The sharing of personal information among health and social service organisations is a complex issue and problematic process in present-day England. Organisations which provide services to children face enormous challenges on many fronts. Internal ways of working, evolving best practice, data protection applications, government mandates and new government agencies, rapid changes in technology, and increasing costs are but a few of the challenges with which organisations must contend in order to provide services to children while keeping in step with change. This thesis is an exploration into the process of sharing personal information in the context of public sector reforms. Because there is an increasing emphasis of multi-agency collaboration, this thesis examines the information sharing processes both within and among organisations, particularly those providing services to children. From the broad principles which comprise a socio-technical approach of information sharing, distinct critical factors for successful information sharing and best practices are identified. These critical success factors are then used to evaluate the emerging national database, ContactPoint, highlighting particular areas of concern. In addition, data protection and related issues in the information sharing process are addressed. It is argued that one of the main factors which would support effective information sharing is to add a timeline to the life of a dataset containing personal information, after which the shared information would dissolve. Therefore, this thesis introduces Dynamic Multi-Agency Collaboration (DMAC), a theoretical model of effective information sharing using a limited-life dataset. The limited life of the DMAC dataset gives more control to information providers, encouraging effective information sharing within the parameters of the Data Protection Act 1998.

Sedan införandet av dataskyddsförordningen GDPR den 25 maj 2018 har internetanvändare i alla EU/ESS länder blivit mötta av en förfrågan om godkännande av cookies vid varje besök av en ny hemsida. Frågan ska enligt lag tydligt informera användare om att cookies används, i vilket syfte och hur länge de sparas. Beväpnad med denna information ska användaren sedan ha möjlighet att ta ett välinformerat beslut om hen godkänner webbplatsens användning av cookies och därmed insamlingen av hens personuppgifter. Denna lagstiftning gäller för samtliga webbplatser oavsett offentlig eller privat avsändare och avser att skapa ett skydd för varje individs digitala integritet. Cookies har använts i funktionssyfte sedan internets begynnelse men har under de senare åren använts med stor framgång primärt i marknadsföringssyfte i form av riktad marknadsföring av kommersiella webbplatser. Det finns stor vinning för många företag att användare godkänner dessa cookie-förfrågningar vilket gör att stor vikt läggs vid hur dessa förfrågningar designas. Dark Patterns är ett begrepp på former av konverteringsinriktad design som används för att få användare att utföra handlingar som ej gynnar dem i längden, men som skapar mervärde för aktören bakom. Dessa designval används flitigt över hela internet och har även identifierats i cookie-förfrågningar. Följande studie undersöker hur dessa cookie-förfrågningar är utformade, vilka dark patterns som finns att identifiera i deras gränssnitt samt användares inställning till 15 statliga respektive 15 kommersiella webbplatser. Data för studien har samlats in genom en kvantitativ enkätundersökning med 102 respondenter samt en kvalitativ innehållsanalys av samtliga webbplatser. Empiri från tidigare forskning har använts för att jämföra och styrka studiens slutsats. Användningen av dark patterns har identifierats på både statliga och kommersiella webbplatser men i en högre grad i den sistnämnda. Dessa designval har visats påverka användarens interaktion med förfrågan på ett sätt som är positivt för aktören. Studien har däremot även visat att en lika stor faktor för användarens medvetna beslut är det anseende aktören för webbplatsen har. Avslutningsvis visar studien att dagens internetanvändare generellt är trötta på konstanta förfrågningar med samma eller liknande information, och vad som var avsett att skapa en trygghetskänsla hos användaren har i stället bara blivit ett evigt störningsmoment. / Since the implementation of the General Data Protection Regulation (GDPR) on May 25th, 2018, users in EU/EEC countries have encountered cookie approval requests upon accessing new websites. By legal demand, these cookie prompts must provide information on the use of cookies, their purpose, and the duration of data retention. With this knowledge, users are expected to make informed decisions regarding their consent to the website's cookies and data collection utilization. This legislation applies universally to all websites, regardless of their public or private nature, to protect individuals’ digital privacy. While cookies have served functional purposes since the early days of the Internet, their recent substantial adoption for targeted marketing by commercial websites has provided significant advantages for many companies. Consequently, precise attention is placed on the design of these cookie requests themselves. Dark Patterns represent a form of conversion-oriented design tactics employed to impact users to perform certain actions that may not be beneficial in the long term but generate value for the entity implementing them. These design choices are prevalent across the internet and have also been identified within the context of cookie prompts. This study observes the design elements of such cookie prompts, identifies the presence of dark patterns within their interfaces, and examines user attitudes toward these prompts. The research analyzes 15 government websites and 15 commercial websites through a qualitative content analysis that uncovers hidden information. As a complement, an additional quantitative survey was formed by collecting data from 102 respondents. The study leverages empirical evidence from previous research to strengthen its findings and comparisons. Findings show that the use of dark patterns on both government and commercial websites is evident, with a more noticeable occurrence on commercial ones. These design choices have been observed to influence user interactions with the requests to favor the sender implementing the dark patterns. However, the research also demonstrates that the senders' reputation equally influences users' conscious decision-making process. In conclusion, the study indicates that contemporary internet users generally experience weariness due to persistent requests featuring repetitive or similar information. What was initially intended to instill a sense of user security has instead become an enduring source of disruption.

No description available.

The Windows registry serves as a valuable resource for both digital forensics experts and security researchers. This information is invaluable for reconstructing a user's activity timeline, aiding forensic investigations, and revealing other sensitive information. Furthermore, this data abundance in the Windows registry can be effortlessly tapped into and compiled to form a comprehensive digital profile of the user. Within this dissertation, we've developed specialized applications to streamline the retrieval and presentation of user activities, culminating in the creation of their digital profile. The first application, named "SeeShells," using the Windows registry shellbags, offers investigators an accessible tool for scrutinizing and generating event timelines based on specific criteria like file access patterns and system navigations. It boasts analytical features that can identify potentially suspicious events through a heat mapping system. In the context of our research, we've also crafted another application designed to collect and deduce a user's extensive activities by solely accessing the Windows registry. This program effectively sidesteps security software by utilizing native Windows application programming interface (API) to interact with the registry, granting unrestricted access to valuable information. This trove of data, often referred to as the user's digital footprint, holds the potential to either investigate or compromise both the user's privacy and security. Finally, we propose a custom-developed application that utilizes both software-based encryption and advanced hooking techniques to protect users' personal data within the registry. Our program is designed to create a more secure and discreet environment for users, effectively fortifying it against privacy and security threats while maintaining accessibility to legitimate users and applications.

his thesis researches the complex intersection of Data Protection and Intelligent Chatbots (IC)at Scania Group. Developing intelligent chatbots in a secure and GDPR compliant way is highlycomplicated and multifaceted task. The purpose of this research is to provide Scania withorganizational knowledge on how this can be achieved. This study utilizes the Action DesignResearch framework to develop an artifact which integrates technological solutions with dataprotection considerations. By conducting a literature review and semi-structured interviews withemployees at Scania, three potential solutions are identified evaluated: ChatGPT Enterprise, theSecured AI Knowledge Repository (SAIKR), and Techtalker. Each solution offers differentcapabilities and compliance strategies: ChatGPT Enterprise, while practical, relies on contractualassurances for GDPR compliance with data stored in the USA. SAIKR, on the other hand, offersmore control with data stored and encrypted in Sweden, allowing for the use of advancedprivacy-preserving techniques. Techtalker, which is hosted directly by Scania, provides enhancedsecurity measures tailored to specific technical use cases. Based on the artifact and conclusionsof this research, generalized design principles for developing intelligent chatbots within acorporate structure are formulated. These four design principles encourages the utilization ofRAG and LLMs, safe and legal data localization, strong contractual safeguards with third-partyproviders, and a comprehensive risk analysis with stringent security measures.

Frågan om rätten till personlig integritet är aktuell på ett helt annat sätt idag än den var på 1990-talet. Sedan dataskyddsdirektivet trädde i kraft har behandlingen av personuppgifter ökat exponentiellt. Informationsteknik har möjliggjort en omfattande kartläggning av personers beteenden online. Idag använder många webbplatser funktioner för att samla in och på andra sätt behandla sina besökares personuppgifter. Samtidigt har informationen om personuppgiftsbehandlingen som ges till enskilda på webbplatser i många fall blivit omfattande och komplicerad. Ett av syftena med den nya dataskyddsförordningen är att bygga upp konsumenters förtroende för handel på internet. Förordningen syftar även till att stärka skyddet för enskildas personliga integritet. Bestämmelserna kan anses vara svårtydda, vilket kan leda till att skyddet som bäst blir oförändrat. I ett samhälle som blir alltmer digitaliserat tycks det önskvärt att de moderna reglerna håller vad de lovar, annars kan konsekvenserna bli stora. I denna uppsats diskuteras om dataskyddsförordningens krav på informerat samtycke förbättrar förutsättningarna för ett effektivt skydd för den personliga integriteten. De nya bestämmelserna är mer omfattande men har kritiserats för att vara otydliga, närmare principer i direktiv snarare än direkt tillämplig förordningstext. Bestämmelserna behöver också vägas mot andra rättigheter. Därför kan bestämmelserna om samtycke och informationsplikt leda till ett sämre skydd för enskilde om inte tydlig vägledning ges. Det är därför en risk som kommer behöva beaktas vid tillämpningen av förordningen. Om personuppgiftsansvariga saknar vägledning finns en risk att bestämmelserna i praktiken inte ger enskilda den kontroll över sina personuppgifter som var avsedd.

Digitisation had a profound impact on the creation, reproduction, and dissemination of works protected by copyright. Works in digital format are vulnerable to infringement, and technological protection measures are accordingly applied as protection. Technological protection measures can, however, easily be circumvented, and additional legal protection against circumvention was needed. Article 11 of the WIPO Copyright Treaty (the WCT) obliges Member States to provide adequate legal protection against the circumvention of technological measures applied to works protected by copyright. Contracting parties must refine the provisions of Article 11 and provide for exceptions on the prohibition. Article 11 does not specify whether it pertains to only certain types of technological measures, nor does it prohibit the trafficking in circumvention devices. The United States implemented the provisions of Article 11 of the WCT through the Digital Millennium Copyright Act of 1998 (the DMCA). Section 1201 of the DMCA prohibits the circumvention of technological measures. It is detailed and relates to two categories of technological measures - access control and copy control. It prohibits not only the act of circumvention, but also the trafficking in circumvention devices. Article 6 of the EC Directive on the Harmonisation of Certain Aspects of Copyright and Related Rights in the Information Society of 2001 implements Article 11 of the WCT. Article 6 seeks to protect Aeffective technological measures@. It prohibits both the act of circumvention and circumvention devices. Although Article 11 of the WCT is silent on the issue of access control, it seems as if the international trend is to provide legal protection to access controls, thus indirectly creating a right to control access. South Africa has not yet implemented Article 11 of the WCT. The South African Copyright Act of 1979 does not protect technological protection measures. The Electronic Communications and Transactions Act of 2002 (the ECT Act) provides protection against the circumvention of technological protection measures applied to digital data. The definition of Adata@ is such that it could include protected works. If applied to protected works, the anti-circumvention provisions of the ECT Act would be detrimental to user privileges. As developing country, it seems to be in South Africa's best interest to the implement the provisions of Article 11 in such a manner that it still allows users access to and legitimate use of works protected by copyright. / Jurisprudence / LL.D.

Digitisation had a profound impact on the creation, reproduction, and dissemination of works protected by copyright. Works in digital format are vulnerable to infringement, and technological protection measures are accordingly applied as protection. Technological protection measures can, however, easily be circumvented, and additional legal protection against circumvention was needed. Article 11 of the WIPO Copyright Treaty (the WCT) obliges Member States to provide adequate legal protection against the circumvention of technological measures applied to works protected by copyright. Contracting parties must refine the provisions of Article 11 and provide for exceptions on the prohibition. Article 11 does not specify whether it pertains to only certain types of technological measures, nor does it prohibit the trafficking in circumvention devices. The United States implemented the provisions of Article 11 of the WCT through the Digital Millennium Copyright Act of 1998 (the DMCA). Section 1201 of the DMCA prohibits the circumvention of technological measures. It is detailed and relates to two categories of technological measures - access control and copy control. It prohibits not only the act of circumvention, but also the trafficking in circumvention devices. Article 6 of the EC Directive on the Harmonisation of Certain Aspects of Copyright and Related Rights in the Information Society of 2001 implements Article 11 of the WCT. Article 6 seeks to protect Aeffective technological measures@. It prohibits both the act of circumvention and circumvention devices. Although Article 11 of the WCT is silent on the issue of access control, it seems as if the international trend is to provide legal protection to access controls, thus indirectly creating a right to control access. South Africa has not yet implemented Article 11 of the WCT. The South African Copyright Act of 1979 does not protect technological protection measures. The Electronic Communications and Transactions Act of 2002 (the ECT Act) provides protection against the circumvention of technological protection measures applied to digital data. The definition of Adata@ is such that it could include protected works. If applied to protected works, the anti-circumvention provisions of the ECT Act would be detrimental to user privileges. As developing country, it seems to be in South Africa's best interest to the implement the provisions of Article 11 in such a manner that it still allows users access to and legitimate use of works protected by copyright. / Jurisprudence / LL.D.

This thesis investigates the potentially complex power effects generated in Online Social Networking Sites (‘OSNS’), such as YouTube and Facebook, when legal values, such as copyright and personal data, are protected and/or violated. In order to develop this analysis, in Chapter Two, I critically analyse key academic writings on internet regulation and argue that I need to move away from the dominant ‘regulatory’ lens to my Actor-Network Theory-Foucauldian Power Lens (‘ANT-Foucauldian Power Lens’) in order to be able to capture the potentially complex web of power effects generated in YouTube and Facebook when copyright and personal data are protected and/or violated. In Chapter Three, I develop my ANT-Foucauldian Power Lens and explore how key ANT ideas such as translation can be used in conjunction with Foucauldian ideas such as governmentality. I utilise my ANT-Foucauldian Power Lens in Chapters Four to Seven to analyse how YouTube and Facebook are constructed as heterogeneous, contingent and precarious ‘actor-networks’ and I map in detail the complex power effects generated from specific local connections. I argue five key points. Firstly, I suggest that complex, multiple, and contingent power effects are generated when key social, legal, and technological actants are locally, contingently, and precariously ‘fitted together’ in YouTube and Facebook when copyright and personal data are protected and/or violated. Secondly, I argue that ‘materialities’ play key roles in maintaining the power effects generated by specific local connections. Thirdly, I argue that there are close links between power and ‘spatialities’ through my analysis of the Privacy Settings and Tagging in Facebook. Fourthly, I argue that my relational understandings of YouTube and Facebook generate a more comprehensive view of the power effects of specific legal elements such as how specific territorial laws in YouTube gain their authority by virtue of their durable and heterogeneous connections. Finally, I argue that we can extrapolate from my empirical findings to build a small-scale theory about the power effects generated in OSNS when legal values are protected and/or violated. Here I also consider the contributions made by my research to three distinct fields, namely, internet regulation, socio-legal studies, and actor-network theory.

L’évolution continue des besoins d’apprentissage vers plus d’efficacité et plus de personnalisation a favorisé l’émergence de nouveaux outils et dimensions dont l’objectif est de rendre l’apprentissage accessible à tout le monde et adapté aux contextes technologiques et sociaux. Cette évolution a donné naissance à ce que l’on appelle l'apprentissage social en ligne mettant l'accent sur l’interaction entre les apprenants. La considération de l’interaction a apporté de nombreux avantages pour l’apprenant, à savoir établir des connexions, échanger des expériences personnelles et bénéficier d’une assistance lui permettant d’améliorer son apprentissage. Cependant, la quantité d'informations personnelles que les apprenants divulguent parfois lors de ces interactions, mène, à des conséquences souvent désastreuses en matière de vie privée comme la cyberintimidation, le vol d’identité, etc. Malgré les préoccupations soulevées, la vie privée en tant que droit individuel représente une situation idéale, difficilement reconnaissable dans le contexte social d’aujourd’hui. En effet, on est passé d'une conceptualisation de la vie privée comme étant un noyau des données sensibles à protéger des pénétrations extérieures à une nouvelle vision centrée sur la négociation de la divulgation de ces données. L’enjeu pour les environnements sociaux d’apprentissage consiste donc à garantir un niveau maximal d’interaction pour les apprenants tout en préservant leurs vies privées. Au meilleur de nos connaissances, la plupart des innovations dans ces environnements ont porté sur l'élaboration des techniques d’interaction, sans aucune considération pour la vie privée, un élément portant nécessaire afin de créer un environnement favorable à l’apprentissage. Dans ce travail, nous proposons un cadre de vie privée que nous avons appelé « gestionnaire de vie privée». Plus précisément, ce gestionnaire se charge de gérer la protection des données personnelles et de la vie privée de l’apprenant durant ses interactions avec ses co-apprenants. En s’appuyant sur l’idée que l’interaction permet d’accéder à l’aide en ligne, nous analysons l’interaction comme une activité cognitive impliquant des facteurs contextuels, d’autres apprenants, et des aspects socio-émotionnels. L'objectif principal de cette thèse est donc de revoir les processus d’entraide entre les apprenants en mettant en oeuvre des outils nécessaires pour trouver un compromis entre l’interaction et la protection de la vie privée. ii Ceci a été effectué selon trois niveaux : le premier étant de considérer des aspects contextuels et sociaux de l’interaction telle que la confiance entre les apprenants et les émotions qui ont initié le besoin d’interagir. Le deuxième niveau de protection consiste à estimer les risques de cette divulgation et faciliter la décision de protection de la vie privée. Le troisième niveau de protection consiste à détecter toute divulgation de données personnelles en utilisant des techniques d’apprentissage machine et d’analyse sémantique. / The emergence of social tools and their integration in learning contexts has fostered interactions and collaboration among learners. The consideration of social interaction has several advantages for learners, mainly establishing new connections, sharing personal experiences and receiving assistance which may improve learning. However, the amount of personal information that learners disclose in these interactions, raise several privacy risks such as identity theft and cyberbullying which may lead to serious consequences. Despite the raised concerns, privacy as a human fundamental right is hardly recognized in today’s social context. Indeed, the conceptualization of privacy as a set of sensitive data to protect from external intrusions is no longer effective in the new social context where the risks come essentially from the self-disclosing behaviors of the learners themselves. With that in mind, the main challenge for social learning environments is to promote social interactions between learners while preserving their privacy. To the best of our knowledge, innovations in social learning environments have only focused on the integration of new social tools, without any consideration of privacy as a necessary factor to establish a favorable learning environment. In fact, integrating social interactions to maintain learners’ engagement and motivation is as necessary as preserving privacy in order to promote learning. Therefore, we propose, in this research, a privacy framework, that we called privacy manager, aiming to preserve the learners’ privacy during their interactions. Considering social interaction as a strategy to seek and request peers’ help in informal learning contexts, we analyze learners’ interaction as a cognitive activity involving contextual, social and emotional factors. Hence, our main goal is to consider all these factors in order to find a tradeoff between the advantages of interaction, mainly seeking peer feedback, and its disadvantages, particularly data disclosure and privacy risks. This was done on three levels: the first level is to help learners interact with appropriate peers, considering their learning competency and their trustworthiness. The second level of protection is to quantify potential disclosure risks and decide about data disclosure. The third level of protection is to analyze learners’ interactions in order to detect and discard any personal data disclosure using machine learning techniques and semantic analysis.