal information, which reflects the value orientation of strengthening the protection of sensitive personal information. However, due to the mode of permitting the processing of sensitive personal information in principle and restricting pro-cessing with exceptions, the protection of sensitive personal information is greatly weakened in fact. Through the comprehensive analysis of our country's specific specifications of pro-cessing mode of principled prohibition and exception prohibition and combined with compara-tive law experience, the processing of sensitive personal information should adopt the legis-lative mode of principled prohibition and exception permission, and further limit the processing of exceptional allowed circumstances.

Realistic Dilemma and Improvement of Sensitive Personal Information Processing Rules

The Personal Information Protection Law has a special chapter to stipulate the special pro-cessing rules of sensitive personal information, which reflects the value orientation of strengthening the protection of sensitive personal information. However, due to the mode of permitting the processing of sensitive personal information in principle and restricting pro-cessing with exceptions, the protection of sensitive personal information is greatly weakened in fact. Through the comprehensive analysis of our country's specific specifications of pro-cessing mode of principled prohibition and exception prohibition and combined with compara-tive law experience, the processing of sensitive personal information should adopt the legis-lative mode of principled prohibition and exception permission, and further limit the processing of exceptional allowed circumstances.

Cooperation and competition between the default mode network and frontal parietal network in the elderly.

Recent research has shown that the Default Mode Network (DMN) typically exhibits increased activation during processing of social and personal information but shows deactivation during working memory (WM) tasks. Previously, we reported the Frontal Parietal Network (FPN) and DMN showed coactivation during task preparation whereas the DMN exhibited deactivation during task execution in working memory tasks. Aging research has shown that older adults exhibited decreased functional connectivity in the DMN relative to younger adults. Here, we investigated whether age-related cognitive decline is related to a reduced relationship between the FPN and DMN using a working memory task during the execution period. First, we replicated our previous finding that the FPN and DMN showed coactivation during the preparation period, whereas the DMN showed deactivation during the execution period. The older adults showed reduced DMN activity during task preparation and reduced deactivation during task execution; however, they exhibited a higher magnitude of activation in the FPN than the young individuals during task execution. Functional connectivity analyses showed that the elderly group, compared to the young group, showed weaker correlations within the FPN and the DMN, weaker positive correlations between the FPN and DMN during task preparation, and weaker negative correlations between the FPN and DMN during execution. The results suggest that cognitive decline in the older adults might be related to reduced connectivity within the DMN as well as between the FPN and DMN.

Challenges in Implementing Data Protection Laws: Lessons Learnt from Developed Countries

Purpose: The purpose of the study is to examine the challenges experienced in implementing data protection laws.
 Methodology: This study adopted a desktop methodology. This study used secondary data from which include review of existing literature from already published studies and reports that was easily accessed through online journals and libraries.
 Findings: The study concludes that monitoring and inspections by the regulatory authority regulatory bodies is not properly done because the regulatory authorities lack the resources to monitor and inspect.
 Unique Contribution to Theory, Practice and Policy: The study was anchored on Adaptive Structuration Theory and Absorptive Capacity Theory. The study recommended that personal information processing management framework is required to aid the critical industries in understanding how personal information can be processed in line with the requirements of the Act. The study recommended that a wider variety of enforcement strategies should be used apart from the persuasion and warning letters issued to who do not comply.

Legal regulation of big data killing

As a new problem arising from algorithm and information abuse in the data age, big data killing is difficult to be regulated by law before the promulgation of the Personal Information Protection Law, and the relevant judicial practice is not mature enough. The implementation of the Personal Information Protection Law clearly prohibits the killing of big data from the perspective of protecting personal information, and makes comprehensive provisions from the three stages of personal information collection, processing and application. However, the relevant regulations are not perfect, and the right to carry personal information and the impact assessment system of personal information protection still need to be clarified. In terms of information compliance, the government and enterprises should build a multi governance mechanism to improve personal information protection and governance capabilities.