Organizations are increasingly adopting the cloud to meet their business goals more cost-effectively. Cloud benefits like scalability, broad access, high availability, and cost-effectiveness provide a great incentive for organizations to move their applications to the cloud. However, concerns regarding privacy data protection remain one of the top concerns for applications migrating to the cloud. With various legislations and regulations mandating organizations to protect personal data, it is required that cloud applications and associated infrastructure are designed in a manner that provides adequate data protection. To achieve this there is a need to understand various data protection legislations, regulations, and risks faced by the cloud applications and various security controls that can be put in place to address those. Smart homes equipped with health monitoring systems have the potential to monitor the health of elderly people in their homes. In such homes, sensors are employed to monitor the activity of individuals and leverage that information to detect anomalies and raise alarms to the caretakers. However, hosting such a system in the cloud has potential privacy impacts, since health data is treated as sensitive privacy data in many regulations.  This thesis is conducted based on a use case of the deployment of an elderly health care monitoring system for municipalities in Sweden. I analyzed various regulations and privacy risks in migrating such a health monitoring system to the public cloud, the regulations captured are specific to the use case where the e-health data of Swedish citizens is captured in the cloud. The study also highlights various data protection approaches that can be employed to address the identified concerns.  In the thesis, I highlighted that data residency, data control, and the possibility of data leakage from the public cloud are among the top concerns for the municipality. I also listed various applicable data protection regulations and legislation, with “Swedish law for public access to information and secrecy” having a crucial influence on privacy data storage. I evaluated various data protection approaches to alleviate the above concerns, which include access control, anonymization, data splitting, cryptographic measures, and leveraging public cloud capabilities.

Technological advancement has transformed our lives by bringing unparalleled convenience and efficiency. Data, particularly consumer data, essential for influencing businesses and developing personalized experiences, is at the heart of this transition. Companies may improve consumer satisfaction and loyalty by using data analysis to customize their products and services. However, the collection and utilization of consumer data raise privacy concerns. Protecting customers’ personal information is essential to maintaining trust, respecting individual autonomy, and preventing unauthorized access or misuse. Along with the protection of data, transparency is also another essential factor. When companies or organizations deal with users’ data, they are liable to inform these users of anything and everything that happens with their data. Our study focuses on the online privacy policies of Google Chrome browser extensions. We have tried to find the extensions that comply with the data protection guidelines and if all Google Chrome browser extensions are transparent enough to mention the details as per guidelines. Utilizing the power of Natural Language Processing (NLP) techniques, we have employed advanced methodologies to extract insights from these policies.

Forms for consent regarding the use of digital cookies are currently used by websites to convey the information about the use of digital cookies on the visited website. However, the design of these consent forms is not entirely right according to the directives of the General Data Protection Regulation and also not optimal seen from a user's perspective. They often lack options and the informational text is often too brief within the form. As a user, that might make it difficult to understand what it is you accept and what the consequences could be for your personal data. Based on the directives given for the digital cookie consent form, it becomes clear that many do not meet the requirements. The question therefore arise, which factors make a cookie consent form successful, concerning how well a user understands the content and is aware of his/her choice of action? To answer that question, a quantitative- and a qualitative study was conducted. The quantitative study examined people's current understanding and perception about digital cookie forms. The results of that study were then used in the qualitative study to develop prototypes producing new cookie consent forms which were then examined with a usability test. The study presents five factors that contribute to a cookie consent form to be considered successful from the user's perspective in understanding the content and making an active choice. These factors are text, options, full-page consent form, active choice and trustworthiness. These five factors can independently increase the user experience of a form, although, all should be accounted for for better results. The various factors together contribute to a form that complies with different directives and laws, but above all, helps users get a better experience of understanding what they approve of and the feeling of making an active choice. / Formulär för samtycke till användandet av digitala kakor (cookies) används idag av hemsidor för att förmedla informationen om användningen av digitala kakor på den besökta hemsidan. Utformningen av dessa samtyckesformulär är däremot inte alltid helt korrekta enligt direktiven från the General Data Protection Regulation och inte heller optimala sett utifrån en användares perspektiv. De saknas ofta valmöjligheter och information är ofta kortfattad inom formuläret. Som användare, kan det därför vara svårt att förstå vad det är man godkänner och vilka konsekvenser det innebär för ens personliga data. Utifrån de direktiv som ges för utformningen av formulären för samtycke till användandet av digitala kakor blir det tydligt att många inte uppnår kraven. Frågan blir därför vilka faktorer som gör att ett formulär blir framgångsrikt i den aspekt att användaren förstår innehållet och är medveten om sitt val? För att svara på denna fråga gjordes en kvantitativ studie och en kvalitativ studie. Den kvantitativa studien undersökte människors nuvarande förståelse och känsla om formulär för digitala kakor. Resultatet användes denna studie använde sedan i den kvalitativa studien i form av prototyper föreställande nya formulär som sedan undersöktes i ett användartest. Studien resulterade i att fem faktorer visade sig vara avgörande för att ett samtyckesformulär för digitala kakor ska anses framgångsrikt utifrån användarens perspektiv med att förstå innehållet och göra ett aktivt val. Dessa faktorer är, text, alternativ, heltäckande sida av formulär, aktivt val och pålitlighet. Dessa fem faktorer kan enskilt förhöja användarupplevelsen av ett formulär, dock bör man ta hänsyn till alla för ett bästa resultat. De olika faktorerna bidrar tillsammans till ett formulär som följer olika direktiv och lagar men framförallt bidrar till att användarna får en bättre upplevelse med att förstå vad de godkänner och känslan av att göra ett medvetet val.

No description available.

Cloud computing which provides computation and storage resources in a pay-per-usage manner has emerged as the most popular computation model nowadays. Under the new paradigm, users are able to request computation resources dynamically in real-time to accommodate their workload requirements. The flexible resource allocation feature endows cloud computing services with the capability to offer affordable and efficient computation services. However, moving data and applications into the cloud exposes a privacy leakage risk of the user data. As the growing awareness of data privacy, more and more users begin to choose proactive protection for their data in the cloud through data encryption. One major problem of data encryption is that it hinders many necessary data utilization functions since most of the functions cannot be directly applied to the encrypted data. The problem could potentially jeopardize the popularity of the cloud computing, therefore, achieving efficient data utilization over encrypted data while preserving user data privacy is an important research problem in cloud computing. The focus of this dissertation is to design secure and efficient schemes to address essential data utilization functions over encrypted data in cloud computing. To this end, we studied three problems in this research area. The first problem that is studied in this dissertation is fuzzy multi-keyword search over encrypted data. As fuzzy search is one of the most useful and essential data utilization functions in our daily life, we propose a novel design that incorporates Bloom filter and Locality-Sensitive Hashing to fulfill the security and function requirements of the problem. Secondly, we propose a secure index which is based on the most popular index structure, i.e., the inverted index. Our innovative design provides privacy protection over the secure index, the user query as well as the search pattern and the search result. Also, users can verify the correctness of the search results to ensure the proper computation is performed by the cloud. Finally, we focus ourselves on the privacy-sensitive data application in cloud computing, i.e., genetic testings over DNA sequences. To provide secure and efficient genetic testings in the cloud, we utilize Predicate Encryption and design a bilinear pairing based secure sequence matching scheme to achieve strong privacy guarantee while fulfilling the functionality requirement efficiently. In all of the three research thrusts, we present thorough theoretical security analysis and extensive simulation studies to evaluate the performance of the proposed schemes. The results demonstrate that the proposed schemes can effectively and efficiently address the challenging problems in practice. / Ph. D.

There is a gap between intention and action that people experience when faced with protecting their digital data privacy. Known as the privacy paradox, it is the idea that what a person says they believe (protecting their data privacy is paramount) is not reflective of how they act (relinquishing their data privacy). In other words, what people express about their data privacy is often in opposition to the frequency with which they relinquish their data privacy. The research intends to examine the privacy paradox and consists of two studies, one qualitative and one quantitative. First, focus groups were held, the outcome of which was an attempt at the creation of a typology of words and phrases that consumers use relative to their data privacy. Second, an experiment using Likert scales and Pareto-optimal choice-based conjoint analysis was created based on the typology created in study one, giving insight into what consumers feel are motivators towards protecting or relinquishing their data privacy. The contribution is filling a gap in the existing literature related to the privacy paradox through an analysis of behavior. / Business Administration/Marketing

Diese Dissertation besteht aus drei unabhängigen Kapiteln, die sich mit Wissen und Informationen in der mikroökonomischen Theorie beschäftigen. In Kapitel 1 untersuchen wir ein Duopolmodell mit Preisdiskriminierung, bei dem die Verbraucher über ihren Datenschutz entscheiden. Wir stellen zwei Datenumgebungen gegenüber und finden für jede ein Gleichgewicht. In einer offenen Datenumgebung geben alle Verbraucher ihre Daten preis. Unternehmen diskriminieren bei der Preisgestaltung, was zu Wohlfahrtsverlusten aufgrund von Abwerbung führt. In einer Umgebung mit exklusiven Daten anonymisieren sich die Verbraucher, die Preise sind einheitlich, und der Markt ist effizient. Wir testen die Gleichgewichte in einem Experiment. In Kapitel 2 untersuchen wir ein Modell einer Organisation, die wissensintensive Produktion betreibt. Der Organisationsdesigner stellt Arbeiter ein, die mit Wissen ausgestattet sind, um Probleme zu lösen, deren Art ex ante unbekannt ist. Der Designer bestimmt, ob die Arbeitnehmer einzeln oder im Team produzieren. Als Team können die Arbeitnehmer kommunizieren und ihr Wissen teilen, während sie bei Einzelarbeit nur ihr eigenes Wissen nutzen können. Wir stellen fest, dass Teamarbeit optimal ist, wenn Spillovers ausreichend hoch sind. Insbesondere dann, wenn Spillovers perfekt oder alle Problemtypen gleich wahrscheinlich sind, sind selbstverwaltete Teams optimal. In Kapitel 3 untersuche ich ein dynamisches Modell mit einem Moral-Hazard-Problem und einem kostspieligen Wissenstransfer. Ein Auftraggeber stellt zwei risikoneutrale, vermögensbeschränkte Agenten ein, die jeweils eine individuelle Aufgabe in einem Projekt übernehmen. Bevor sie sich ihren Aufgaben zuwenden, können die Agenten beschließen, Wissen zu transferieren, das die Produktivität des Empfängers erhöht. Der Auftraggeber kann durch ein gemeinsames Leistungssignal einen Transfer mit oder ohne Verpflichtungsmacht veranlassen. / This dissertation consists of three independent chapters that contribute to understanding how knowledge and information is used in microeconomic theory. In Chapter 1, we study a duopoly model of behavior-based pricing where consumers decide on their data privacy. Contrasting two data environments, we find unique equilibria for each. In an open data environment, all consumers reveal their data. Firms price discriminate causing welfare losses due to poaching. In an exclusive data environment, consumers anonymize, prices are uniform, and the market is efficient. We test the predictions in an experiment. In the open data treatment, subjects act as predicted. In the exclusive data treatment, buyers initially share data but anonymize when sellers poach. In Chapter 2, we study a model of an organization engaging in knowledge-intensive production. The organizational designer hires workers endowed with knowledge to solve problems whose types are ex ante unknown. The designer determines whether workers produce individually or as team. As team, workers can communicate and share their knowledge, while when working individually they can only use their own knowledge. We find that teamwork is optimal when spillovers are sufficiently high. Particularly, when spillovers are perfect, or all problem types are equally likely, self-managed teams arise as a special form of teamwork. In Chapter 3, I explore a dynamic model with a moral hazard problem and knowledge transfer. A principal hires two risk-neutral, wealth-constrained agents to each perform an individual task in a project. Before they address their tasks, the agents can decide to transfer knowledge that increases the task-related productivity of the receiver. The transfer is costly for both. I find that the principal can induce a transfer with or without commitment power through a joint performance signal. It is not clear that commitment is always better, even though with commitment the first-best allocation can be achieved.

This study focuses on online news coverage of TikTok's privacy policies to uncover accusations related to security threats between October 2020 and May 2023. Using critical discourse analysis, the research compares TikTok's discourse with other platforms like Facebook and YouTube, highlighting the role of governments, tech companies, and users in shaping this discourse. Furthermore, it demonstrates how cultural and political factors influence privacy discussions, particularly regarding the controversies, discussions, and accusations between the United States and China. AI tool ChatGPT analyzes the discourse by focusing on the news texts' most prominent topics and keywords. The goal is to identify key themes for each highlighted keyword to answer the following questions: (1) How does TikTok's privacy policy construct notions of privacy and security? (2) How do shareholders discuss potential risks in TikTok’s privacy policies? (3) What are the risks of privacy violations and TikTok's global implications? This research asserts that when analyzed alongside the privacy policy discourses of other major social media platforms, TikTok's privacy policies reveal significant implications for cybersecurity, particularly in the context of informed consent. The findings highlight the interplay of cultural, political, and economic factors, emphasizing the urgent need for continuous monitoring and accountability in digital privacy-seeking risk assessment and minimizing.

Machine learning algorithms based on neural networks have achieved remarkable results and are being extensively used in different domains. However, the machine learning algorithms requires access to raw data which is often privacy sensitive. To address this issue, we develop new techniques to provide solutions for running deep neural networks over encrypted data. In this paper, we develop new techniques to adopt deep neural networks within the practical limitation of current homomorphic encryption schemes. We focus on training and classification of the well-known neural networks and convolutional neural networks. First, we design methods for approximation of the activation functions commonly used in CNNs (i.e. ReLU, Sigmoid, and Tanh) with low degree polynomials which is essential for efficient homomorphic encryption schemes. Then, we train neural networks with the approximation polynomials instead of original activation functions and analyze the performance of the models. Finally, we implement neural networks and convolutional neural networks over encrypted data and measure performance of the models.

Data anonymization is a relevant and important field within data privacy, which tries to find a good balance between utility and privacy in data. The field is especially relevant since the GDPR came into force, because the GDPR does not regulate anonymous data. This thesis focuses on anonymization of directory-structured data, which means data structured into a tree of directories. In the thesis, four of the most common models for anonymization of tabular data, k-anonymity, ℓ-diversity, t-closeness and differential privacy, are adapted for anonymization of directory-structured data. This adaptation is done by creating three different approaches for anonymizing directory-structured data: SingleTable, DirectoryWise and RecursiveDirectoryWise. These models and approaches are compared and evaluated using five metrics and three attack scenarios. The results show that there is always a trade-off between utility and privacy when anonymizing data. Especially it was concluded that the differential privacy model when using the RecursiveDirectoryWise approach gives the highest privacy, but also the highest information loss. On the contrary, the k-anonymity model when using the SingleTable approach or the t-closeness model when using the DirectoryWise approach gives the lowest information loss, but also the lowest privacy. The differential privacy model and the RecursiveDirectoryWise approach were also shown to give best protection against the chosen attacks. Finally, it was concluded that the differential privacy model when using the RecursiveDirectoryWise approach, was the most suitable combination to use when trying to follow the GDPR when anonymizing directory-structured data.