Data Protection - Science topic

Besnik Sulmataj I think the word "ethics" should be fundamentally removed from the discussion, because a binding code of ethics simply doesn't exist. In Germany, for example, you can now get into serious legal trouble if you refuse to hate certain ethnic groups with a passion and instead stand up for their rights. Depending on the issue, it will probably be no different in other countries.

Dear Dariusz Prokopowicz ,

Analytics have long been used for commercial purposes, where the return on investment is easier to see and justify. Now the ISF is urging business to use the same concepts to secure its networks. “Few organizations currently recognize the benefits for information security, yet many are already using data analytics to support their core business,” says Michael de Crespigny, CEO at ISF. “With the speed and complexity of the threat landscape constantly evolving and the prevalence of combined threats, organizations need to start moving away from being retrospective and reactive to being proactive and preventative.”

The digital age is awash in data. The amount of information organizations collect is growing exponentially, creating a vast data repository with immense potential. This data goldmine holds the key to not only understanding customers but also fortifying security.

Regards,

Shafagat

Yes, that's a quite emerging issue to address. Ethical AI building is as much necessary as much as building new AI model

Thanks Mfundiso Nongqwenga, "How AI Alters CRM Processes" it is my biggest concern. I will check with the best practices regarding the priorities for keeping the data protected at all the times. Thanks again!

For qualitative analysis, ATLAS.ti, MAXQDA, and NVivo now all incorporate generative AI to different degrees, so if you already have access to one of these, it should serve your purposes.

For quantitative analyses, I think contemporary AIs are likely to be less practical because they can only work with data that they have "seen" before. For example, ChatGPT cannot solve complex addition problems unless they are part of its "reference data set."

For transcription software suitable for research in Uganda, consider the following recommendations:

These tools can enhance transcription efficiency for research projects.

Satayu,

I am not sure which research area you are trying to connect to Abhinav Gupta. My guess based on your inquiry is Electrical Engineering or Computers and Information Technology. Not here, but I found two that are possible contacts for your topic???

Abhinav Gupta - Carnegie Mellon University

Abhinav Gupta - Biochemist/Machine Learning

Hope this helps???

The complexities of data protection legislation, such as the CCPA in the US and the GDPR in Europe, are critical to understanding when it comes to legal awareness in cyberspace. This entails understanding the rights of individuals with regard to their personal data, the responsibilities of organisations that handle such data, and the possible repercussions of non-compliance. Investigating the ways in which legal systems in various jurisdictions handle data protection issues might yield important information for improving legal awareness in cyberspace.

Hope this helps: https://privacyinternational.org/sites/default/files/2018-09/Data%20Protection%20COMPLETE.pdf

Here are simplified strategies for implementing AI in education while protecting minors' data:

Limit Data Collection: Only collect necessary data and avoid collecting personal information unless absolutely required.

Obtain Consent: Get permission from parents or guardians before collecting any data from minors.

Anonymise Data: Remove personal identifiers whenever possible to protect students' identities.

Encrypt Data: Use encryption to safeguard data both in transit and storage.

Access Control: Restrict access to data to only authorized individuals who need it for educational purposes.

Regular Checks: Conduct regular checks and assessments to ensure data protection measures are effective.

Transparency: Clearly communicate data protection policies to parents, students, and staff.

By following these simple steps, educational institutions can use AI responsibly while ensuring minors' data remains safe and secure.

Only two more weeks to go of data gathering 😎Thank you again for all for your help so far. However, we still need additional participation to make it up to the necessary sample-size/to successfully validate the research undertaken to date.

So, if you are working with the technical application of Data Protection (i.e., privacy, security, cybersecurity), governance, ethics, and compliance, then please take part in the anonymous questionnaire (https://lnkd.in/eXU9wmSD). Your contributions are appreciated, and fundamental in providing support to my research/framework development efforts. #GDPR, #iso27001, #privacy, #gdprcompliance, #datagovernance, #datasecurity, #cybersecurity,

Absolutely, there are ethical and privacy concerns with AI-augmented healthcare.

AI can process and analyze vast amounts of medical data, which is great for diagnosis and treatment. But, it also raises questions about data privacy. Patients' health information must be protected from breaches or misuse.

Then there's the issue of bias in AI algorithms. If the data used to train AI models isn't diverse, it can lead to biased recommendations or diagnoses, which isn't fair or ethical.

So, while AI has incredible potential in healthcare, it's essential to ensure patient privacy, fairness, and ethical use of AI to make it a win-win for everyone.

For your master's degree dissertation in cybersecurity, with a focus on Access Control Management and Data Protection, here are some compelling topic ideas: First, consider exploring Advanced Access Control Models in Cloud Computing. This area involves developing or assessing innovative access control mechanisms suited for cloud environments, addressing the unique security challenges of cloud-based data. Another intriguing topic is the application of Blockchain Technology in enhancing secure access control systems. Investigating how blockchain's inherent features can revolutionize access management offers a rich research avenue. Additionally, the integration of Machine Learning for Predictive Access Control presents an opportunity to design systems that adaptively modify access rights based on behavioral analysis and threat prediction. The specific challenges of IoT Security and Access Control also make for an important study, focusing on developing scalable and efficient solutions for the diverse IoT landscape. Lastly, analyzing the interplay between Data Protection Laws and Access Control Compliance could provide valuable insights into aligning organizational policies with legal requirements while safeguarding sensitive data. Each of these topics not only aligns with your interest but also contributes significantly to the evolving field of cybersecurity.

In the realm of intelligent transportation systems (ITS), cybersecurity plays a crucial role, primarily due to the extensive reliance on technology for traffic management, vehicle communication, and data handling.

Key discussion points include Data Protection and Privacy, where the focus lies on safeguarding the vast amount of personal data collected by ITS. Techniques like encryption and anonymization are essential, alongside ensuring compliance with data protection laws like GDPR.

Preventing Unauthorized Access is another vital aspect, emphasizing the need for robust authentication protocols. It also explores the potential of blockchain for secure, decentralized communication in ITS networks.

The third significant point, Protection Against Cyber Attacks, delves into ITS's susceptibility to various cyber threats such as hacking and malware. This involves deploying advanced intrusion detection systems, conducting regular security audits, and establishing a rapid response framework to effectively mitigate such threats.

Overall, this discussion underscores the evolving nature of cyber threats and the imperative for continuous advancement in cybersecurity strategies to safeguard these essential systems.

In this regard, the IT Act also prescribes criminal penalties that include both imprisonment of up to three years and fines for persons that disclose personal information without the consent of the person to whom the data relates, where such disclosure is in breach of a contract or results in wrongful loss or gain.

I know it's hard. I will not share my data either. I think forget about these people and produce your own data, but copywrite it 100% :)

Another non-traditional approach would be the use of Block-Chain tech, but it would not qualify under the standards you mentioned. Could be an elegant solution to the problem though.

Is there a specific view of security you are thinking of, or is this just a wide and general question?

Thinking of security with respect to network/cyber attacks, then Electroni Health Records simply inherit the same deep learning techniques that can be applied to any networked systems/applications (perhaps with some diffeent 'value' calclulations as to the monetary expression of the damage done in such an attack).

If this question is about privacy concerns and data use - who has access to and whwo uses your data, then mostly the access controlls and logging of data access are within the EHR applications themselves (EHR, personal health record or any system/application that looks after health information).

The are also in some networked environments with multiple actors, there are audit logs that can be inspected (the IHE ATNA being an example). I know of a few real world examples (but with no accademic publications) where such logs were inspected and the evidence of un-authorised access (or miss use of authorised access) was proven. Since this activity is looking for patterns in a log file (or set of log files with some correlation) then this looks to me exactly like the kind of problem that deeo learning could be applied to. Note "who" is looking at "what" data implies you need to know the identities of the "who" in a real world context that would confirm or deny that they are allowed to look at "whatever-it-is".

In private healthcare based economies, your insurance premiums are based on your declared health. Health insurance companies may use deep learning tools in analysis of their customers health records - but this is ouutside of my experience and it is of course linked to the legality of doing this (which I am surer varies from country to country).

Effectively though, this kind of deep learning would ook like a specialisation of the kind of deep learning applied to fraud (specialised for healthcare insurance premiums and delcarations).

I am sure there are other areras. Computer architecture that results in multiple copies of healthcare data items and records leads to ambiguity in records - where is the source of truth. You can see how in the above fraud example any ambiguity might lead to loopholes for fraudulent activity or put a consumer in a position where they find it difficult to prove their health records. I am not sure if deep learning would be applicable here, when inspection of the architeture would tell you about this potential-duplicates problem.

Your question seems quite wide, I hope my contribution is useful for you and I haven't missed the poiont of your question.

Laws will definitely govern the life cycle, as you put it, of any data collected. Needless to say, different jurisdictions/countries will have their own respective laws on the matter. One concept of relatively recent development in "destroying" data collected is the "right to be forgotten."

@Erdem Erkoyun, you could also use median number as a replacement of missing numbers and rerun the model.

This link maybe useful

"Hands-on with Feature Engineering Techniques: Imputing Missing Values | by Younes Charfaoui | Heartbeat" https://heartbeat.comet.ml/hands-on-with-feature-engineering-techniques-imputing-missing-values-6c22b49d4060

Hi, I am looking for participants for the study if you are able to take part? x

Dear Mr. Sekulovic!

You pointed to an important issue. There might be a need for studies depicting the context and impact of this regulation package:

1) Karen Yeung, Lee A. Bygrave (2021). Demystifying the modernized European data protection regime: Cross-disciplinary insights from legal and regulatory governance scholarship, Regulation & Governance Early View, 04 May 2021, Open access:

2) Hallinan D. (2021) Biobank Oversight and Sanctions Under the General Data Protection Regulation. In: Slokenberga S., Tzortzatou O., Reichel J. (eds) GDPR and Biobanking. Law, Governance and Technology Series, vol 43. Springer, Cham. https://doi.org/10.1007/978-3-030-49388-2_8 Available at:

3) Ilse Heine (2021). 3 Years Later: An Analysis of GDPR Enforcement, Center for Strategic & International Studies, Sept., 13, 2021, Free access: https://www.csis.org/blogs/strategic-technologies-blog/3-years-later-analysis-gdpr-enforcement

Yours sincerely, Bulcsu Szekely

Your question is very interesting, thank you for taking me into account

As a runner, user of Garmin and Strava, and someone who has dabbled in the analytics space, I think that this is a really interesting question. First, Kaggle has a number of data sets on marathon prediction and some kernels that attempt to solve that problem. You can find them with this query:

Second, getting data from Strava would be more challenging. While the have an API you can use with athletes' permission described here:

they have a ToS prohibiting doing analytics on their data:

I suggest asking their developer forum to see how to get permissions for doing analytics.

Third and last, I found this fitness database called fitabase that is de-identified. Never used it, but thought I would mention it is there:

send details " inbox"

Interesting question for sure. There is a semantic difficulty since "paying" somewhat presuppose a financial transaction with money. While data is certainly something that worth money, it requires quite a lot of intermediate steps to do so.

Any basic website collects automatically lot of data (connection logs, information on browser and location, sessions...). To distinguish data collected as payment from data collected not as payment might not be very easy (you would need to carefully examine the use of data in many steps).

It's definitely tricky, as you have two opposing principles:

1) What happens on the blockchain, stays on the blockchain

2) The GDPR "right to be forgotten"

This implies that you can certainly never place any form of personal information on a blockchain, but only links to or hashes of such information. However, this in turn breaks another principle, namely that you should never sign something you don't know the content of. What happend if the information that is pointed to changes? Is it possible to perform a birthday attack on the hash by preparing two different messages with the same hash?

Whether the blockchain is permissioned or not does not make any difference regarding Art. 16 and 17 GDPR. As long as the blockchain has the standard functionality that you cannot modify any data once they have been included in the blockchain, you can by definition not satisfy the requirements regarding correction or erasure.

A workaround is that the personal data are stored within the blockchain, but the blockchain only contains a link to the personal data. Then you cannot modify the link but you can modify the data itself since they are outside the blockchain.

I have sent the survey to some colleagues and encouraged their participation.

On another note my work has focused on global citizenship education and competence, as well as diversity, equity, and inclusion. I find that this Covid-19 issue has highlighted the continued need to develop Global Citizenship Education program, as well as global citizenship competencies in today's students. There have been numerous examples from around the world (and so many in the US) of people ignoring the well being of their families and communities in order to go to Spring Break, go to a ski resort, or have 1 last party before leaving campus. In each of these cases participants got sick and brought this home to their loved ones and their community. This has led to increases in the spread of the virus, which has directly led to an increase in the number of deaths.

If anything this pandemic has showed that unchecked globalization, without the global citizenship competencies needed to balance it, is dangerous to us all, and a silver lining would be an increase in the promotion of these competencies across higher education institutions.

I would like to discuss this with you and see if we can collaborate on some future research. I will email you.

Agree with Ralf's views on this. Universities can look at industry linked programs in Risk and Compliance space and privacy can be covered under that.

Dear Mr. Giulio di Lernia

Thank you very much for a comprehensive and helpful answer! I myself am an Information Security Manager, and also an Operational Risk Manager in my institution and I am pretty much familiar with your experiences. So I think, definitely, a lawyer and an infosec manager should make a DPO team. Lawyers know the legislation and infosec managers know standards and data protection side of the story. It's like two sides of the same coin, both necessary for a good privacy management.

Dear Mr. Thank you very much for good wishes! All the best to you too in the coming year!

Best Regards,

Rajko Sekulović

This is a great question, and inspired to me to look for some quantification of the risk and probability of data breaches and harm. Found the following reports which may be of interest. They are largely from security companies and insurance companies, which would have access to this kind of data and might need data like that to set insurance policies.

Japan changed its legislation in order to get an adequacy decision from the European Commission and South Korea is in the way to do the same. There is a clear convergence trend from some countries who aspire to have a free flow of personal data with the EU. In my opinion, the EC rushed with the Japanese decision which should had set an example as it was the first after the application of the GDPR started to be applicable but the EU wanted to apply it in parallel with the EU/Japan trade agreement so it could not wait any more. I am finishing a paper on the topic if you want to check the draft you can send me a message.

Hard to find the data on the Internet.

Ecosystem service approach is still not used properly, but hopefully some rough estimates exist. Perhaps Robertina Brajanoska can help.

Visitors don't pay for entrance yet, so that income is 0.

Recently a summary of different fines was published at https://dataagenda.de/wp-content/uploads/2019/05/DataAgenda-Arbeitspapier-06_DS-GVO-Bu%C3%9Fgelder.pdf

The report is in German but it covers other EU countries as well.

Please read my papers below for my take on the GDPR's impact on non-EU businesses, in particular on the controversial topics of extraterritorial applicability and cross-border data transfer:

I have set out some analyses of the GDPR from the perspective of non-EU businesses, in the following research pieces, feel free to have a read:

For me, a part of this kind of information can be used for scientific research, under the context of the question. Of course, scrutiny is necessary.

Regards

Dear Ekaterina, I enclose a copy of the Baker McKenzie report titled, GDPR National Legislation Survey issued in January 2018 and it covers a number of your queries.

GPDR can be considered in many aspects.

For small organizations, this will involve many new responsibilities. It will also affect honest and high standards - as there will be a need to document compliance with these standards, while it has been sufficient to comply with them so far.

Larger organizations are likely to feel less because they are more formalized and bureaucratic anyway.

There will be fear of penalties, which may limit some activities. While most probably agree that abuses and uncontrolled trade in personal data should be limited, the problem of borderline events, taken in good faith, will also appear, which, however, can also be interpreted as abuse and transgression.

Will this improve the protection of the right to privacy? It really depends on people and their awareness. The last affair with Facebook showed how easy private data can be used, but on the other hand people should be able to count on such a situation by sharing their data on the Internet. No regulation can replace reason and caution.

Will it affect learning and information flow? I do not think so much. If these regulations were in force many years ago, today we would probably know that the AIDS patient traveled a lot and was homosexual - because they influenced the way the disease spread and that it affected homosexuals in the first place, but we would not know the name this patient, which does not matter to understand the mechanism of disease spread.

I work in data recovery. This is a very sensitive area when it comes to confidentiality and data security. If someone entrusts me with his medium, he expects that the data I will recover will not be disclosed to anyone else or to a jealous wife or police - if I suspect that they may be evidence of a crime. On the other hand, if the client is, for example, the Police, it is not my role to protect someone's intimate secrets that concern legal but very personal matters.

Usually I do not analyze the contents of the media, unless I am explicitly asked for it, so I do not even know about many ethically doubtful situations. However, over the years I have seen something like this several times that I had serious doubts as to how to proceed. Always prevailed loyalty to the client. He is the owner of the data and he is responsible for their use.

Thank you very much and all the best with the project,

Dilyana

This is a really good question, and the general issue has recently come up in my work. I looked around for studies, and found a couple of analysis of its effects. They seem to point out that there is an exception for "research," but the definition of "research" can vary by EU member state. Anonymization is said to help with the restriction, but pseudo anonymization, where data can be re-identified, has particular issues. Here are links I saw that may be helpful:

 I'm tempted to say "let's wait and see", but I suspect that the GDPR may end up being just so much smoke - everyone is currently in a frenzy, worrying about the 4% of global turnover fines, but will they actually ever be levied? Or will we just see the customary wrist-slapping from the respective DPAs?

Here is an article discussing the privacy laws between the EU and the US: 

As for the determination of the best country, it will depend on your preset determining factors.

Very kind of you Bob. I will read it with interest.

Thank you.

Eoin

Dear Arthur, you might consider what he says to his profession. Everything should be monetized.

Then sencibilidade a document is directly linked to the value that it has, or projuízo would cause if disclosed.

In my profile you will find many articles on privacy and data loss and data leakage.

Estou em Campinas caso precise.

I assume you are referring to web app security assessment.

Try starting with http://www.openvas.org/ http://sqlmap.org/ and http://sectools.org/tool/nikto/. 

The evaluation of any security devices is in fact an evaluation of security algorithms and security implemented protocols. However, the evaluation in not mainly related to Devices. For example we evaluate AES or RSA cipher algorithms regardless they are implemented in smart card or in a router. 

can i use weka for data anonymization.Please explainme

Authentication User’s Privacy: An Integrating Location Privacy Protection Algorithm for Secure Moving Objects in Location Based Services

read this paper also related reference it will help you .

The first issue with any public-use file (open data) is providing a file that allows reproduction of 1-2 (but hopefully more) analyses that might be performed the the original, non-public file prior to the 'masking' of certain fields to prevent re-identification. If the file has valid analytic properties, then the data producer should (attempt to) justify that re-identification of a small proportion of individuals is exceptionally difficult or impossible.

 This has been an open area of research for 35+ years. Do a bunch of tabulations (queries) with the underlying microdata in a manner so that individuals cannot reconstruct the underlying microdata from the tabulations (even when noise (epsilon) is added in a suitable manner). At one point, major database groups and IBM concluded that it was an impossible problem (even after millions in dollars of NSF support).

 In the mid 1990s, Latanya Sweeney (then a CS Ph.D. student at MIT, now a Harvard professor) took an 'anonymized' set of health data from Massachusetts State employees and showed how to re-identify most of them using a Massachusetts voter registration database. The health data had been anonymized by removing individual's names, SSNs, heath insurance IDs, doctor's names, hospital names and just about any other identifiers that individuals could think of. For analytic purposes, ZIP codes, sex, and date-of-birth were left in the file and these fields were used to re-identify more than 70% of the individuals in the file, including the Governor.

 In 2003 Dinur and Nissim provided methods with rigorous guarantees on the privacy.

Dinur, I., and Nissim, K. (2003), “Revealing Information while Preserving Privacy,” ACM PODS Conference, 202-210.

Much of the work in recent years has been on improving analytic properties.

Dwork, C. (2008), “Differential Privacy: A Survey of Results,” in (M. Agrawal et al., eds.) TAMC 2008, LNCS 4978, 1-19.

Barak, B., Chaudhuri, K., Dwork, C., Kale, S., McSherry, F., and Talwar, K. (2007), “Privacy, Accuracy, and Consistency Too: A Holistic Solution to Contingency Table Release,” PODS ’07, Beijing, China.

Hardt, M,, Ligget, K., and McSherry, F. A (2010), A simple and practical algorithm for differentially private data release, available at http://arxiv.org/abs/1012.4763 .

Over the last seven years, the American Statistical Association has had three invited paper sessions at their Annual Meeting on differential privacy. Different groups would like to provide 'protected' microdata with guarantees on privacy and on valid analytic properties.

The answer is that there are presently no systematic methods of both assuring analytic properties and privacy. As long as your original data are suitably clean (this is not always assured in many databases), then your tabulations should be valid. Unfortunately, there are very sophisticated methods of working backwards from the tabulations to subsets of the microdata. Look at the following for improved methods of working backwards from the tabulations to the microdata.

Dwork, C. and Yekhanin, S. (2008), “New Efficient Attacks on Statistical Disclosure Control Mechanisms,” Advances in Cryptology—CRYPTO 2008, to appear, also at http://research.microsoft.com/research/sv/DatabasePrivacy/dy08.pdf .

Many CS and other researchers have shown how to re-identify with seemingly innocuous files.  The used public-use IMDB information to re-identify individuals in the Netflix public-use that Netflix subsequently took down.

Narayanan, A. and Shmatikov, V. (2008), Robust De-anonymization of Large Sparse Datasets, Proceedings of the 2008 IEEE Symposium on Security and Privacy, 111-125.

This paper perhaps does not respond to your question but is a good overview of the efforts to come to common ground and to identify the minimum standards between US-EU privacy law 

these are reference articles which discussed about data leakage protection and model, hopefully can help you.

I also agree with Lazaridis, Ngafeeson and Aghatise. Simulated data is possible, and results based on them even publishable, as long as it refers to simulation. Its connection to real clinical outputs, however, remains doubtful, precisely because it is based on a simulation.

Gracias Fabio! I'll take a look (although I doubt that most workers know whether their employers are registered or pay taxes...)

The challenges of data protection/security in an organization include:

-Availability of trained staff (from user to administrator)

-Regular training of master trainers as new threats are always growing

-Bringing all machines on the network 

-Disabling USB data storage devices

-Controlled access to internet

-SAN for data storage and archiving

-Effective group policies

-Regular updating/upgrading of OS

-Installation of antivirus software and its regular updating

-Legal support / supporting policies/Laws

-& physical security as an additional protection layer

Data protection is bigger picture and can be see as institutional issue where as  data security is an organizational matter and it deals more with technicalities or implementation of data protection policies. 

I can understand the opposite: unencrypted data being classified as encrypted. This can happen if data is compressed, thus increasing the entropy to the max limit (at least should). One thing that might help is to first identify the encoding of the source (e.g., raw or base64 encoded, quoted_printable, ...) Once this is know, the limit of entropy is also identified. Another practical issue, is to skip the initial blocks of the source file (e.g., the header info of a zip file will have low entropy, but actual encrypted content afterwards will be as random as they should).

I have done research and published on spatial position and movement in groups

as non-verbal behavior. There is some evidence that controlling for cultural definitions of permitted spatial closeness, those who infringe such boundaries and or, who move around a lot in a stable group such as a classroom, business or military group (after four sessions) are possibly alien to or uncomfortable with the group. There is also a difference depending on seat position, in dominant and minority group status, possible detection of pro or con attitudes toward authority or peers in the group. Experiments on spatial distance from others controlling for culture maybe class, might indicate emotional disturbance. Marking territory and defense of territory in invasion experiments also identifies dominants and "strangers" in the group. I would like to do more research on this topic that could benefit the field, also business and security, but would want to be recompensed. Also, many other nonverbal behaviors indicate cultural, class and other origins. Gilda Haber, PhD

Confidentiality assumes full protection of any information relating to a person. Data protection legislation intended to ensure the integrity of the exclusive list of personal information about a person who strictly listed in a specific legislative act.

hi ahmed. You can search for provable data possession for cloud data integrity.

This topic is of high-interest at OHRP right now and at every conference I've been to where a representative from OHRP is present, this issue is addressed by referring back to http://www.hhs.gov/ohrp/policy/reposit.html and specifically the guidance at http://www.hhs.gov/ohrp/policy/cdebiol.html. OHRP views personally identifiable private information stored as data synonymous with tissue samples, even if it's coded but could possibly be linked to specific individuals by the investigator(s) either directly or indirectly through a key (available to the investigator). There are exceptions spelled out in the guidance so take a close look to see if your project meets one of the exclusions.