Search

Mobile Applications (a.k.a. apps) have rapidly grown into a multi-billion-dollar industry. Because they are available through devices that are “always on” and often with the user, mobile apps are often adopted “on the fly” as needed. As a result, the related adoption and disclosure decisions are frequently only based on the information provided through the mobile app delivery platform (e.g., the Apple App Store™ or Google Play™). The fact that mobile app use often requires the disclosure of an unprecedented combination of personal information (e.g., location data, preferences, contacts, calendars, browsing history, music library) means that a very complex risk/benefit tradeoff decision is based on only the small amount of information provided by the mobile app delivery platform — and all in a short period of time. Hence, this process is much shorter and much riskier than traditional software adoption. Through two experiments involving 1,588 mobile app users, we manipulated three primary sources of information provided by the platform (app quality ratings, network size, and privacy assurances) to understand their effect on perceptions of privacy risks and benefits, and in turn, how they influence consumer adoption intentions and willingness-to-pay (WTP). The results indicate that network size influences not only perceived benefits but also the perceived risks of apps in the absence of perfect information. In addition, we find that integrating a third-party privacy assurance system into the app platform has a significant influence on app adoption and information disclosure. LBS privacy risk perceptions can also be reduced by network size, thus confirming our information cascade hypothesis. We further discuss the implications of these findings for research and practice.

The recent unprecedented threat from COVID-19 and past epidemics, such as SARS, AIDS, and Ebola, has affected millions of people in multiple countries. Countries have shut their borders, and their nationals have been advised to self-quarantine. The variety of responses to the pandemic has given rise to data privacy concerns. Infection prevention and control strategies as well as disease control measures, especially real-time contact tracing for COVID-19, require the identification of people exposed to COVID-19. Such tracing frameworks use mobile apps and geolocations to trace individuals. However, while the motive may be well intended, the limitations and security issues associated with using such a technology are a serious cause of concern. There are growing concerns regarding the privacy of an individual's location and personal identifiable information (PII) being shared with governments and/or health agencies. This study presents a real-time, trust-based contact-tracing framework that operates without the use of an individual's PII, location sensing, or gathering GPS logs. The focus of the proposed contact tracing framework is to ensure real-time privacy using the Bluetooth range of individuals to determine others within the range. The research validates the trust-based framework using Bluetooth as practical and privacy-aware. Using our proposed methodology, personal information, health logs, and location data will be secure and not abused. This research analyzes 100,000 tracing dataset records from 150 mobile devices to identify infected users and active users. © 2021 Tech Science Press. All rights reserved.

In Code, the most influential book yet written about law and cyberspace, Lawrence Lessig makes an intriguing proposal for shaping privacy on the Internet: (1) the legal assignment to every individual of a property interest in her own personal information, and (2) the employment of software transmission protocols, such as P3P, to permit the individual to structure her access to Web sites. In "Beyond Lessig's Code for Internet Privacy: Cyberspace Filters, Privacy Control, and Fair Information Practices," 2000 Wisc. L. Rev. 743, I respond to this approach with a number of criticisms and a competing proposal. My initial criticism of Lessig's proposal for privacy concerns how it contradicts his stand against PICs, a software transmission protocol for filtering Internet content reminiscent of P3P. Once we place privacy in a social context, moreover, P3P seems far less attractive an option. In place of Lessig's underlying paradigm, which seeks to increase personal control of data. I develop a concept of constitutive privacy. In my view, information privacy is a constitutive value that safeguards participation and association in a free society. Rather than simply seeking to allow more and more individual control of personal data, we should view the normative function of information privacy as inhering in its relation to participatory democracy and individual self-determination. A privacy market can play a role in helping information privacy fulfill this constitutive function. Yet, Lessig's propertization of privacy raises a further set of difficulties. In my view, propertization a la Lessig will only heighten flaws in the current market for personal data. This consequence follows from numerous shortcomings in this market and structural difficulties that indicate the unlikelihood of a self-correction in it. Moreover, in revisiting Calabresi and Melamed's work regarding the comparative merits of property and liability regimes, I find that a mixed regime is to be preferred for Internet privacy over Lessig's property regime. Part III of this Article turns from criticism to prescription and develops the mixture of property and liability rules necessary for establishment of information privacy standards in cyberspace. It proposes recourse to Fair Information Practices (FIPs) to establish rules for the fair treatment of personal data on the Internet. Yet, FIPs are not without potential shortcomings if structured only as command-and-control rules. My suggestion therefore is that an American Internet privacy law consisting of FIPs should include both mandatory and default elements.

Proposed "information privacy" rules that give us the power to "control . . . information about ourselves" and to mandate "fair information practices" sound appealing. Why, after all, should a business be able to communicate information about its clients without the clients' permission, and why should the media be able to publish unnewsworthy private information about us for the whole world to see? The difficulty is that the right to information privacy -- the right to control other people's communication of personally identifiable information about you -- is a right to have the government stop people from speaking about you. And the First Amendment (which is already our basic code of "fair information practices") generally bars the government from "control[ling the communication] of information," either by direct regulation or through the authorization of private lawsuits. This article makes two main points: (1) While privacy protection secured by contract turns out to be constitutionally sound, broader information privacy rules are not easily defensible under existing free speech law. (2) Creating new free speech exceptions to accommodate information privacy speech restrictions could give us much more than we bargained for: Most of the justifications given for information privacy speech restraints are directly applicable to other speech control proposals that have already been proposed, and accepting these justifications in the attractive case of information privacy speech restrictions would create a powerful precedent for those other restraints. My chief goal is to consider, as concretely as possible, what these unintended consequences of various justifications for information privacy speech restrictions might be. I ultimately conclude that these consequences are troubling enough that I must reluctantly oppose such information privacy rules. But I hope the article will also be useful to those who are committed to supporting information privacy speech restrictions but would like to design their arguments in order to minimize the risks that I identify, and even to those who welcome the possibility that information privacy speech restrictions may become a precedent for other restrictions because they believe the Court has generally gone too far in protecting, say, nonpolitical speech or speech that injures the dignity of others.

Blockchain technology is an undeniable ledger technology that stores transactions in high-security chains of blocks. Blockchain can solve security and privacy issues in a variety of domains. With the rapid development of smart environments and complicated contracts between users and intelligent devices, federated learning (FL) is a new paradigm to improve accuracy and precision factors of data mining by supporting information privacy and security. Much sensitive information such as patient health records, safety industrial information, and banking personal information in various domains of the Internet of Things (IoT) including smart city, smart healthcare, and smart industry should be collected and gathered to train and test with high potential privacy and secured manner. Using blockchain technology to the adaption of intelligent learning can influence maintaining and sustaining information security and privacy. Finally, blockchain-based FL mechanisms are very hot topics and cut of scientific edge in data science and artificial intelligence. This research proposes a systematic study on the discussion of privacy and security in the field of blockchain-based FL methodologies on the scientific databases to provide an objective road map of the status of this issue. According to the analytical results of this research, blockchain-based FL has been grown significantly during these 5 years and blockchain technology has been used more to solve problems related to patient healthcare records, image retrieval, cancer datasets, industrial equipment, and economical information in the field of IoT applications and smart environments.

Mobile usage has become a part of our daily lives. However, many mobile users ignore the existence of app permissions in an app. One of the reasons is the lack of information related to app permissions. If users are not careful, app permissions can be abused by hackers to steal their data such as SMS, photos, microphone access, and GPS. The purpose of this study is to observe the perspective of university students in Batam regarding app permissions as well as to see the consequences of that perspective. The basis of this research is using survey method for 132 social media users and regression. This study proves that mobile users’ information privacy concerns have an influence on the intention to accept app permissions, which means that university students of Batam tend to consider personal information privacy on mobile before accepting app permissions. However, computer anxiety and perceived control do not affect mobile users’ information privacy concerns, which means university students of Batam have neither computer anxiety nor perceived control over personal information privacy on mobile.

Disinformation campaigns reduce trust in democracy, harm democratic institutions, and endanger public health and safety. While disinformation and misinformation are not new, their rapid and widespread dissemination has only recently been made possible by technological developments that enable never-before-seen levels of mass communication and persuasion.Today, a mix of social media, algorithms, personal profiling, and psychology enable a new dimension of political messaging—a dimension that disinformers exploit for their political gain. These enablers share a root cause—the poor data privacy and security regime in the U.S.At its core, democracy requires independent thought, personal autonomy, and trust in democratic institutions. A public that thinks critically and acts independently can check the government’s power and authority. However, when the public is misinformed, it lacks the autonomy to freely elect and check its representatives and the fundamental basis for democracy erodes. This Article addresses a root cause of misinformation dissemination —the absence of strong data privacy protections in the U.S.—and its effects on democracy. This Article explains, from a technological perspective, how personal information is used for personal profiling, and how personal profiling contributes to the mass interpersonal persuasion that disinformation campaigns exploit to advance their political goals.

Federated learning is designed to collaboratively train a shared model based on a large number of mobile devices while preserving data privacy, which has been widely adopted to support different geo-spatial systems. However, two critical issues prevent federated learning to be effectively deployed on resource-constrained devices in large scale. First, federated learning causes high energy consumption which can badly hurt the battery lifetime of mobile devices. Second, leakage of sensitive personal information still occurs during the training process. Thus, a system that can effectively protect the sensitive information while improving the energy efficiency is urgently required for a mobile-based federated learning system. This paper proposes SmartDL, an energy-aware decremental learning framework that well balances the energy efficiency and data privacy in an efficient manner. SmartDL improves the energy efficiency from two levels: (1) global layer, which adopts an optimization approach to select a subset of participating devices with sufficient capacity and maximum reward. (2) local layer, which adopts a novel decremental learning algorithm to actively provides the decremental and incremental updates, and can adaptively tune the local DVFS at the same time. We prototyped SmartDL on physical testbed and evaluated its performance using several learning benchmarks with real-world traces. The evaluation results show that compared with the original federated learning, SmartDL can reduce energy consumption by 75.6–82.4% in different datasets. Moreover, SmartDL achieves a speedup of 2–4 orders of magnitude in model convergence while ensuring the accuracy of the model.

The General Data Protection Regulation came into effect on May 25, 2018, and has rapidly become a touchstone model for modern privacy law. It empowers consumers with unprecedented control over the use of their personal information. However, new guarantees of consumer privacy adversely affect data sharing and data application markets because service companies (e.g., Apple, Google, Microsoft) cannot provide immediate and optimized services through analysis of collected consumer experiences. Therefore, data de-identification technology (e.g., k-anonymity and differential privacy) is a candidate solution to protect sharing data privacy. Various workarounds based on existing methods such as k-anonymity and differential privacy technologies have been proposed. However, they are limited in data utility, and their data sets have high dimensionality (the so-called curse of dimensionality). In this paper, we propose the ( $$k,\varepsilon ,\delta $$ )-anonymization synthetic data set generation mechanism (called ( $$k,\varepsilon ,\delta $$ )-anonymization for short) to protect data privacy before releasing data sets to be analyzed. Synthetic data sets generated by ( $$k,\varepsilon ,\delta $$ )-anonymization satisfy the definitions of k-anonymity and differential privacy by applying KD-tree and random sampling mechanisms. Moreover, ( $$k,\varepsilon ,\delta $$ )-anonymization uses principle component analysis to rationally replace high-dimensional data sets with lower-dimensional data sets for consideration of efficient computation. Finally, we confirm the relationships between parameters k, $$\varepsilon $$ , and $$\delta $$ for k-anonymity and ( $$\varepsilon ,\delta $$ )-differential privacy and estimate the utility of ( $$k,\varepsilon ,\delta $$ )-anonymization synthetic data sets. We report a privacy analysis and a series of experiments that prove that ( $$k,\varepsilon ,\delta $$ )-anonymization is feasible and efficient.

Epilepsy is a chronic neurological disorder affecting more than 65 million people worldwide and manifested by recurrent unprovoked seizures. The unpredictability of seizures not only degrades the quality of life of the patients, but it can also be life-threatening. Modern systems monitoring elec-troencephalography (EEG) signals are being currently developed with the view to detect epileptic seizures in order to alert caregivers and reduce the impact of seizures on patients' quality of life. Such seizure detection systems employ state-of-the-art machine learning algorithms that require a large amount of labeled personal data for training. However, acquiring EEG signals during epileptic seizures is a costly and time-consuming process for medical experts and patients. Furthermore, this data often contains sensitive personal information, presenting privacy concerns. In this work, we generate synthetic seizure-like brain electrical activities, i.e., EEG signals, that can be used to train seizure detection algorithms, alleviating the need for sensitive recorded data. Our experiments show that the synthetic seizure data generated with our GAN model succeeds at preserving the privacy of the patients without producing any degradation in performance during seizure monitoring. © 2020 IEEE. ISSN:0018-9294 ISSN:1558-2531

Personal information (PI) is valuable to web-based service providers, but its mishandling can be costly due to emerging laws. This article identifies nine legal requirements for privacy compliance in five stages of PI handling and discusses potential technical solutions.

Currently, Edge computing (EC) paradigm is adopted to provision the low-latency resources for the massive real-time services in Internet of vehicles (IoV). To alleviate the QoE (Quality of Experience) degradation of the vehicular users due to the uncertainties (e.g., resource conflicts and communicating interruption), software-defined network (SDN) is involved in the EC-enabled IoV to manage the cooperative operation of distributed edge nodes (ENs). However, the increasing privacy leakage for the IoV service offloading causes the disclosure of the sensitive information, including driving location, personal information of the driver, etc. Moreover, the regulation of SDN is practically insufficient, as the general control is incompetent to maintain balanced operation with the premise of efficient service utility. In view of these challenges, a secure s ervice o ffloading me thod, named SOME, is designed to promote IoV service utility and edge utility, meanwhile ensuring privacy security, in SDN-enabled EC. Specifically, an SDN-based framework for IoV service management is developed to address the inherent uncertainty of edge network by SDN controllers. Besides, the locality-sensitive-hash (LSH) is leveraged to realize utility- and privacy-aware service selection. Eventually, comparative experiments are implemented to verify the effectiveness of SOME.

With global personal information flows increasing, efforts have been made to develop principles to standardize data protection regulations. However, no set of principles has yet achieved universal adoption. This note proposes a principle mandating that personal data be securely destroyed when it is no longer necessary for the purpose for which it was collected. Including a data deletion principle in future data protection standards will increase respect for individual autonomy and decrease the risk of abuse of personal data. Though data deletion is already practiced by many data controllers, including it in legal data protection mandates will further the goal of establishing an effective global data protection regime.

Contact tracing is a key public health intervention during the coronavirus pandemic. While government contact tracing apps (e.g., COVIDSafe) may enforce personal information protection, privacy concerns remain among citizens. To date, few studies have investigated the adoption of contact tracing technology and corresponding citizen information privacy concerns. To address this gap, we propose a research model to explore the impact of individual privacy concerns, trust, and risk perceptions on citizen’s willingness to download a federal contact tracing app. To test the model, we administer a survey to Australian citizens to assess their perceptions of the government’s “COVIDSafe” app. The results of this study indicate that relative advantage, compatibility and trusting beliefs increase adoption intentions. The study provides recommendations for governments tackling COVID-19 and guidance for contact tracing strategies in preparation for future pandemics. © Operational Research Society 2021.

Individuals are increasingly using personal Internet of Things (IoT) devices that digitize their day-to-day lives. Those devices, however, often require substantial personal information to generate their intended benefits. For example, fitness technologies collect health, sleep, personal, and a vast array of other information ubiquitously, creating possible privacy issues for the users when fitness technology platform providers store or share their information, whether users know this or not. To explore the role of privacy perceptions in the context of continued use of fitness technologies, this study collected data from 212 fitness tracker users. We find empirical support for the importance of privacy perceptions in a user's intention to continue to use their fitness tracker. More specifically, consistent with privacy calculus research, privacy concern is negatively related to willingness to disclose information while perceived benefit is positively related to it. As an extension to calculus variables, users' expectations towards the data sharing practices of organizations also influences their willingness to disclose information. Importantly, willingness to disclose information has a direct effect on continued use intentions but also moderates the relationship between perceived benefit and users' intentions to continue using a fitness tracker. We discuss the implications of these findings for research and practice.

Video game players face a fundamental challenge in managing their competing desires for both privacy and publicity, for being both apart from, and a part of, the communities in which they play. In this paper, we argue that "gamertags" are important tools for protecting gamers' privacy as well as creative outlets for expressing meaningful aspects of identity. Based on 30 semi-structured interviews focused on players' usernames, we find through the pseudonyms under which they play, gamers both hide identifying information such as their offline names and addresses while bringing attention to information that is deeply meaningful to them, such as their family nickname or favorite music. By deemphasizing some parts of their identity and by emphasizing others, players not only shape how they are perceived by other gamers, but they also attempt to preclude accidental disclosure of more identifying information. We argue that gamertag practices thus constitute an important form of boundary work through which gamers actively seek to draw lines between their offline and multiple online worlds in the ways that they wish. We argue that gamers use these names to both protect and project aspects of their identities--at times even seeking protection through projection--as a way of addressing their competing desires to both conceal and reveal different aspects of their identities. As boundary work, players' efforts to carefully protect personally-identifying information and intentionally project personally meaningful information to their communities help them better manage their online identities, relationships with others, and overall data privacy.

Bigdata becomes a significant sector and academics research topic. Bigdata is a two-edged sword. The rising volume of information together will increase the likelihood of blundering non-public data privacy. Due to many new technologies and innovations that pervade our everyday lives, like smartphones and social networking apps, and the Internet of Things-based intelligent-world systems, the large amount of data generated in our world has exploded. During this data processing, storage, and the use of the information it can quickly cause personal information exposure and the difficulty of interpreting the information. The aim is to incorporate this range of information into one framework for big data management and to recognize problems regarding privacy. This paper begins with the introduction of bigdata, its process, protection issues, and tools which are used to solve its problems

Electronic healthcare (e-health) networks are increasingly popular, particular during pandemics such as COVID-19. This reinforces the importance of ensuring security and privacy for data-in-transit. One such solution is steganography-based schemes that utilize biological signals (e.g., ECG) as cover signals to preserve the privacy of patient personal information without affecting the diagnostic features. There are various limitations in existing steganography-based schemes, and in this study we present an effective privacy protection scheme leveraging both multidimensional steganography and shared keys. To enhance security and accelerate signal processing in our design, the Fast Walsh-Hadamard transform (FWHT) is employed to decompose ECG signals into a set of coefficients, of which the less-significant coefficients are used to construct the multidimensional space. The negotiated shared keys facilitate the embedding of encrypted data in the constructed space. We then evaluate the proposed scheme using different categories of ECG signals in the MIT-BIH database. It is observed that the signal distortion is minimal (i.e., less than 1%), even if the embedded data reaches the maximum embedding capacity. The security analysis also demonstrates that unauthorized retrieval of hidden information is not practical, within a short period of time.

Mobile social sensing leverages a large group of individuals having mobile devices capable of sensing and computing to perform intelligence sensing tasks. To perform smart participant selection (i.e. task assignment) for mobile social sensing, most of the cloud-based platforms often require mobile users to report their personal information, such as sensing cost, location and sensing quality. Therefore, the users might suffer from potential privacy breaches during the participant selection phase especially when they are not selected for performing the tasks. Existing solutions based on participant grouping can resolve this privacy leakage by leveraging secure sharing or group bidding within groups. However, the group formation problem has not be well studied, and the communication overhead over formed groups is usually ignored. To address these issues, in this paper, we consider a new set of privacy-preserving grouping problems over edge clouds to minimize the communication cost at edge clouds during secure sharing/bidding, while satisfying each participant's privacy requirement. Various grouping schemes are carefully designed to fulfill the optimization goal for two different scenarios: tree-based hierarchical edge clouds and graph-based interconnected edge clouds. Extensive simulations over both synthetic and real-life datasets are conducted to confirm the efficiency of all proposed schemes.

The concept of people’s memory maintains the finiteness of time and capacity. However, with the advancement in technology, the amount of storage memory a person can use has increased dramatically. Given that digital traces can hardly be erased or forgotten, individuals have begun to express their desire to be forgotten in the digital world, and governments and academia are considering methods to fulfill such wishes. Capturing the difficulties in terms of a cultural lag between technological advancements and regulations on individuals’ data privacy needs, we identify six motives for individuals wishing to be forgotten online and investigate its expected effects on online content generation through a qualitative content analysis of 222 responses from open-ended surveys in Korea. Our findings provide implications for the literature on individual privacy and the right to be forgotten employing the cultural lag, as well as, elaborate further on the relationship between being forgotten online and the legitimacy of such requests of individuals. Additionally, implications for data providers, data controllers/processors, and governments to address this lag and build a balanced system of personal information are provided.

At present, the WTO's multilateral trading system faces the acute challenge of adapting to the digital and commercial economies' rapid evolution. The recent regional trade agreements embody the corresponding achievements of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), Economic Partnership Agreement (EPA), and the United States Mexico Canada Agreement (USMCA) in facilitating the free flow of data and regulating digital barriers to trade. The General Data Protection Regulation (GDPR) has also developed several new norms for promoting free data flow and protecting personal data privacy. The new regional trade agreements fulfil the digital trade threshold, prohibit delocalization by the data center and establish organized frameworks for cross-border data flow and personal privacy protection. In the negotiations on trade services agreements, China should focus on implementing a new management structure, speeding up domestic legislation and legislative reforms, and establishing a legal framework that promotes the free flow of data, fair competition, and personal information among corporations.

Personal information and other types of private data are valuable for both data owners and institutions interested in providing targeted and customized services that require analyzing such data. In this context, privacy is sometimes seen as a commodity: institutions (data buyers) pay individuals (or data sellers) in exchange for private data. In this study, we examine the problem of designing such data contracts, through which a buyer aims to minimize his payment to the sellers for a desired level of data quality, while the latter aim to obtain adequate compensation for giving up a certain amount of privacy. Specifically, we use the concept of differential privacy and examine a model of linear and nonlinear queries on private data. We show that conventional algorithms that introduce differential privacy via zero-mean noise fall short for the purpose of such transactions as they do not provide a sufficient degree of freedom for the contract designer to negotiate between the competing interests of the buyer and the sellers. Instead, we propose a biased randomized algorithm to generate differentially private output and show that this algorithm allows us to customize the privacy-accuracy tradeoff for each individual. We use a contract design approach to find the optimal contracts when using this biased algorithm to provide privacy and show that under this combination the buyer can achieve the same level of accuracy with a lower payment as compared to using the conventional, unbiased algorithms, while at the same time incurring lower privacy loss for the sellers.

This work proposes a theoretical framework for explaining the end users' willingness to disclose their personal information to the IoT service providers, despite the known privacy risks. The Communication Privacy Management Theory and Privacy Trust Behavioral Intention Model are used as the backbone for the presented framework. The model is empirically validated by collecting data from 924 participants residing in Thailand and Singapore who are active users of at least one type of IoT service: smart home, smart healthcare or smart cities. The results suggest that trust, perceived privacy risks, perceived benefits and the level of information sensitivity affect the users' willingness to disclose their personal information. Certain cultural differences are also noticed from the two different country samples. Based upon the results, the research implications are discussed, and suggestions provided.

With the rapid development of social networks, users pay more and more attention to the protection of personal information. However, the transmission of users’ personal information through social networks will inevitably lead to privacy leakage and make users attacked. A large amount of privacy information can be inferred from the content and social traces published by users, which leads to the rise of privacy inference technology for users in social networks. Social relationship inference and attribute inference are two basic attacks on users’ privacy in social networks. This is the first systematic review of privacy inference attacks in social networks. The purpose of this retrospective study is to provide a global summary, summarizing the time trend of the topic, and show the evolution of the topic in the past 15 years. In addition, this paper discusses the trend and development of this topic and finally looks forward to future work. The contribution of our work is helpful for researchers to continue their research in this field.

International audience; The widespread use of mobile devices and location-based services has generated a large number of mobility databases. While processing these data is highly valuable, privacy issues can occur if personal information is revealed. The prior art has investigated ways to protect mobility data by providing a wide range of Location Privacy Protection Mechanisms (LPPMs). However, the privacy level of the protected data significantly varies depending on the protection mechanism used, its configuration and on the characteristics of the mobility data. Meanwhile, the protected data still needs to enable some useful processing. To tackle these issues, we present PULP, a framework that finds the suitable protection mechanism and automatically configures it for each user in order to achieve user-defined objectives in terms of both privacy and utility. PULP uses nonlinear models to capture the impact of each LPPM on data privacy and utility levels. Evaluation of our framework is carried out with two protectionmechanisms from the literature and four real-world mobility datasets. Results show the efficiency of PULP, its robustness and adaptability. Comparisons between LPPMs’ configurators and the state of the art further illustrate that PULP better realizes users’ objectives, and its computation time is in orders of magnitude faster.

The General Data Protection Regulation (GDPR) is considered by some to be the most important change in data privacy regulation in 20 years. Effective May 2018, the European Union GDPR privacy law applies to any organization that collects and processes the personal information of EU citizens within or outside the EU. In this work, we seek to quantify the progress the GDPR has made in improving privacy policies around the globe. We leverage our data mining tool, PrivacyCheck, to automatically compare three corpora (totaling 550) of privacy policies, pre- and post-GDPR. In addition, to evaluate the current level of compliance with the GDPR around the globe, we manually studied the policies within two corpora (450 policies). We find that the GDPR has made progress in protecting user data, but more progress is necessary—particularly in the area of giving users the right to edit and delete their information—to entirely fulfill the GDPR’s promise. We also observe that the GDPR encourages sharing user data with law enforcement, and as a result, many policies have facilitated such sharing after the GDPR. Finally, we see that when there is non-compliance with the GDPR, it is often in the form of failing to explicitly indicate compliance, which in turn speaks to an organization’s lack of transparency and disclosure regarding their processing and protection of personal information. If Personally Identifiable Information (PII) is the “currency of the Internet,” these findings mark continued alarm regarding an individual’s agency to protect and secure their PII assets.

In the digital age, where the Internet connects things across the globe and individuals are constantly online, data security and privacy are becoming key drivers (and barriers) of change for adoption of innovative solutions. Traditional approaches, whereby communication links are secured by means of encryption, and access control is run in a static way by a centralized authority, are showing their limits when applied to massive-scale, interconnected and distributed systems. Regulations, while still fragmented, are moving to adapt to changes in technology and society, with the aim to protect confidential information by governments, businesses, and individual citizens. In this landscape, proper mechanisms should be defined to allow a strict control over the data life-cycle and to guarantee the privacy and the application of specific regulations on personal information's disclosure, usage and access. Sticky policies represent one approach to improve owners’ control over their data. In such an approach, machine-readable policies are attached to data. They are called 'sticky’ in that they travel together with data, as data travels across multiple administrative domains. In this article we survey the state-of-the-art in sticky policies, discussing limitations, open issues, applications and research challenges, with a specific focus on their applicability to Internet of Things, cloud computing, and Content Centric Networking.

Social media networks are extensively using artificial intelligence tools (AI) fed with huge data about users’ preferences, mental state, mood, health, and other. The potential risk of manipulating this “Big Data” to predict users ‘behavior, customize users’ profiles and create a “Virtual social world” for each one is of major importance. Using algorithms to make sense of streams of data, known as the discipline of data analytics, and how it’s applied in social media platforms and decision-making, raises ethical concerns about data privacy and data protection. This research is conducted to answer questions related to users’ perceptions of privacy, risk of sharing personal data on social media and to what extent are people aware of the use of AI and the risks they face while using SNSs, as well as the ethical issues related to the use of artificial intelligence in social media. This study focuses on measuring people’s perceptions of privacy through four main variables and their interrelation. The results emphasized that people perceived themselves at risk on social media, they have concerns about their data being manipulated and misused, this affects their overall perception of privacy, the sample consisted of 200 respondents through an online survey. People’s perceptions of privacy could be an indicator of how they will act regarding the sharing of personal information and feelings on social media.

In this work, we consider the multi-party privacy conflict (MPC) in an online social network (OSN). As many data items uploaded to the OSN are “co-owned” by multiple users with different privacy concerns, some personal information of OSN users may be disclosed by others unintentionally. On the contrary with existing mainstream OSN platforms allowing only the very user uploading the data to set the privacy level, in this article we take a fine-grained approach to resolve MPC, in which all co-owners independently determine whether to share their personal content within the data on OSN. Interacted with its peers, the opinion of a co-owner, however, might be influenced by and consequently influence the decision of its peers. To this end, each co-owner, as an individual decision maker, strikes a tradeoff between its internal privacy preference and the external social influence from its neighbors in a OSN. Specifically, we formulate the interaction among co-owners as a multi-player non-cooperative game with a network structure representing their social relations. For the proposed network game, we establish the existence of multiple (pure-strategy) equilibria, and characterize them accordingly. The convergence of interaction is also investigated when synchronous and asynchronous best-response updates are used, respectively. We note that when the action set for the players is discrete, the game exhibits non-linear dynamics, making it challenging to analyze the convergence behavior. We prove that synchronous update may lead to either an equilibrium or a strategy cycle, and the asynchronous update always leads to an equilibrium. Building upon this analysis, we advocate a practical implementation of the proposed MPC management, which balances the automation of the management and intervention of users. Moreover, we take one step further to develop approaches aiming to reach a “stronger agreement” among the players for the sake of benefits of uploader and OSN provider. Numerical examples are also provided to corroborate the analytical results.

The rapid evolution of Internet use has led to the collection of big data about users, which has raised users’ privacy concerns about their personal information. This study adopts the hypothesis to evaluate the perception of the information sensitivity of Internet users in Saudi Arabia as research subjects. This study analyzes the sensitivity of 35 types of information through a questionnaire with answers from 508 participants from Saudi Arabia and estimates the cultural influence by comparing Saudi results with users from the USA, Brazil and Germany. Demographic information, such as age, gender, marital status and education, and attitude characteristics, such as disposition to privacy, propensity to take risks, privacy violation experience and trust in institutions, influence Saudi individuals’ perception of sensitivity towards various types of information. The survey results show slight differences in the sensitivity levels between Internet users in Saudi Arabia and their counterparts in other nations. Ultimately, this study contributes to improving the international model of information sensitivity perception between different nations.

Trust and privacy have emerged as significant concerns in online transactions. Sharing information on health is especially sensitive but it is necessary for purchasing and utilizing health insuranc...

Marketing in the digital age is driven by software and algorithms, and is characterized by sociability, networking and personalization, which make children profitable targets for the advertising industry. Relying on a survey on UNICEF's U-Report platform registering children and youth, we wanted to examine whether young internet users in Serbia are aware that their personal data are revealed for advertising purposes and if they understand the digital marketing techniques that they are exposed to. Given that more than half of the survey respondents opened their accounts on social media before the age limit, that most of them share their personal information online and are largely indifferent to cookies on the websites they visit, it does not come as a surprise that young internet users in Serbia become an active target of advertising, which is often unwanted or inappropriate for their age. Bearing in mind the multidisciplinary nature of the topic, the recommendations for a variety of stakeholders, from publishers to creative industries and parents are given in the concluding remarks. Article received: April 30, 2020; Article accepted: May 30, 2020; Published online: October 15, 2020; Original scholarly paper How to cite this article: Krstic, Natasa i Danica Cigoja Piper. "Digital Marketing and Children’s Rights: Trick or Treat?" AM Journal of Art and Media Studies 23 (2020): 135-148. doi: 10.25038/am.v0i23.402

PurposeThe purpose of this paper is to report on the findings from the Digital Privacy Story Completion Project, which investigated Australian participants' understandings of and responses to digital privacy scenarios using a novel method and theoretical approach.Design/methodology/approachThe story completion method was brought together with De Certeau's concept of tactics and more-than-human theoretical perspectives. Participants were presented with four story stems on an online platform. Each story stem introduced a fictional character confronted with a digital privacy dilemma. Participants were asked to complete the stories by typing in open text boxes, responding to the prompts “How does the character feel? What does she/he do? What happens next?”. A total of 29 participants completed the stories, resulting in a corpus of 116 narratives for a theory-driven thematic analysis.FindingsThe stories vividly demonstrate the ways in which tactics are entangled with relational connections and affective intensities. They highlight the micropolitical dimensions of human–nonhuman affordances when people are responding to third-party use of their personal information. The stories identified the tactics used and boundaries that are drawn in people's sense-making concerning how they define appropriate and inappropriate use of their data.Originality/valueThis paper demonstrates the value and insights of creatively attending to personal data privacy issues in ways that decentre the autonomous tactical and agential individual and instead consider the more-than-human relationality of privacy.Peer reviewThe peer review history for this article is available at: https://publons.com/publon/10.1108/OIR-05-2020-0174

This article explores conceptual barriers to protecting children’s personal information in relation to online commercial data practices. It does this by using Vedder’s conceptual categories of privacy to identify and position parents’ and teenagers’ concepts of privacy within interpersonal, institutional and commercial data terrains. Drawing from qualitative interviews, the analysis shows that parents’ and teenagers’ conceptualise privacy in terms of the private/public dimension and that their conceptualisations of the consumer–corporate relationship, and corporations themselves, prohibited any concern for their decisional and informational privacy. As their conceptualisations of privacy harms were embedded within social rather than technological frames, this precluded motivation to protect children’s data privacy. This research argues that without a conceptual shift in the way we think about privacy and privacy harms, we need to question whether the logics of neoliberalism can effectively address children’s data privacy.

A cyber–physical system is a mechanism controlled or monitored by computer-based algorithms, tightly integrated with the internet and its users. Cyber–physical systems such as smart grid, autonomous automobile systems, medical monitoring, process control systems, robotics systems, and automatic pilot avionics will use physical sensors to produce and collect data. Most of the data contains personal information, which is so called privacy, should be carefully protected. How to protect privacy is now a hot-topic not only in academia but also in industry. Differential privacy has been accepted as the privacy concept due to its concise definition and its simple implementation. However, the interactive model cannot achieve differential privacy without data provider’s timely answers, which means data provider should always be attachable. It is unrealistic to keep data provider online due to the risk of data provider be broken will grow rapidly as time goes by. With today’s differential privacy technology, a non-interactive model remains an open problem. To find an alternative, we consider implant whole dataset into a cloud server to provide all the functions instead of data provider. Nonetheless, once the server is compromised, the privacy of the data cannot be guaranteed. It appears that there should be a strong definition, the cloud server is completely trustworthy, before differential privacy can actually be implemented. An intuitive thought to improve this situation is to only upload encrypted datasets. Then, the server could be semi-honest or even fully malicious. Homomorphic encryption can make the encrypted dataset operable, but it requires considerable storage space and bandwidth, which are impractical. We realized that order-preserving encryption is a tradeoff between data utility and practicability. Thus, we propose a novel outsourcing differential privacy data release scheme in cyber–physical system. The proposed scheme allows data providers to outsource their datasets to a cloud service provider with low communication cost. Let the cloud service provider be the host that answers the queries from the data evaluator with noisy results. The data providers can go offline after uploading their encrypted datasets, which is one of the critical requirements for a practical system. In this paper, we present a detailed theoretical analysis, including proofs of differential privacy and security. We also report an experimental evaluation on real datasets.

Data privacy and security are among the most important aspects to be considered in implementing a data-driven system. A well generated Big Data contains a wealth of information that can reveal personal life that should be kept in private. Although various studies and Big Data analysis are widely documented, the methods and policies to ensure the privacy and security of data in Big Data governance remain unclear. Big Data analytics also seeks to make the affected person disclose new and critical personal information that is not intended for disclosure. Thus, this study focuses on data privacy and security issues in Big Data governance. The objective of this study aims to propose of Big Data governance framework that complements data privacy and security factors. This study uses a qualitative approach in the development of the research framework based on a systematic literature review and evaluated by experts to validate the framework. This study is expected to benefits the public and private sectors where the proposed framework could be applied as a guide to preventing any data leakage or misuse of Big Data.

Acquiring traffic condition information is of great significance in transportation guidance, urban planning, and route recommendation. To date, traffic density data are generally acquired by road sound analysis, video data analysis, or in-vehicle network communication, which are usually financially or temporally expensive. Another way to get traffic conditions is to collect track data by crowdsourcing. However, this way lead to a greater risk of leaking users’ privacy. To avoid the risk, this article proposes a traffic density estimation model based on crowdsourcing privacy protection. First, in the acquisition process of the track data by crowdsourcing, dual servers are employed for transmission, and homomorphic encryption is carried out to encrypt the data to protect the data from being leaked during transmission. Second, sampling is implemented for randomization and anonymization to reduce the spatial continuity and temporal continuity of position data. In this way, the intermediate server cannot acquire users’ original data, and the main server cannot obtain users’ personal information. Finally, before data transmission, Laplace noising is performed on the users’ local position data to further protect the original location information. The proposed algorithm in this study realizes that only users have their original track data, and the servers involved in the work cannot infer the original track data, which ensures the real security of user privacy. The proposed algorithm was verified with the track data from the Didi Gaia Data Opening Plan. The experimental results showed that the proposed algorithm could still maintain the validity of data analysis results and the security of user data privacy after homomorphic encryption, noise addition, and sample collection, and displayed good robustness and scalability.

A key challenge in information privacy research is how to value personal data with privacy consideration. In this study, we propose an experimental auction approach for valuing personal data. We use the generalized second-price auction to assess the monetary values of individuals' identity, demographic, and private information. We find that individuals' economic valuation of personal data is consistent with their actual self-disclosure behaviors. The economic valuation approach also produces results that are consistent with some well-accepted observations about consumer demographics and privacy. On the other hand, individuals' stated privacy preferences and attitudes are not consistent with their economic valuation. The findings of this study suggest that the proposed approach can be an effective mechanism for measuring personal data privacy. This study also provides important insights into valuing personal information for practical uses with several implications to policy decision makers, corporate executives and managers, data analysts, as well as decision science researchers.

While much effort has been made to detect and measure the privacy leakage caused by the advertising (ad) libraries integrated in mobile applications, analytics libraries, which are also widely used in mobile apps have not been systematically studied for their privacy risks. Different from ad libraries, the main function of analytics libraries is to collect users’ in-app actions. Hence, by design analytics libraries are more likely to leak users’ private information. In this work, we study what information is collected by the analytics libraries integrated in popular Android apps. We design and implement a framework called “Alde”. Given an app, Alde employs both static analysis and dynamic analysis to detect the users’ in-app actions collected by analytics libraries. We also study what private information can be leaked by the apps that use the same analytics library. Moreover, we analyze apps’ privacy policies to see whether app developers have notified the users that their in-app action data is collected by analytics libraries. Finally, we select eight widely used analytics libraries to study and apply our method to 300 popular apps downloaded from both Chinese app markets and Google play. Our experimental results show that some apps indeed leak users’ personal information through analytics libraries even though their genuine purposes of using analytics services are legal. To mitigate such threats, we have developed an app named “ALManager” that leverages the Xposed framework to manage analytics libraries in other apps.

Although data privacy is a compelling concern, prior inquiries have found that consumers do not adequately attend to data privacy policies. This research develops a framework delineating the effects of top-down/bottom-up processes and individual consumer differences in the need for cognition (NFC) and perceived control on visual attention to data privacy policies, including influences on perceptions, attitudes, and behavioral intentions. Using eye tracking in an online shopping context, this research finds perceived control interacted with top-down motivation, manipulated through perceived risk in sharing personal information, to affect visual attention toward privacy-related information. Moreover, a privacy policy icon garners more attention than privacy policy text and non-privacy contents on the website. Further, attention to non-privacy contents significantly enhances loan application likelihood and attitude toward the website. These findings demonstrate attention toward privacy information as a function of the dynamic interaction between top-down motivational influences and individual differences in perceived control.

The architectural, engineering and construction (AEC) requires most efficient joint efforts between the construction project stakeholders with continuing exchange of large amount of project data. Nowadays, it is seen paradigm shift in construction industry to work on digital technologies like BIM from conventional methods of paper-based data exchange. The expanding volume of individual and sensitive information being digitally gathered by the AEC industry and store in the cloud, which makes it vulnerable to cyber attack. According to the Data Protection Act and the General Data Protection Regulation, organisation has to ensure security of people and security of sensitive data. Subsequently, it is crucial to establish the framework or method to provide the privacy of project data. Specifically, individual information, for example, individual health records, address and all other background information should be protected as per the legal regulation In this research paper, a technique called Hybrid-k anonymity has been proposed to protect the individual’s personal information as well as employees details, supplier details, cost details. In this technique, we modified original data using randomisation technique and then apply anonymisation on modified data which can provide better accuracy with minimum loss of information. This approach will enhance the privacy of sensitive information from cyber attack of the data miner.