Search

Daily schedule recommendation is an intelligent approach to recommend multiple suitable activity locations and activity sequences for users based on their needs in a day. In such a scenario, training the model using traditional methods requires centralized data collection from individual users, which may be prohibited by data protection acts, such as GDPR and CCPA. In this paper, we address the problem of daily schedule recommendation utilizing the deep reinforcement learning model in a federated learning framework (FedDSR). And curriculum learning is applied to guide the training process towards better local optimization and better generalization. For the uploaded local parameters, a similarity aggregation algorithm is proposed to improve the quality of the model. The experimental results show that the proposed FedDSR model is superior and effective to multiple baselines on two real datasets Geolife and Chengdu. Comparing with baselines, our method not only ensures that the parties do not need to share data and thus achieve joint modeling, but also can exceed ~18% under evaluation metric perimeter and improve ~0.72% under evaluation metric ADTS.

Machine Learning (ML) algorithms can effectively perform analytics and inferences for building smart applications, such as early detection of diseases in the Industrial Internet of Things (IIoT) and smart healthcare systems. The main components of ML, including training and testing phases, can be decomposed into microservices to improve service quality, along with fast implementation and integration with the edge and cloud services. However, the execution of ML in an edge-cloud environment introduces privacy risks to data owners (e.g., patients). In this paper, we present a privacy-preserving machine learning (ML) framework by leveraging microservice technology for safeguarding healthcare IIoT systems. More specifically, we develop a microservice-based distributed privacy-preserving technique using Differential Privacy (DP) and Radial Basis Function Network (RBFN) to balance between privacy protection and model performance in edge networks. We conduct extensive experiments to evaluate the performance of the proposed technique. The results revealed that DP has a significant influence on the model’s performance and achieves more than 90% accuracy with an epsilon value over 0.4, enhancing data protection and analytics through the implementation of microservices.

Blockchain for supply chain use cases is quickly becoming a prevalent topic of discussion among distribution giants and smaller players. The actual and perceived benefits of blockchain have driven these discussions, as supply chain partners are well aware of the data protection, increased transparency, and end-to-end authentication of goods that blockchain technology can provide. Track and trace mandates from regulatory bodies are also driving the discussions. However, missing from the dialogue is how partners in this ecosystem manage and resolve disputes using smart contracts inherent in blockchain instead of existing dispute resolution mechanisms and processes. This gap is critical; trust will be eroded if supply chain partners do not have adequate dispute resolution mechanisms within the blockchain ecosystem. This paper highlights the areas of friction and potential disputes for supply chains arising from emerging technology such as Artificial Intelligence (AI), asset management using Internet of Things (IoT), and particularly blockchain, a type of Distributed Ledger Technology (DLT). We discuss the importance of regulation in how the use of DLT in supply chains is managed and suggest principles of resolving inevitable disputes with disparate information. We emphasize the need for portable and enforceable contractual terms and argue that standardizing how disputes are resolved may go a long way to technology adoption.

The Internet of Things (IoT) is an emerging paradigm and has penetrated deeply into our daily life. Due to the seamless connections of the IoT devices with the physical world through the Internet, the IoT applications use the cloud to store and provide ubiquitous access to collected data. Sharing of data with third party services and other users incurs potential risks and leads to unique security and privacy concerns, e.g., data breaches. Existing cryptographic solutions are inapt for resource-constrained IoT devices, because of their significant computational overhead. To address these concerns, we propose a data protection scheme to store the encrypted IoT data in a cloud, while still allowing query processing over the encrypted data. Our proposed scheme features a novel encrypted data sharing scheme based on Boneh-Goh-Nissim (BGN) cryptosystem, with revocation capabilities and in-situ key updates. We perform exhaustive experiments on real datasets, to assess the feasibility of the proposed scheme on the resource constrained IoT devices. The results show the feasibility of our scheme, together with the ability to provide a high level of security. The results also show that our scheme significantly reduces the computation, storage and energy overheads than the best performed scheme in the state-of-the-art.

This article considers the question of legal basis of the data protection in the world while and exactly in the European continent. Special attention is paid to the question of personal data as a part of human rights and how the ECHR is dealing with protection of it. The author analyzed a list of different type of issues related to the question of personal data and how they are protected under the Article 8 of the European Convention on Human Rights. Also, it was researched question what does “personal data” means under the legal understanding according to the European law. The main question, which author raised, is there any legal bases of protection of data and which new mechanism we can use with so fast development of information technologies. All these questions lead to the idea that there is no unique and universal way to protect personal data in the world, what we all need because of the high level of cyberterrorism. We should find solution which will regulate the acceptance to data and how to protect it on the international level by public and private international law. In conclusion, we proposed some measures that may improve institute of personal data protection in general., O artigo tem como objetivo examinar o marco legal da proteção de dados no continente europeu. O artigo analisa a questão dos dados pessoais sob o prisma dos direitos humanos e sua proteção nos termos do artigo 8º da Convenção Europeia dos Direitos Humanos. O artigo analisa a experiência do TEDH e a relevância de suas decisões no âmbito da proteção de dados pessoais. Os autores estudam o entendimento legal de dados pessoais dentro da legislação europeia. A base legal para a proteção de dados pessoais foi analisada, e novos mecanismos que poderiam ser utilizados no contexto do rápido desenvolvimento das tecnologias de informação foram estabelecidos. Todas essas questões levam à ideia de que não existe uma forma única e universal de proteger os dados pessoais, ainda que seja necessária, dado o alto nível de ciberterrorismo. Neste artigo, os autores tentam encontrar um mecanismo universal para regular o acesso aos dados pessoais e protegê-los em nível internacional pelo direito internacional público e privado. Em conclusão, sugere-se um conjunto de medidas que podem melhorar o instituto da proteção de dados pessoais.

The rising volume of sensitive and personal data being harvested by data controllers has increased the security essentials in the cloud system. The cloud module is not used just to store the data, but also to process them on cloud premises. Security for the cloud premises is essential as the cloud has lot of outsourced, unprotected sensitive data for the public access. This has resulted repeated data violations, and thus there is a need for the advanced legal data protection constraints. Various studies were conducted to adopt the privacy preservation in the cloud, and most of the state-of-the-art techniques fail to handle the optimal privacy when dealing with sensitive data, as it requires separate data sanitization and restoration models. To overcome this challenge, this paper tempts to develop the privacy preservation model in the cloud environment using the advancements of artificial intelligent techniques. Artificial Intelligent capabilities are working in the business cloud computing environment to make organizations more efficient, strategic, and insight-driven. However, by hosting the data, cloud computing offers businesses high flexibility, agility, and cost savings. The two main phases of the proposed privacy preservation system are the data sanitization and restoration. Moreover, the proposed sanitization process depends on the optimal key generation, which is performed by the hybrid meta-heuristic algorithm. This hybrid algorithm merges two well-performed algorithms, such as Shark Smell Optimization (SSO) and Jaya Algorithm (JA), and thus termed as Jaya-based Shark Smell Optimization (J-SSO). The optimal key generation is accomplished by deriving a multi-objective function that involves the parameters, such as the degree of modification, hiding ratio, and information preservation ratio. Finally, the performance analysis has proved the efficiency of the proposed model over the state-of-the-art models in enhancing cloud security.

The aim of the article is to explore potential ways employers could use contact‐tracing apps and other monitoring technologies to mitigate the spread of COVID‐19 and potential concerns in the context of the EU GDPR (General Data Protection Regulation). The analysis indicates that, due to the imbalance of power in the employment relationship, national laws are needed to strengthen employees' ability to reject downloading contact‐tracing apps or similar monitoring technologies after the end of the COVID‐19 pandemic. When the need for such technological means for keeping employees safe has receded, additional regulations and guidance are necessary to prevent future problems, such as function creep, and similar misuse by employers.

With rapid growth in data volume generated from different industrial devices in IoT, the protection for sensitive and private data in data sharing has become crucial. At present, Federated Learning for data security has arisen, and it can solve the security concerns on data sharing by model sharing on Internet of mutual distrust. However, the hackers still launch attack aiming at the security vulnerabilities (e.g. model extraction attack and model reverse attack) in Federated Learning. To address the above problems, we first design an application model of blockchain-enabled Federated Learning in IIoT, and formulate our data protection aggregation scheme based on the above model. Then, we give the distributed K-means clustering based on differential privacy and homomorphic encryption, and the distributed Random Forest with differential privacy and the distributed AdaBoost with homomorphic encryption methods, which enable multiple data protection in data sharing and model sharing. Finally, we integrate the methods with blockchain and Federated Learning, and provide the complete security analysis. Extensive experimental results show that our aggregation scheme and working mechanism have the better performance in the selected indicators.

Identifying an unfamiliar caller's profession is important to protect citizens' personal safety and property. Owing to the limited data protection of various popular online services in some countries, such as taxi hailing and ordering takeouts, many users presently encounter an increasing number of phone calls from strangers. The situation may be aggravated when criminals pretend to be such service delivery staff, threatening the user individuals as well as the society. In addition, numerous people experience excessive digital marketing and fraudulent phone calls because of personal information leakage. However, previous works on malicious call detection only focused on binary classification, which does not work for the identification of multiple professions. We observed that web service requests issued from users' mobile phones may exhibit their applications preferences, spatial and temporal patterns, and other profession-related information. This offers researchers and engineers a hint to identify unfamiliar callers. In fact, some previous works already leveraged raw data from mobile phones (which includes sensitive information) for personality studies. However, accessing users' mobile phone raw data may violate the more and more strict private data protection policies and regulations (e.g., General Data Protection Regulation). We observe that appropriate statistical methods can offer an effective means to eliminate private information and preserve personal characteristics, thus enabling the identification of the types of mobile phone callers without privacy concerns. In this paper, we develop CPFinder —- a system that exploits privacy-preserving mobile data to automatically identify callers who are divided into four categories of users: taxi drivers, delivery and takeouts staffs, telemarketers and fraudsters, and normal users (other professions). Our evaluation over an anonymized dataset of 1,282 users with a period of 3 months in Shanghai City shows that the CPFinder can achieve accuracies of more than 75.0% and 92.4% for multiclass and binary classifications, respectively.

Where personal, usually pseudonymised, from health research or healthcare are made available for scientific purposes, especially across borders, it is unclear what GDPR roles apply. This is a persistent roadblock for accelerating data-driven scientific discovery or for establishing large research consortia. The assignment of GDPR roles is a matter of form and function (unless roles are assigned by law). A controller determines the purpose and essential means of processing. Essential means include determining the types of data, the categories of data subjects, the parties having access to data, and the length of data retention. Joint controllers arise where two or more parties jointly determine the purpose and essential means of processing through a common decision or converging decisions. We argue that a data user (research organisation) will normally be the sole controller for a research project accessing personal data, because the data user independently determines the purposes and means of the associated processing. A party that only provides data (hospital or research organisation) for the research project will not normally be a controller for the research project, unless it actively participates in the design of the research project or requires researchers to share ownership in derived intellectual property or enriched data. Data providers who require data users to remotely access data in a secure computing environment hosted by the data provider will generally be processors, not joint controllers.

The privacy paradox suggests that privacy concerns do not relate to privacy-related behavior. Although it has inspired numerous studies, findings remain inconclusive. Some of the inconsistencies in published findings may be explained by a strong heterogeneity in the conceptual and analytical choices that researchers implement when investigating the privacy paradox. Based on representative survey data of the 27 EU member states (2011: n = 8,962; 2015: n = 10,526; 2019: n = 11,428), I investigated the effect of conceptual and analytical decisions on ‘finding’ the privacy paradox. Specification curve analyses revealed that the magnitude and statistical significance of the relationship between privacy concerns and information disclosure is contingent on the operationalization of the independent variable, the inclusion of covariates, and the age of the studied population. The relationship between online privacy concerns and using social media privacy settings, in contrast, was less influenced by analytical decisions. Yet, the relationship was stronger in younger people and increased over time. The findings call for more transparency in analyzing research data. Evaluating the implications of analytical choices will help to establish best practices and advance cumulative knowledge creation in privacy research.

Recently, data-driven industrial monitoring systems have been rapidly developed and significantly improved the performance on industrial monitoring tasks. However, the widely deployed data-driven models expose industrial data to more unsecured links, increasing the safety risk of safe-critical industrial systems. The research about adversarial attacks has shown that the potential attackers can utilize tiny crafted perturbations on the input data to mislead the machine learning model outputs. In this paper, a novel cross-domain data protection scheme named Data Guardian is proposed to authenticate and correct industrial data under potential attacks on data-driven monitoring systems. Data Guardian embeds designed redundancy information into the data least significant bits (LSB), based on q-ary low density parity-codes (LDPC) over Galois field (finite field). The data is encoded at the secured industrial sites, then decoded before being input into the data-driven monitoring systems, where the security risk is usually higher. The decoding capability of q-ary LDPC codes is improved by the data statistical characteristics, with a new proposed prior estimation method. In the experiments, the Data Guardian is tested under the attacks to the fault diagnosis models on Tennessee Eastman process (TEP) and rolling element bearing (REB) from Case Western Reserve University. The results show that Data Guardian can efficiently reduce the success rate of adversarial attacks, especially when the attack variable ratio is small.

It is becoming fashionable for people to access data outsourced to clouds with mobile devices. To protect data security and privacy, attribute-based encryption (ABE) has been widely used in cloud storage systems. However, one of the main efficiency drawbacks of ABE is the high computation overheads at mobile devices during user revocation and file access. To address this issue, we propose a revocable attribute-based data storage (RADS) scheme equipped with several attracting features. First, our RADS scheme achieves a fine-grained access control mechanism, by which file owners do not need to explicitly specify authorized visitors to their outsourced files. Second, our RADS scheme allows mobile users to authorize the cloud service provider (CSP) to share costly computations in file access, without exposing the file content. Third, our RADS scheme offloads the operations of access-credential update and file re-encryption during revocation process to CSP, leaving all non-revoked users undisturbed. The revocation of RADS achieves a strong data protection, i.e., revoked users can access neither newly uploaded files nor old ones. The security and efficiency of the RADS scheme are validated via both analysis and experimental results.

Biometrics has nowadays become a preferred solution for systems requiring secure authentication. However, the usage of biometric characteristics raises significant concerns regarding personal data protection and privacy. Several template protection schemes have been therefore proposed to conceal the employed identifiers, while still ensuring the ability to efficiently recognise users. In this paper, we propose and analyse three different approaches generating cancelable templates from finger vein features. A thorough analysis of the considered methods is conducted to investigate their impact on the achievable recognition performance, as well as their security in terms of renewability and unlinkability. Furthermore, a specific attack is designed to evaluate the irreversibility of the protection scheme providing the best recognition performance.

Internet of Things (IoT) devices generate a high volume of data that is processed and stored in traditional cloud computing. The processing including data replication in traditional cloud computing often results in excessive resource utilization, performance overhead, and long response time. Fog computing has been proposed to overcome the shortcomings of cloud computing. Fog computing alleviates the processing and storage burden during data replication from the cloud to the network edge closer to sensor devices. Numerous data replica schemes in fog computing have been proposed to improve the performance efficiency of the data, reduce the turnaround delays of data access, and minimize network latency. However, these schemes do not consider data replication privacy, which is essential for data protection, reliability, and authentication. Therefore, this paper proposes a data replica creation scheme and a data replica placement scheme for preserving the privacy of data in fog computing. Our proposed replica creation scheme is based on a Level of Privacy (LoP) defined by data owners and the service capacity of fog nodes. Our proposed replica placement scheme is based on the priority level of fog nodes. We have conducted a comprehensive experimental analysis to compare the performance of our scheme and the existing schemes. Our results demonstrate that the proposed scheme can significantly achieve efficient replicas privacy, prediction accuracy, as well as outperform the existing state-of-the-art schemes in terms of computational and memory costs.

The Internet of things (IoT) has certainly become one of the hottest technology frameworks of the year. It is deep in many industries, affecting people's lives in all directions. The rapid development of the IoT technology accelerates the process of the era of ``Internet of everything'' but also changes the role of terminal equipment at the edge of the network. It has changed from a single data user to a dual role of both producing and using data. And collaborative edge computing (CEC) has been born in time. CEC itself can not only solve the problem of computing and storage but also combines with the deep learning (DL) model to make full use of edge computing ability. However, as the core of DL, the robustness of neural network is often not high. In addition, edge devices of CEC are facing a highly dynamic environment, which can easily cause the edge network to be attacked by malicious devices. Therefore, user privacy protection and security issues for CEC deserve more attention. To avoid privacy leakage and security crisis of CEC in social IoT systems, a data protection method based on data disturbance method and adversarial training viewpoint is introduced in this article. Besides, a new adversarial sample generation method based on the firefly algorithm (FA) is proposed. This method reduces the time complexity of traditional by an order for magnitude compared with traditional generative adversarial network (GAN) generation. Since sentences, information on CEC in the IoT system is characterized by a large amount of data, strict confidentiality, and high-security requirements, and they are usually high-risk information on privacy leakage. The proposed method is conducted to the sentence similarity analysis model based on a convolutional neural network (CNN) in the CEC scene to test the feasibility of the method. Compared with the original CNN, the accuracy of the model using the confrontation training method is improved by 4.8%. At the same time, the security value of our model is 2.1% higher than that of the simple CNN model, and it has the best security performance among the four comparison models. Further experiments have demonstrated that the model performs better in its capacity of resisting disturbance and can effectively help multiple organizations to implement data usage and sentence information on the requirements of user privacy protection, data security, and government regulations.

This paper analyzes consumers' privacy choice concerning their data and firms' ensuing pricing strategies. Consumers decide whether to reveal private information in form of cookies. We study this endogenous decision in a duopoly model with behavior-based pricing and conduct an experiment to test our theoretical predictions. Contrasting two data environments, we derive a unique pure-strategy pooling equilibrium for each environment. We find that all consumers share their data in an open data environment while no consumers share data in an exclusive environment. In the experiment, however, some subjects readily share their data in the exclusive treatment. In the open data treatment subjects predominantly act as predicted by our theory. A mandated data sharing policy among firms leads consumers to share more data and increases consumer welfare. This helps policy makers to make an informed decision about data protection policies.

This study introduces a descriptive analysis to carry out the transformation of the Dubai smart city as a case study in the GCC region with reference to the Barcelona smart city. Furthermore, to investigate how the Dubai smart city will deal with the huge amount of the collected personal data through Internet of Things devices and applications. The theoretical analysis shows that the Barcelona smart city can be represented as an effective model, its innovations recommends to be used in Dubai smart city. The analysis founds that the classification of the collected data inside smart city to open and shared data did not provide sufficient privacy for personal data. Therefore, the personal data should be classified explicitly in order to be processed separately under the rules of the data protection law.

The article analyzes the theoretical approaches that have developed in relation to the issues of control and freedom of the Internet space, including copyright regulation and its gradual transformation as the digital environment develops and changes. Special attention is given to the values underpinning the principles of regulation are determined. If initially the dominant notion was that the Internet would ensure humanity a new free world, then later the discourse shifted to much less optimistic views and topics the issue of network regulation, technical and legal restrictions, censorship and data protection. Most recent academic literature is devoted to the practical side of the issue, and the issue of values has faded into the background. As a result, the discussion has lost significant context: issues of freedom and human rights in the Internet environment, discussion of what is really important for society - security or the absence of restrictions, the problem of users trust in the state and platforms.

Emergence of Internet of Things (IoT) and modern digital applications such as digital financial services and deliveries make it easy to reproduce and re-distribute digital contents thus give room to so many copyright violations of illegal use of contents that need to be resolved. Researcher have been presenting the watermarking algorithms to prevent these illicit activities to a document before distribution. However, several issues have been identified for the digital transactions in the IoT. Thus, this research proposes a new text document image watermarking algorithm which emphasizes on two most important measures, visual quality, and robustness. To boost these measures, third least significant bit has been used for insertion. In addition, to further strengthen the technique, the Pascal Triangle is applied to determine the best position for embedding. Experimental results on the standard dataset have revealed that the proposed watermarking has achieved very encouraging results with PSNR and NCC averaged 54.95db and 0.98, respectively.

With the development of IoT devices, wearable devices are being used to record various types of information. Wearable IoT devices are attached to the user and can collect and transmit user data at all times along with a smartphone. In particular, sensitive information such as location information has an essential value in terms of privacy, and therefore some IoT devices implement data protection by introducing methods such as masking. However, masking can only protect privacy to a certain extent in logs having large numbers of recorded data. However, the effectiveness may decrease if we are linked with other information collected from within the device. Herein, a scenario-based case study on deanonymizing anonymized location information based on logs stored in wearable devices is described. As a result, we combined contextual and direct evidence from the collected information. It was possible to obtain the result in which the user could effectively identify the actual location. Through this study, not only can a deanonymized user location be identified but we can also confirm that cross-validation is possible even when dealing with modified GPS coordinates.

COVID-19 has presented unusual challenges for individuals, governments and societies across the globe. Several non-medical and non-pharmaceutical interventions have demonstrated to be critical in addressing the resultant impacts. One notable tool among these interventions is the application of technology in identifying infected persons or individuals coming into contact with those infected. Policy think-tanks have invested in geospatial technology and information systems to help resolve contact tracing inefficiencies to curtail the fast spread of the disease. This study highlights the extent of the application of geospatial technology in COVID-19 contact tracing in Ghana. Here, it was demonstrated that majority of young adults that form the greater part of Ghana’s population have access to digital devices which serve as primary catalysts in facilitating effective and efficient contact tracing. Case count of the pandemic continues to surge sharply from one month to the other since the first recorded case on March 12, 2020. A huge number of cases were recorded in the southern part of the country, as against cases recorded in the north. Mobility patterns depicted the migration of more people from regions with a high number of case count to regions with lower counts. We recommend a holistic and proactive approach to the use of smart mobile devices and applications in enhancing contact tracing. Privacy and data protection laws must be prioritized and supported by effective legislative and policy frameworks that serve as the legal basis for the management of personal information.

As digital technology and related data become more and more common, the lack of user data protection and personal privacy leakage become more serious. In the era of big data, platform corporate social responsibility is facing more challenges, and platform enterprises should pay more attention to corporate digital responsibility. This paper studies the research status and development trend of platform corporate social responsibility, especially corporate digital responsibility, under the background of digital transformation. The main content covers the implications of platform corporate social responsibility and the new challenges posed by digital change, differentiates corporate digital responsibility (CDR) from corporate social responsibility (CSR) to highlight their uniqueness, while also linking the two, and identifying key stakeholders and critical phases that CDR must address. That is technology and data creation, operation, impact assessment and refinement.

While the dawn of Artificial Intelligence (AI) solutions have aided in solving some of societal challenges, globalization and technological innovation potentially have the capability to disrupt, suspend, or change existing legal order, preventing the realization of business and human rights principles. For example, with AI-enabled systems, Africans can now access better healthcare, education, health, and transportation. However, AI has the potential to undermine human rights concerns. This article contextualizes the usage of AI systems and its implications for human rights violations. With particular reference to Africa, it gives an overarching context capable of constructing legal reactions to corporate related human rights violations. Some of the questions posed are: What are the ways human rights can be protected from exploitative tendencies of AI companies? How can African states, and businesses respond to regulatory challenges triggered by loss of work due to automation? What innovations and new methodologies are to be designed to engage with a sustainable and automated future? Finally, we propose reforms for corporate entities developing and deploying AI to respect human rights.

Advancements in artificial intelligence and Big Data allow for a range of goods and services to determine and respond to a consumer’s emotional state of mind. Considerable potential surrounds the technological ability to detect and respond to an individual’s emotions, yet such technology is also controversial and raises questions surrounding the legal protection of emotions. Despite their highly sensitive and private nature, this article highlights the inadequate protection of emotions in aspects of data protection and consumer protection law, arguing that the contribution by recent proposal for an Artificial Intelligence Act is not only unsuitable to overcome such deficits but does little to support the assertion that emotions are highly sensitive.

Over the last half-decade or so, since 2015, data privacy has become an important concern for organizations and consumers alike. Rules and regulations associated with data protection and privacy ha...

The intention of this position paper is to comment on the joint European Data Protection Supervisor (EDPS)‐Agencia Española de Protección de Datos (aepd) publication ‘14 Misunderstandings with regard to Biometric Identification and Authentication’ that was published in June 2020 and to provide additional input to help with the better understanding of the issues raised in that publication. In particular, it aims to highlight some important missing information in the aforementioned publication. It is hoped that this paper will help with any future revision of the EDPS‐aepd publication, such that it includes a full picture of the current state of the art in biometrics and the availability of standards and privacy enhancing techniques.

The paper focuses on the norms of Serbian Penal Code that incriminates personal data abuse. Starting with a brief overview of personal data legislation in Serbia, the author states that legal protection of data is guaranteed through constitutional (former federal and republic and the current Constitution) and provisions of Data Protection Law (three Laws were adopted and implemented since 1998), but also with criminal law norms. However, the quality and the implementation of mentioned criminal law provisions is questionable. The author analyses different crimes and notes that certain norms are incoherent with other relevant legislative provisions. The author points to incoherent provisions and provides recommendations de lege ferenda, concluding that legislative changes are needed in order to construct a solid legal framework for personal data protection in domestic Criminal law.

Ambient Assisted Living (AAL) technologies are being developed which could assist elderly people to live healthy and active lives. These technologies have been used to monitor people’s daily exercises, consumption of calories and sleep patterns, and to provide coaching interventions to foster positive behaviour. Speech and audio processing can be used to complement such AAL technologies to inform interventions for healthy ageing by analyzing speech data captured in the user’s home. However, collection of data in home settings presents challenges. One of the most pressing challenges concerns how to manage privacy and data protection. To address this issue, we proposed a low cost system for recording disguised speech signals which can protect user identity by using pitch shifting. The disguised speech so recorded can then be used for training machine learning models for affective behaviour monitoring. Affective behaviour could provide an indicator of the onset of mental health issues such as depression and cognitive impairment, and help develop clinical tools for automatically detecting and monitoring disease progression. In this article, acoustic features extracted from the non-disguised and disguised speech are evaluated in an affect recognition task using six different machine learning classification methods. The results of transfer learning from non-disguised to disguised speech are also demonstrated. We have identified sets of acoustic features which are not affected by the pitch shifting algorithm and also evaluated them in affect recognition. We found that, while the non-disguised speech signal gives the best Unweighted Average Recall (UAR) of 80.01%, the disguised speech signal only causes a slight degradation of performance, reaching 76.29%. The transfer learning from non-disguised to disguised speech results in a reduction of UAR (65.13%). However, feature selection improves the UAR (68.32%). This approach forms part of a large project which includes health and wellbeing monitoring and coaching.

An electronic toll collection (ETC) system is one of the most important parts of an intelligent transportation system (ITS), but existing ETC systems are not efficient and have vehicle fee evasion complications. Owing to the traceability and tamper resistance of a blockchain, the combination of a blockchain and ETC system is a feasible way to solve the above problems. However, traditional blockchain (e.g., Bitcoin and Ethereum) has high power consumption and low efficiency. Hence, it cannot be used in ETC systems with high throughput and is not suitable for power-constrained Internet of Things (IoT) devices. In this study, therefore, we propose a blockchain architecture for the ETC system. To curb vehicle fee evasion behavior, thereby reducing the economic loss caused, we propose a vehicle behavior management mechanism based on credit value. Furthermore, to reduce the burden of storage and build a chain of evidence for auditing purposes, we propose an evidence chain framework. To protect the data security in the transaction process, we designed a data protection method to encrypt the transaction data. Additionally, this system is based on an open-source alliance blockchain framework called Hyperledger Fabric, which is more in line with the current application scenarios of ETC systems. We implemented the system on a Raspberry Pi and carried out simulations. The comprehensive evaluation results and analysis show that the system effectively reduces the number of illegal acts, completes the evidence inspection, and improves the security of the data.

Purpose: The research aims to characterize newest soultions, especially with the respect to cybersecurity aspects of Business Intelligence analytics based on the processing of large sets of information with the use of sentiment analysis and Big Data. Design/Methodology/Approach: The working hypothesis refers to assumption that current regulations and security solutions for Business Intelligence analytics based on the processing of large sets of information with the use of sentiment analysis and Big Data is under extreme preassure to meet evergrowing challenges. There are more and more dends form the legal regulators as well as from the market and that creates a lot of problems with data protection. The article uses legal and comparative analysis as well as structural and functional analysis. Additionally, the interpretation method is also present. Findings: Article indicates that the aforementioned issues with the respect to growing importance of internet including the Internet of Things and Internet of Everything are becoming of more and more importance and cannot go with appropriate level of cybersecurity since the data they collect is of the great importance. The trends immanent to Industry 4.0 require from business more effort and customer orientation. Growing population and access to Internet demands larger scales of business operations. Practical Implications: As a result of conducting the research, it is possible to identify threats and present some recommendations for cybersecurity of Business Intelligence. Originality/Value: This is a complete research for Cybersecurity of Business Intelligence analytics based on the processing of large sets of information with the use of sentiment analysis and Big Data.

The Internet-of-Things (IoT) triggers data protection questions and new types of cyber risks. Cyber risk regulations for the IoT, however, are still in their infancy. This is concerning, because companies integrating IoT devices and services need to perform a self-assessment of its IoT cyber security posture. At present, there are no self-assessment methods for quantifying IoT cyber risk posture. It is considered that IoT represent a complex system with too many uncontrollable risk states for quantitative risk assessment. To enable quantitative risk assessment of uncontrollable risk states in complex and coupled IoT systems, a new epistemological equation is designed and tested though comparative and empirical analysis. The comparative analysis is conducted on national digital strategies, followed by an empirical analysis of cyber risk assessment approaches. The results from the analysis present the current and a target state for IoT systems, followed by a transformation roadmap, describing how IoT systems can achieve the target state with a new epistemological analysis model. The new epistemological analysis approach enables the assessment of uncontrollable risk states in complex IoT systems—which begin to resemble artificial intelligence—and can be used for a quantitative self-assessment of IoT cyber risk posture.

Zusammenfassung Hintergrund In Deutschland gibt es bisher keine Gesundheitsberichterstattung zu sektorenübergreifenden Versorgungsverläufen im Kontext einer Notaufnahmeversorgung. Das Projekt INDEED (Inanspruchnahme und sektorenübergreifende Versorgungsmuster von Patienten in Notfallversorgungsstrukturen in Deutschland) erhebt Routinedaten aus 16 Notaufnahmen, die mit ambulanten Abrechnungsdaten der Jahre 2014 bis 2017 personenbezogen zusammengeführt werden. Ziel der Arbeit Die methodischen Herausforderungen der Planung der internen Zusammenführung von klinischen und administrativen Routinedaten aus Notaufnahmen in Deutschland bis zur finalen Datenextraktion werden hier gemeinsam mit Lösungsansätzen dargestellt. Methodik Die Auswahl der Notaufnahmedaten erfolgte in einem iterativen Prozess unter Berücksichtigung der Forschungsfragen, medizinischen Relevanz und angenommenen Datenverfügbarkeit. Nach einer Vorbereitungsphase zur Klärung der Rahmenbedingungen (u. a. Datenschutz, Ethik), zur Prüfung von Testdaten und ggf. Korrekturen, erfolgte die verschlüsselte und pseudonyme Datenausleitung. Ergebnisse Die Daten der 16 kooperierenden Notaufnahmen stammten in der Regel aus dem Notaufnahme- und dem Krankenhausinformationssystem. Die Datenlage war sehr heterogen. Nicht alle Variablen waren in jeder Notaufnahme verfügbar, da sie beispielsweise nicht standardisiert und digital vorlagen oder der Extraktionsaufwand als zu hoch bewertet wurde. Schlussfolgerung Relevante Daten aus Notaufnahmen liegen unterschiedlich strukturiert und in mehreren IT-Systemen vor. Die notwendige Bildung eines klinikübergreifenden vergleichbaren Datensatzes erfordert erhebliche Ressourcen auf Seiten der Kliniken sowie der datenaufbereitenden Stelle. Dies muss für zukünftige Projekte großzügig kalkuliert werden.

With the increasing capability of software and hardware, mobile devices especially smartphones are changing the way of peoples’ communication and living styles. For the sake of convenience, people often store a lot of personal data like images on the device and use it for completing sensitive tasks like payment and financial transfer. This makes data protection more important on smartphones. To secure the device from unauthorized access, one simple and efficient method is to design a device or screen unlock mechanism, which can authenticate the identity of current user. However, most existing unlock schemes can be compromised if an attacker gets the correct pattern. In this work, we advocate that behavioral biometrics can be useful to improve the security of unlock mechanisms. We thus design DCUS, a double-click-based unlocking scheme on smartphones, which requires users to unlock the device by double clicking on the right location on an image. For user authentication, our scheme needs to check the selected images, image location and double-click patterns. In the evaluation, we perform a user study with 60 participants and make a comparison between our scheme and a similar unlock scheme. With several typical supervised classifiers, it is found that participants can perform well under our scheme.

The article is devoted to the individual’s right to privacy protection and the study of legal consolidation of the individual’s right to privacy of communication problems. Issues of respect for private life, generalized norms of procedural legislation of Ukraine and the European Court of Human Rights decisions on the admissibility of inter-ference by investigators in private life are studied there.The normative legal acts that regulate the procedure for obtaining the consent of an individual to the processing of his / her data are considered and researched there. On the basis of author’s conclusions the concerning improvement of the legislation in the field of data collection of physical persons - businessmen are substantiated. The article characterizes the basic principles of international legislation on the legal protection of information with limited access and foreign experience of its implementation. The positions of scientists on the protection of an individual’s personal life are analyzed. The positive novelties of the Law of Ukraine “On Personal Data Protection”, as well as the gaps in it are analyzed there. It was found that the consent of the personal data subject is the voluntary expression of the individual’ will (provided that the person is informed) to grant permission for the processing of his / her personal data in accordance with the stated purpose of its processing. The notion of unreliable information and the composition of the offense in the dissemination of such information are studied. Judicial practice is analyzed, in particular, the Supreme Court of Ukraine notes that the legal composition of the offense in the dissemination of inaccurate information is a set of circumstances such as dissemination of information, that is bringing it to the notice of at least one person in any way; the information disseminated relates to a specific individual or legal person, that is the plaintiff; dissemination of unreliable information. It is made generalizations of the experience formed in Ukraine and abroad concerning protection of individual’s private life. The conditions of application of refutation of unreliable information for protection of individual’s right to private life from the infringements which arise as a result of distribution of such information are studied there.

•Provisions in many data protection laws require a legal basis, or at the very least safeguards, for significant, solely automated decisions; Article 22 of the GDPR is the most notable. •Little attention has been paid to Article 22 in light of decision-making processes with multiple stages, potentially both manual and automated, and which together might impact upon decision subjects in different ways. •Using stylised examples grounded in real-world systems, we raise five distinct complications relating to interpreting Article 22 in the context of such multi-stage profiling systems. •These are: the potential for selective automation on subsets of data subjects despite generally adequate human input; the ambiguity around where to locate the decision itself; whether ‘significance’ should be interpreted in terms of any potential effects or only selectively in terms of realised effects; the potential for upstream automation processes to foreclose downstream outcomes despite human input; and that a focus on the final step may distract from the status and importance of upstream processes. •We argue that the nature of these challenges will make it difficult for courts or regulators to distil a set of clear, fair and consistent interpretations for many realistic contexts.

In the past two decades, the unprecedented incursion of technology into the economic and socio-cultural activities in Nigeria increasingly posed many unanswered questions on data protection and privacy. Consequently, this led to the country’s numerous attempts to enact a principal data protection legislation in addition to the existing sectoral laws on the subject.\ud \ud Despite its ratification of the Economic Community of West African States (ECOWAS) Supplementary Act on data protection in 2010, Nigeria carried on without a general data protection legislation until nine years later when the National Information Technology Development Agency (NITDA), in a face-saving regulatory move, issued the Nigeria Data Protection Regulation (NDPR) as Nigeria’s first all-encompassing and comprehensive, albeit subsidiary legislation on data protection.\ud \ud This article provides an analytical synopsis of Nigeria’s current legal framework on data protection touching its brief history, the general and sectoral enactments on data protection, the enforcement mechanism created under the NDPR as well as the Implementation Framework issued in the mould of guidance notes.

Purpose The purpose of this paper is two-fold: to explore the legal issue of the importance of personal data protection in the digital economy sector and to propose a legal framework for personal data protection as a consumer protection strategy and accelerate the digital economy. Design/methodology/approach This study is legal research. The research approach used was the comparative approach and statute approach. The legal materials used are all regulations regarding personal data protection that apply in Indonesia, Hong Kong and Malaysia. The technique of collecting legal materials is done by using library research techniques. Findings The value of Indonesia’s digital economy is the biggest in the Southeast Asia region, but data breach is still a big challenge to face. The Indonesian Consumers Foundation (Yayasan Lembaga Konsumen Indonesia) recorded 54 cases of a data breach in e-commerce, 27 cases in peer-to-peer lending and 5 cases in electronic money. Based on the results of a comparative study with Hong Kong and Malaysia, Indonesia has yet no specific Act that comprehensively regulates personal data protection. Indonesia also does not have a personal data protection commission. Criminal sanctions and civil claims related to data breaches have not yet been regulated. Research limitations/implications This study examines the data breach problem in the Indonesian digital economy sector. However, the legal construction of personal data protection regulations is built on the results of a comparative study with Hong Kong and Malaysia. Practical implications The results of this study can be useful for constructing the ideal regulation regarding the protection of personal data in the digital economy sector. Social implications The results of the recommendations in this study are expected to develop and strengthen the protection of personal data in the Indonesian digital economy sector. Besides aiming to prevent the misuse of personal data, the regulation aims to protect consumers and accelerate the growth of the digital economy. Originality/value Indonesia needs to create a personal data protection act. The act should at least cover such issues: personal data protection principles; types of personal data; management of personal data; mechanism of personal data protection and security; commission of personal data protection; transfers of personal data; resolution mechanism of personal data dispute and criminal sanctions and civil claims.

The problem of protecting personal data in medical institutions is currently very acute. The article discusses the main problems of personal data protection.

The COVID-19 crisis has exposed some of the most pressing challenges affecting healthcare and highlighted the benefits that robust integration of digital and AI technologies in the healthcare setting may bring. Although medical solutions based on AI are growing rapidly, regulatory issues and policy initiatives including ownership and control of data, data sharing, privacy protection, telemedicine, and accountability need to be carefully and continually addressed as AI research requires robust and ethical guidelines, demanding an update of the legal and regulatory framework all over the world. Several recently proposed regulatory frameworks provide a solid foundation but do not address a number of issues that may prevent algorithms from being fully trusted. A global effort is needed for an open, mature conversation about the best possible way to guard against and mitigate possible harms to realize the potential of AI across health systems in a respectful and ethical way. This conversation must include national and international policymakers, physicians, digital health and machine learning leaders from industry and academia. If this is done properly and in a timely fashion, the potential of AI in healthcare will be realized.

The fundamental right to confidentiality and integrity of IT systems was recognized by the Bundesverfassungsgericht (BVerfG) in Germany and responds to the growing need to recognize new rights that are able to properly protect the individual as new technologies continue to develop. In the said scenario, this paper will seek to answer the question: Starting from the premises set by the BVerfG in the ruling rendered on February 27th, 2008, are there similar grounds to sustain the existence of an IT Privacy right in Brazil, regarding the Brazilian juridical scenario, mainly as to data protection? To that end, the paper is divided into four main parts to: (i) assess the fundamentals of the decision rendered by the BVerfG in the case mentioned; (ii) present the privacy and data protection legal scenario in Brazil; (iii) point out how information security is provided for in Brazilian legislation; and (iv) validate whether the premises adopted by the BVerfG are also coherent in Brazil, considering the legal landscape presented. The research is based on a hypothetical-deductive method, through inquiry and bibliographic analysis, grounded both in Brazilian and European doctrine. Lastly, the research concludes in the sense that the Brazilian and German Constitutional Legal Orders are different, not only relating to the way in which new fundamental rights are acknowledged, but also in regard to the privacy and data protection legal culture, which directly impacts the feasibility of a fundamental right to confidentiality and integrity of IT systems.

The General Data Protection Regulation (GDPR) is, together with its seven principles, designed to function as the cornerstone of data protection in the European Union. Although the GDPR was meant to keep up with technological and socioeconomic changes while guaranteeing fundamental rights, its unclear wording with regard to the use of artificial intelligence (AI) systems has led to uncertainty. Therefore, the development and application of ever new AI systems raises various, as yet unresolved questions. Moreover, the complexity of legal requirements poses the risk of inhibiting AI innovation in the European Union. On the other hand, the GDPR gives Member States certain leeway to regulate data processing by public authorities. Therefore, data protection requirements for AI systems in public administration must be assessed under both the GDPR and national law. Against this backdrop, the article aims to guide the reader through the relevant data-protection rules applicable to AI systems in both the EU and in Estonia.

On 10 June 2021, the Data Security Law of the People’s Republic of China (hereinafter the “DSL”) was adopted at the 29th session of the Standing Committee of the 13th National People’s Congress, effective as of 1 September 2021. The DSL is the fundamental law in the data security sphere and, together with the Cybersecurity Law (hereinafter the “CSL”) and the Personal Information Protection Law (hereinafter the “PIPL”), outlines the data regulatory framework in China. The DSL contains seven chapters and 55 articles that widely cover data security mechanisms, obligations and liabilities at both State administration and data handler levels. In this article, the key contents of the DSL together with the intensively promulgated supplemental laws and regulations will be analyzed to provide a comprehensive grasp of data security supervision in China. Specifically, section one explains the basic concepts of the DSL, section two highlights the key data security protection mechanisms such as the Important Data protection and data cross-border transfer and section three will summarize the main compliance obligations for companies to effectively put laws into actions.

With the burgeoning technology, Malaysia has seen a staggering number of data breaches and data leaks within this past decade alone, with no signs of the trend decreasing. This has raised questions on whether the Personal Data Protection Act 2010 (PDPA) adequately protects the personal data of Malaysians. With the recent COVID-19 pandemic, data has been collected on a larger scale than before, with more frequent data leaks occurring. Hence, this study aims to analyse the adequacy of the PDPA by benchmarking it to the United Kingdom’s (UK) Data Protection Act 2018, which have seen a decrease in data breaches since the implementation of the new legislation. In this context, personal data refers to information processed or recorded that relates directly or indirectly to a data subject, who may be identified from the information and may include sensitive personal data. The study uses a doctrinal analysis methodology to best explore the ideas and concepts within the literature available regarding the protection of personal data. The study also employs a comparative analysis methodology by comparing the scope and application of Malaysian and UK legislation for benchmarking. The findings suggest that there are improvements to be made for the PDPA to be adequate.

The home is a site marked by the increasing collection and use of personal data, whether online or from connected devices. This trend is accompanied by new data protection regulation and the development of privacy enhancing technologies (PETs) that seek to enable individual control over the processing of personal data. However, a great deal of the data generated within the connected home is interpersonal in nature and cannot therefore be attributed to an individual. The cardboard box study adapts the technology probe approach to explore with potential end users the salience of a PET called the Databox and to understand the challenge of collaborative rather than individual data management in the home. The cardboard box study was designed as an ideation card game and conducted with 22 households distributed around the UK, providing us with 38 participants. Demographically, our participants were of varying ages and had a variety of occupational backgrounds and differing household situations. The study makes it perspicuous that privacy is not a ubiquitous concern within the home as a great deal of data is shared by default of people living together; that when privacy is occasioned it performs a distinct social function that is concerned with human security and the safety and integrity of people rather than devices and data; and that current ‘interdependent privacy’ solutions that seek to support collaborative data management are not well aligned with the ways access control is negotiated and managed within the home.