Data Protection - Science topic

Is there a specific view of security you are thinking of, or is this just a wide and general question?

Thinking of security with respect to network/cyber attacks, then Electroni Health Records simply inherit the same deep learning techniques that can be applied to any networked systems/applications (perhaps with some diffeent 'value' calclulations as to the monetary expression of the damage done in such an attack).

If this question is about privacy concerns and data use - who has access to and whwo uses your data, then mostly the access controlls and logging of data access are within the EHR applications themselves (EHR, personal health record or any system/application that looks after health information).

The are also in some networked environments with multiple actors, there are audit logs that can be inspected (the IHE ATNA being an example). I know of a few real world examples (but with no accademic publications) where such logs were inspected and the evidence of un-authorised access (or miss use of authorised access) was proven. Since this activity is looking for patterns in a log file (or set of log files with some correlation) then this looks to me exactly like the kind of problem that deeo learning could be applied to. Note "who" is looking at "what" data implies you need to know the identities of the "who" in a real world context that would confirm or deny that they are allowed to look at "whatever-it-is".

In private healthcare based economies, your insurance premiums are based on your declared health. Health insurance companies may use deep learning tools in analysis of their customers health records - but this is ouutside of my experience and it is of course linked to the legality of doing this (which I am surer varies from country to country).

Effectively though, this kind of deep learning would ook like a specialisation of the kind of deep learning applied to fraud (specialised for healthcare insurance premiums and delcarations).

I am sure there are other areras. Computer architecture that results in multiple copies of healthcare data items and records leads to ambiguity in records - where is the source of truth. You can see how in the above fraud example any ambiguity might lead to loopholes for fraudulent activity or put a consumer in a position where they find it difficult to prove their health records. I am not sure if deep learning would be applicable here, when inspection of the architeture would tell you about this potential-duplicates problem.

Your question seems quite wide, I hope my contribution is useful for you and I haven't missed the poiont of your question.

Laws will definitely govern the life cycle, as you put it, of any data collected. Needless to say, different jurisdictions/countries will have their own respective laws on the matter. One concept of relatively recent development in "destroying" data collected is the "right to be forgotten."

@Erdem Erkoyun, you could also use median number as a replacement of missing numbers and rerun the model.

This link maybe useful

"Hands-on with Feature Engineering Techniques: Imputing Missing Values | by Younes Charfaoui | Heartbeat" https://heartbeat.comet.ml/hands-on-with-feature-engineering-techniques-imputing-missing-values-6c22b49d4060

Hi, I am looking for participants for the study if you are able to take part? x

Dear Mr. Sekulovic!

You pointed to an important issue. There might be a need for studies depicting the context and impact of this regulation package:

1) Karen Yeung, Lee A. Bygrave (2021). Demystifying the modernized European data protection regime: Cross-disciplinary insights from legal and regulatory governance scholarship, Regulation & Governance Early View, 04 May 2021, Open access:

2) Hallinan D. (2021) Biobank Oversight and Sanctions Under the General Data Protection Regulation. In: Slokenberga S., Tzortzatou O., Reichel J. (eds) GDPR and Biobanking. Law, Governance and Technology Series, vol 43. Springer, Cham. https://doi.org/10.1007/978-3-030-49388-2_8 Available at:

3) Ilse Heine (2021). 3 Years Later: An Analysis of GDPR Enforcement, Center for Strategic & International Studies, Sept., 13, 2021, Free access: https://www.csis.org/blogs/strategic-technologies-blog/3-years-later-analysis-gdpr-enforcement

Yours sincerely, Bulcsu Szekely

Your question is very interesting, thank you for taking me into account

As a runner, user of Garmin and Strava, and someone who has dabbled in the analytics space, I think that this is a really interesting question. First, Kaggle has a number of data sets on marathon prediction and some kernels that attempt to solve that problem. You can find them with this query:

Second, getting data from Strava would be more challenging. While the have an API you can use with athletes' permission described here:

they have a ToS prohibiting doing analytics on their data:

I suggest asking their developer forum to see how to get permissions for doing analytics.

Third and last, I found this fitness database called fitabase that is de-identified. Never used it, but thought I would mention it is there:

send details " inbox"

Interesting question for sure. There is a semantic difficulty since "paying" somewhat presuppose a financial transaction with money. While data is certainly something that worth money, it requires quite a lot of intermediate steps to do so.

Any basic website collects automatically lot of data (connection logs, information on browser and location, sessions...). To distinguish data collected as payment from data collected not as payment might not be very easy (you would need to carefully examine the use of data in many steps).

It's definitely tricky, as you have two opposing principles:

1) What happens on the blockchain, stays on the blockchain

2) The GDPR "right to be forgotten"

This implies that you can certainly never place any form of personal information on a blockchain, but only links to or hashes of such information. However, this in turn breaks another principle, namely that you should never sign something you don't know the content of. What happend if the information that is pointed to changes? Is it possible to perform a birthday attack on the hash by preparing two different messages with the same hash?

Thank you for this post

Whether the blockchain is permissioned or not does not make any difference regarding Art. 16 and 17 GDPR. As long as the blockchain has the standard functionality that you cannot modify any data once they have been included in the blockchain, you can by definition not satisfy the requirements regarding correction or erasure.

A workaround is that the personal data are stored within the blockchain, but the blockchain only contains a link to the personal data. Then you cannot modify the link but you can modify the data itself since they are outside the blockchain.

I have sent the survey to some colleagues and encouraged their participation.

On another note my work has focused on global citizenship education and competence, as well as diversity, equity, and inclusion. I find that this Covid-19 issue has highlighted the continued need to develop Global Citizenship Education program, as well as global citizenship competencies in today's students. There have been numerous examples from around the world (and so many in the US) of people ignoring the well being of their families and communities in order to go to Spring Break, go to a ski resort, or have 1 last party before leaving campus. In each of these cases participants got sick and brought this home to their loved ones and their community. This has led to increases in the spread of the virus, which has directly led to an increase in the number of deaths.

If anything this pandemic has showed that unchecked globalization, without the global citizenship competencies needed to balance it, is dangerous to us all, and a silver lining would be an increase in the promotion of these competencies across higher education institutions.

I would like to discuss this with you and see if we can collaborate on some future research. I will email you.

Agree with Ralf's views on this. Universities can look at industry linked programs in Risk and Compliance space and privacy can be covered under that.

Dear Mr. Giulio di Lernia

Thank you very much for a comprehensive and helpful answer! I myself am an Information Security Manager, and also an Operational Risk Manager in my institution and I am pretty much familiar with your experiences. So I think, definitely, a lawyer and an infosec manager should make a DPO team. Lawyers know the legislation and infosec managers know standards and data protection side of the story. It's like two sides of the same coin, both necessary for a good privacy management.

Dear Mr. Thank you very much for good wishes! All the best to you too in the coming year!

Best Regards,

Rajko Sekulović

This is a great question, and inspired to me to look for some quantification of the risk and probability of data breaches and harm. Found the following reports which may be of interest. They are largely from security companies and insurance companies, which would have access to this kind of data and might need data like that to set insurance policies.

Japan changed its legislation in order to get an adequacy decision from the European Commission and South Korea is in the way to do the same. There is a clear convergence trend from some countries who aspire to have a free flow of personal data with the EU. In my opinion, the EC rushed with the Japanese decision which should had set an example as it was the first after the application of the GDPR started to be applicable but the EU wanted to apply it in parallel with the EU/Japan trade agreement so it could not wait any more. I am finishing a paper on the topic if you want to check the draft you can send me a message.

Hard to find the data on the Internet.

Ecosystem service approach is still not used properly, but hopefully some rough estimates exist. Perhaps Robertina Brajanoska can help.

Visitors don't pay for entrance yet, so that income is 0.

Recently a summary of different fines was published at https://dataagenda.de/wp-content/uploads/2019/05/DataAgenda-Arbeitspapier-06_DS-GVO-Bu%C3%9Fgelder.pdf

The report is in German but it covers other EU countries as well.

Please read my papers below for my take on the GDPR's impact on non-EU businesses, in particular on the controversial topics of extraterritorial applicability and cross-border data transfer:

I have set out some analyses of the GDPR from the perspective of non-EU businesses, in the following research pieces, feel free to have a read:

I agree they can be used as material for a research. As said above, by some researchs, the context, the purposes, the methods used are important to consider this as material to study some issue from a scientific point of view.

Dear Ekaterina, I enclose a copy of the Baker McKenzie report titled, GDPR National Legislation Survey issued in January 2018 and it covers a number of your queries.

GPDR can be considered in many aspects.

For small organizations, this will involve many new responsibilities. It will also affect honest and high standards - as there will be a need to document compliance with these standards, while it has been sufficient to comply with them so far.

Larger organizations are likely to feel less because they are more formalized and bureaucratic anyway.

There will be fear of penalties, which may limit some activities. While most probably agree that abuses and uncontrolled trade in personal data should be limited, the problem of borderline events, taken in good faith, will also appear, which, however, can also be interpreted as abuse and transgression.

Will this improve the protection of the right to privacy? It really depends on people and their awareness. The last affair with Facebook showed how easy private data can be used, but on the other hand people should be able to count on such a situation by sharing their data on the Internet. No regulation can replace reason and caution.

Will it affect learning and information flow? I do not think so much. If these regulations were in force many years ago, today we would probably know that the AIDS patient traveled a lot and was homosexual - because they influenced the way the disease spread and that it affected homosexuals in the first place, but we would not know the name this patient, which does not matter to understand the mechanism of disease spread.

I work in data recovery. This is a very sensitive area when it comes to confidentiality and data security. If someone entrusts me with his medium, he expects that the data I will recover will not be disclosed to anyone else or to a jealous wife or police - if I suspect that they may be evidence of a crime. On the other hand, if the client is, for example, the Police, it is not my role to protect someone's intimate secrets that concern legal but very personal matters.

Usually I do not analyze the contents of the media, unless I am explicitly asked for it, so I do not even know about many ethically doubtful situations. However, over the years I have seen something like this several times that I had serious doubts as to how to proceed. Always prevailed loyalty to the client. He is the owner of the data and he is responsible for their use.

Thank you very much and all the best with the project,

Dilyana

This is a really good question, and the general issue has recently come up in my work. I looked around for studies, and found a couple of analysis of its effects. They seem to point out that there is an exception for "research," but the definition of "research" can vary by EU member state. Anonymization is said to help with the restriction, but pseudo anonymization, where data can be re-identified, has particular issues. Here are links I saw that may be helpful:

 I'm tempted to say "let's wait and see", but I suspect that the GDPR may end up being just so much smoke - everyone is currently in a frenzy, worrying about the 4% of global turnover fines, but will they actually ever be levied? Or will we just see the customary wrist-slapping from the respective DPAs?

Here is an article discussing the privacy laws between the EU and the US: 

As for the determination of the best country, it will depend on your preset determining factors.

Very kind of you Bob. I will read it with interest.

Thank you.

Eoin

Dear Arthur, you might consider what he says to his profession. Everything should be monetized.

Then sencibilidade a document is directly linked to the value that it has, or projuízo would cause if disclosed.

In my profile you will find many articles on privacy and data loss and data leakage.

Estou em Campinas caso precise.

I assume you are referring to web app security assessment.

Try starting with http://www.openvas.org/ http://sqlmap.org/ and http://sectools.org/tool/nikto/. 

The evaluation of any security devices is in fact an evaluation of security algorithms and security implemented protocols. However, the evaluation in not mainly related to Devices. For example we evaluate AES or RSA cipher algorithms regardless they are implemented in smart card or in a router. 

can i use weka for data anonymization.Please explainme

Authentication User’s Privacy: An Integrating Location Privacy Protection Algorithm for Secure Moving Objects in Location Based Services

read this paper also related reference it will help you .

The first issue with any public-use file (open data) is providing a file that allows reproduction of 1-2 (but hopefully more) analyses that might be performed the the original, non-public file prior to the 'masking' of certain fields to prevent re-identification. If the file has valid analytic properties, then the data producer should (attempt to) justify that re-identification of a small proportion of individuals is exceptionally difficult or impossible.

 This has been an open area of research for 35+ years. Do a bunch of tabulations (queries) with the underlying microdata in a manner so that individuals cannot reconstruct the underlying microdata from the tabulations (even when noise (epsilon) is added in a suitable manner). At one point, major database groups and IBM concluded that it was an impossible problem (even after millions in dollars of NSF support).

 In the mid 1990s, Latanya Sweeney (then a CS Ph.D. student at MIT, now a Harvard professor) took an 'anonymized' set of health data from Massachusetts State employees and showed how to re-identify most of them using a Massachusetts voter registration database. The health data had been anonymized by removing individual's names, SSNs, heath insurance IDs, doctor's names, hospital names and just about any other identifiers that individuals could think of. For analytic purposes, ZIP codes, sex, and date-of-birth were left in the file and these fields were used to re-identify more than 70% of the individuals in the file, including the Governor.

 In 2003 Dinur and Nissim provided methods with rigorous guarantees on the privacy.

Dinur, I., and Nissim, K. (2003), “Revealing Information while Preserving Privacy,” ACM PODS Conference, 202-210.

Much of the work in recent years has been on improving analytic properties.

Dwork, C. (2008), “Differential Privacy: A Survey of Results,” in (M. Agrawal et al., eds.) TAMC 2008, LNCS 4978, 1-19.

Barak, B., Chaudhuri, K., Dwork, C., Kale, S., McSherry, F., and Talwar, K. (2007), “Privacy, Accuracy, and Consistency Too: A Holistic Solution to Contingency Table Release,” PODS ’07, Beijing, China.

Hardt, M,, Ligget, K., and McSherry, F. A (2010), A simple and practical algorithm for differentially private data release, available at http://arxiv.org/abs/1012.4763 .

Over the last seven years, the American Statistical Association has had three invited paper sessions at their Annual Meeting on differential privacy. Different groups would like to provide 'protected' microdata with guarantees on privacy and on valid analytic properties.

The answer is that there are presently no systematic methods of both assuring analytic properties and privacy. As long as your original data are suitably clean (this is not always assured in many databases), then your tabulations should be valid. Unfortunately, there are very sophisticated methods of working backwards from the tabulations to subsets of the microdata. Look at the following for improved methods of working backwards from the tabulations to the microdata.

Dwork, C. and Yekhanin, S. (2008), “New Efficient Attacks on Statistical Disclosure Control Mechanisms,” Advances in Cryptology—CRYPTO 2008, to appear, also at http://research.microsoft.com/research/sv/DatabasePrivacy/dy08.pdf .

Many CS and other researchers have shown how to re-identify with seemingly innocuous files.  The used public-use IMDB information to re-identify individuals in the Netflix public-use that Netflix subsequently took down.

Narayanan, A. and Shmatikov, V. (2008), Robust De-anonymization of Large Sparse Datasets, Proceedings of the 2008 IEEE Symposium on Security and Privacy, 111-125.

This paper perhaps does not respond to your question but is a good overview of the efforts to come to common ground and to identify the minimum standards between US-EU privacy law 

these are reference articles which discussed about data leakage protection and model, hopefully can help you.

I also agree with Lazaridis, Ngafeeson and Aghatise. Simulated data is possible, and results based on them even publishable, as long as it refers to simulation. Its connection to real clinical outputs, however, remains doubtful, precisely because it is based on a simulation.

Gracias Fabio! I'll take a look (although I doubt that most workers know whether their employers are registered or pay taxes...)

The challenges of data protection/security in an organization include:

-Availability of trained staff (from user to administrator)

-Regular training of master trainers as new threats are always growing

-Bringing all machines on the network 

-Disabling USB data storage devices

-Controlled access to internet

-SAN for data storage and archiving

-Effective group policies

-Regular updating/upgrading of OS

-Installation of antivirus software and its regular updating

-Legal support / supporting policies/Laws

-& physical security as an additional protection layer

Data protection is bigger picture and can be see as institutional issue where as  data security is an organizational matter and it deals more with technicalities or implementation of data protection policies. 

I can understand the opposite: unencrypted data being classified as encrypted. This can happen if data is compressed, thus increasing the entropy to the max limit (at least should). One thing that might help is to first identify the encoding of the source (e.g., raw or base64 encoded, quoted_printable, ...) Once this is know, the limit of entropy is also identified. Another practical issue, is to skip the initial blocks of the source file (e.g., the header info of a zip file will have low entropy, but actual encrypted content afterwards will be as random as they should).

I have done research and published on spatial position and movement in groups

as non-verbal behavior. There is some evidence that controlling for cultural definitions of permitted spatial closeness, those who infringe such boundaries and or, who move around a lot in a stable group such as a classroom, business or military group (after four sessions) are possibly alien to or uncomfortable with the group. There is also a difference depending on seat position, in dominant and minority group status, possible detection of pro or con attitudes toward authority or peers in the group. Experiments on spatial distance from others controlling for culture maybe class, might indicate emotional disturbance. Marking territory and defense of territory in invasion experiments also identifies dominants and "strangers" in the group. I would like to do more research on this topic that could benefit the field, also business and security, but would want to be recompensed. Also, many other nonverbal behaviors indicate cultural, class and other origins. Gilda Haber, PhD

Confidentiality assumes full protection of any information relating to a person. Data protection legislation intended to ensure the integrity of the exclusive list of personal information about a person who strictly listed in a specific legislative act.

hi ahmed. You can search for provable data possession for cloud data integrity.

This topic is of high-interest at OHRP right now and at every conference I've been to where a representative from OHRP is present, this issue is addressed by referring back to http://www.hhs.gov/ohrp/policy/reposit.html and specifically the guidance at http://www.hhs.gov/ohrp/policy/cdebiol.html. OHRP views personally identifiable private information stored as data synonymous with tissue samples, even if it's coded but could possibly be linked to specific individuals by the investigator(s) either directly or indirectly through a key (available to the investigator). There are exceptions spelled out in the guidance so take a close look to see if your project meets one of the exclusions.