Two recent shifts in computing are challenging the effectiveness of traditional approaches to data protection. Emerging machine learning workloads have complex access patterns and unique leakage characteristics that are not well supported by existing protection approaches. Second, mobile operating systems do not provide sufficient support for fine grained data protection tools forcing users to rely on individual applications to correctly manage and protect data. My thesis is that these emerging workloads have unique characteristics that we can leverage to build new, more effective data protection abstractions. This dissertation presents two new data protection systems for machine learning work-loads and a new system for fine grained data management and protection on mobile devices. First is Sage, a differentially private machine learning platform addressing the two primary challenges of differential privacy: running out of budget and the privacy utility tradeoff. The second system, Pyramid, is the first selective data system. Pyramid leverages count featurization to reduce the amount of data exposed while training classification models by two orders of magnitude. The final system, Pebbles, provides users with logical data objects as a new fine grained data management and protection primitive allowing data management at a higher level of abstraction. Pebbles, leverages high level storage abstractions in mobile operating systems to discover user recognizable application level data objects in unmodified mobile applications.

Criminal law aspects of data electronization in healthcare Abstract Continuous spread of information and communication technologies into all aspects of everyday life goes hand in hand with importance of data and information. This trend can be also observed in the healthcare sector which has recently experienced massive electronization. However, along with electronization, respective criminal law aspects are developing as well. Relevancy of this issue can be clearly demonstrated on the recent cyber-attacks on healthcare providers, which seriously jeopardize valuable data in healthcare. The aim of this work is to set forth comprehensive summary of criminal aspects of data electronization in healthcare with emphasis on the importance of electronization phenomenon, the issue of cybercrime and selected crimes that may be committed in connection with data electronization. This work also aims at highlighting negative impact of electronization in the global information society. In terms of content, the work consists of five structured chapters, in which the author defined relevant theory behind the issue and subsequently performed her own analysis thereof. The first chapter defines the term "data" as well as its categories and legislative framework with emphasis on area of criminal law and related protection of...

No description available.

This study1 addresses the key information technology issues of the age and its unintended consequences. The issues include social control by businesses, governments, and information age Star Chambers. The study focuses on a comparative analysis of data protection, data security, and information privacy (DPSIP) laws, regulations, and practices in five countries. The countries include Australia, Canada, South Africa, the United Kingdom, and the United States. The study addresses relevant international legal standards and justifications. This multidisciplinary analysis includes a systems thinking approach from a legal, business, governmental, policy, political theory, psychosocial, and psychological perspective. The study implements a comparative law and sociolegal research strategy. Historic, linguistic, and statistical strategies are applied. The study concludes with a next step proposal, based on the research, for the international community, the five countries in the study, and specifically, South Africa as it has yet to enact a sound DPSIP approach. / LL. D.

Thesis (M.P.A.)--University of Hong Kong, 1998. / Includes bibliographical references (leaf 127-129).

Thesis (M.P.A.)--University of Hong Kong, 1998. / Includes bibliographical references (leaves 127-129). Also available in print.

The International Conference of Data Protection and Privacy Commissioners has been actively engaged in the development of a new, legally binding international framework for privacy and data protection. Given the existence of three international privacy and data protection regimes (i.e. the OECD Privacy Guidelines, the EU data protection framework and the APEC Privacy Framework) and the availability of other bilateral venues to resolve transnational data flows issues (e.g. the EU-US Safe Harbor agreement, the Umbrella Agreement and the latest, the Privacy Shield arrangement), the thesis asks whether the development of such a new regime is feasible. The main finding of the thesis is that in an era of a globalized society driven by the internet and information-communications technology, where all three of the leading international privacy and data protection regimes are consistently updating and modifying their respective frameworks, and where there is persistent divergence between the European Union and the United States approaches towards transborder data flow, the emergence of a new, legally binding international framework is unlikely, at least under the prevailing circumstances. Therefore, the thesis calls for a shift towards an institutionalized arrangement that is founded on existing international co-operation and convergence and that further expands ongoing inter-regime collaboration. The approach recommended in the thesis is an effective alternative to the development of a new, legally binding international framework, and even offers strong prospects for the evolution of a legalized arrangement for international privacy and personal data governance in due course.

The position of the data protection officer in the light of labour law Abstract The data protection officer is a specialist in law and practices in the area of data protection. His task is to help to controller and processor to fulfil their obligations associated with data processing. He can perform his function as an employee of a controller or a processor or on the basis of a service contract. His status has certain specifications that the character of some labour law provisions doesn't count with. Although uncertainty about the possibility to give him a dismissal or ask him for damages does not cause problems due to only recent changes of legal regulation yet, disputes that may arise in the future will be expected not only before the Czech courts. The main problem of the issue is, whether the labour law regulation can be extended without further delay to the employed data protection officer in the light of his specific independent position, which is guaranteed him by data protection law. The aim of the thesis is to try to solve problematic aspects of the establishment of the data protection officer in the light of Czech labour law institutes. The main purpose of the thesis is to assess the way in which the prohibition of penalizing the data protection officer is projected in the form of the employment...

On May 25 2018, the General Data Protection Regulation from EU was introduced, which aims to protect individual fundamental rights and freedoms, in particular their right to protection of personal data. The data protection regulation replaces the EU's previous data protection directive and will help prevent the flow of data within the Union being hindered, as the data protection ordinance will apply to all members of EU. This case study aims to gaining an understanding of how different organisations’ risk management against the data protection regulation looks, and whether it will lead to compliance or not. Four Swedish organisations have been studied, presented, and then analysed based on a theoretical framework, designed after the different parts of a general risk management process. The study is of qualitative form and data have been collected through both semi structured and structured interviews. The data protection regulation was not yet implemented during the course of this study, and it was during this time that all parts were designed and the information was collected. The study concludes that the organizations will not be completely compliant against the data protection regulation, which has a number of reasons: They do not take the regulation seriously, they are wrongly doing the change which lengthens the processes, and they delay their compliance due to greater economic profit. / Den 25 maj 2018 infördes EU:s dataskyddsförordning General Data Protection Regulation, som syftar till att skydda enskildas grundläggande rättigheter och friheter, särskilt deras rätt till skydd av personuppgifter. Dataskyddsförordningen ersatte EU:s tidigare dataskyddsdirektiv, och kommer bidra till att flödet av uppgifter inom unionen inte hindras på grund av att olika länder har olika lagar gällande dataskydd och personuppgifter, då dataskyddsförordningen kommer tillämpas alla medlemsstater inom EU. Syftet med denna studie är att ge en ökad förståelse kring hur olika organisationers riskbedömning gentemot dataskyddsförordningen ser ut, och om den kommer leda till att dataskyddsförordningen efterföljs eller ej. Fyra svenska organisationer har studerats, redovisats och sedan analyserats utifrån ett teoretiskt ramverk utformat efter en generell riskbedömnings olika delar. Studien är av kvalitativ form och data har samlats in genom både semistrukturerade och strukturerade intervjuer. Dataskyddsförordningen var inte implementerad under studiens gång, och det var under denna tid som samtliga delar utformades och informationen samlades in. Studien kommer fram till att organisationerna inte kommer vara helt lagenliga gentemot dataskyddsförordningens införande, vilket beror på flera olika anledningar: Förordningen tas inte på fullt allvar, förändringsarbetet görs på fel sätt vilket förlänger processen och efterlevnaden skjuts upp på grund av ekonomiska skäl.

Improvement in information communication technology (ICT) is one of the factors behind growth in economic productivity. A major dimension of this is the use of the Internet in e-commerce, allowing companies to collect, store, and exchange personal information obtained from visitors to their websites. Electronic commerce has many different variants, and is believed by many governments throughout the world to be the engine of economic stability in the future. While electronic commerce has many benefits, there is evidence to suggest privacy concerns are an inhibitor to its adoption in Jordan and the UK. According to Campbell (1997, p.45), privacy in this context can be defined as “the ability of individuals to determine the nature and extent of information about them which is being communicated to others”. The importance of information in e-commerce has increased, because the main success factor for the completion of transactions between businesses and consumers is the companies’ ability to access consumers’ personal details. This conflicts with the consumers’ fear of providing personal information to un-trusted parties, which makes them disinterested in entering contracts via the internet. This research discusses privacy concerns as an inhibitor for electronic commerce by providing a comparison between UK and Jordanian regulations, to establish the impact that these regulations have ameliorating privacy concerns regarding the development of electronic commerce in Jordan and the UK. The interpretive grounded theory approach has allowed the researcher to gain a deep understanding about privacy perceptions of electronic commerce held by the main stakeholders: government, businesses and consumers. Furthermore, through implementing the Straussian grounded theory approach as a data collection and analysis method, two grounded theories have emerged as giving deeper understanding of the situation in Jordan and the UK regarding privacy concerns and how this affects electronic commerce development in both countries.