The paper examines the compatibility between the Swedish principle of transparency and EU’s general data protection regulation (EU) 2016/679 (GDPR). The question of compatibility between the right of access to public documents in Sweden and the EU regulation regardng protection of personal data have been relevant since EU started to legislate the area. However, for the first time a general regulation regarding processing of personal data is enforced which brings the problem to a head. Focusing on the right to public documents (a part of the Swedish principle of transparency) the relevant regulations in GDPR is examined to find possible conflicts with the principle of transparency. It is found that the vast opportunities to exception from the principal rules and the possibility of national special regulation solves many of the conflicts, even though some remain. The perception of the Swedish government in regard to article 86 in GDPR, which allows the member states to reconcile the GDPR with the right to public documents, is that the Swedish principle of transparency is granted precedence over the GDPR. The opinion of the Swedish government does not stand valid regarding the textual content in the regulation nor its purpose and goals. It would have been desirable if the government had made a closer investigation regarding what exception from the principal rules to use, and what national special regulation that is necessary, for the practice of the Swedish right of access to public documents. The analysis in the paper concludes that the principle of transparency and the GDPR can possibly be compatible. Article 86 will be of importance after the of- fered exceptions in the specific rights in the GDPR have been used. The article needs to be put in relation to the protection for personal data offered in the Swedish national legislative that limits the right of access to public documents. Furthermore, the question of respect from EU concerning the national constitutional identity is examined regarding its role reconciling the union law and the Swedish principle of trans- parency. It is stated that it may be of importance for a, from a Swedish transparency perspective, beneficial interpretation of article 86 in the CJEU. The paper also investigates the question of Sweden’s transferring of competence concerning the principle of transparency. It is stated that to the extent EU does not provide a protection of the right of access to public documents equal to the law in Sweden a Swedish court could disallow the competence transfer which passed EU that legislative power. / I framställningen utreds den svenska offentlighetsprincipens förenlighet med EU:s dataskyddsförordning (EU) 2016/679. Frågan om förenlighet mellan offentlighetsprincipen och EU:s reglering rörande personuppgiftsskydd har varit relevant sedan EU började lagstifta på området. Däremot har för första gången en allmän förordning rörande behandling av personuppgifter stiftats vilket ställer problemet på sin spets. Med fokus på handlingsoffentligheten utreds det relevanta regelverket i dataskyddsförordningen för att undersöka eventuella konflikter gentemot offentlighetsprincipen. Det konstateras att de många undantag och möjliga nationella särregleringar som förordningen erbjuder löser många av de konflikter som uppstår, men vissa kvarstår. Den svenska regeringen är av uppfattningen att artikel 86 i dataskyddsförordningen, som möjliggör sammanjämkning mellan förordningen och allmänhetens rätt att få tillgång till allmänna handlingar, innebär att offentlighetsprincipen fullt ut kan ges företräde framför förordningen. Den svenska uppfattning framstår inte som hållbar utifrån förordningens ordalydelse och bakomliggande syften och mål. Det hade varit önskvärt om regeringen närmare låtit utreda vilka undantag och nationella särregleringar som varit nödvändiga för att fortsatt kunna tillämpa handlingsoffentligheten. Analysen i framställningen visar att troligen går det att förena offentlighetsprincipen med dataskyddsförordningen. Artikel 86 blir av betydelse efter de i förordningen erbjudna undantagen i de specifika rättigheterna uttömts. Artikeln måste sättas i relation till det skydd för personuppgifter som i svensk nationell rätt begränsar handlingsoffentligheten. Vidare blir frågan om EU:s respekt för den nationella konstitutionella identiteten behandlad rörande dess betydelse för en sammanjämkning av EU-rätten och den svenska offentlighetsprincipen. Det konstateras att den kan ha betydelse för en, till svensk fördel, offentlighetsvänlig tolkning av artikel 86 i EU-domstolen. Framställningen utreder även frågan om svensk kompetensöverlåtelse till EU rörande offentlighetsprincipen. Slutsatsen är att i den mån EU inte erbjuder ett jämbördigt skydd för rätten till allmänna handlingar likt den svenska rätten kan svensk domstol underkänna överlåtelsen av kompetens som tillät EU att inskränka offentlighetsprincipen.

Målet med denna studie är att undersöka om informationskultur är ett teoretiskt verktyg som kan bidra till en proaktiv informationsförvaltning, samt om informationskulturperspektivet kan vara till stöd för en organisation som genomgår ett förändringsarbete som påverkar informationsförvaltningen. I studien används Gillian Oliver and Fiorella Foscarinis definition av informationskultur, vilket de definierar som ”values accorded to information, and attitudes towards it, specifically within organisational contexts.” Förberedelsearbetet på två svenska universitet inför dataskyddsförordningen GDPR (EU) 2016/67, vilken trädde i kraft 25 maj 2018, är det fall som författaren prövar informationskultursteorin mot. Genom en kvalitativ metod, där fem respondenter har intervjuats, har författaren undersökt respondenternas värderingar gentemot information samt hur de hade organiserat sitt arbete inför GDPR. Studien visar på ett stort behov av samarbete mellan arkivarier och andra yrkesgrupper såsom it-ansvariga och jurister när komplexa informationsförvaltningsfrågor som GDPR ska hanteras. Men att detta samarbete involverar arkivet är inte självklart, vilket visas i skillnaden mellan hur de båda universiteten har arbetat. Studien visar även att det finns en skillnad mellan att anlägga ett informationskulturperspektiv under ett förändringsarbete och att använda informationskultur i Oliver och Foscarinis mening, vilket innebär att analysera redan etablerade strukturer och organisationer; de problemområden som Oliver och Foscarini anser att arkivarien bör undvika att lägga mycket arbete på, då de är svårföränderliga, visar sig enligt studieresultatet tvärt om vara viktiga att jobba med under ett förändringsarbete. Att en viss nivå av det informationskulturramverk som Oliver och Foscarini har tagit fram är svår att påverka i en organisation betyder inte att den är svår att inkorporera i ett förändringsarbete. Till skillnad från andra, allmänna förändringteorier så lyfter informationskulturperspektivet fram aspekter som är direkt kopplade till arkivariens roll. I stället för generella råd som ”samarbete” föreslås mer specifikt ”samarbete med it”. Informationskultur är dessutom en väldigt innehållsrik teori då den inbegriper många etablerade teoribildningar. I en informationsförvaltningskontext blir därför informationskulturansatsen paradoxalt nog både bredare och mer specifik på samma gång. / The aim of this thesis is to examine if information culture is a theoretical construct that can assist in creating a proactive recordkeeping environment. It also aims to investigate if information culture can be of help to an organization that goes through changes that affect its recordkeeping practices. The study uses Gillian Oliver and Fiorella Foscarini’s definition of information culture, which they define as ”values accorded to information, and attitudes towards it, specifically within organisational contexts.” The preparations for the GDPR (EU) 2016/67 at two Swedish universities functions as the case that the author uses to explore these questions. Using a qualitative method, interviewing five people, the author examined the interviewees’ values towards information and how the organizations had prepared for the GDPR. The study suggests that there is need for cooperation between archivists and people from other professions, such as IT and law, when preparing for complex recordkeeping issues such as the GDPR. However, the study shows that an archivist is not always involved in an organization’s change management effort.  The study shows that there is a difference between adopting an information culture perspective when managing change and using information culture as Oliver and Foscarini intend it be used. Their approach addresses organizations and structures that are already established. The problem areas that Oliver and Foscarini think an archivist should avoid focusing its change management efforts on, because they are hard to change, are shown to be as important to work with as other problem areas when managing change in an organization. Just because a level of the information culture framework that Oliver and Foscarini have developed is difficult to affect in an organization does not mean that it is hard to incorporate into a change management effort. In contrast to other change management theories, an information culture perspective highlights aspects that are directly connected to the role of the archivist. Instead of generic advice, such as “cooperation”, information culture specifically advices the archivist to “cooperate with the IT department”. Information culture is a theoretical construct that embraces other established theories. From a recordkeeping perspective, an information culture approach is therefore paradoxically both broad and exact at the same time.

The purpose of this paper is to provide information on how organizations prepare for organizational change by examining how they work for the EU General Data Protection Regulation (GDPR) which comes into action in May 2018. The following questions have been used in order to approach this action: How do municipal organizations prepare effectively for the changes that the EU Data Protection Regulation (GDPR) implies? What steps are particularly problematic in the change work? How can change leaders handle these steps? During the study, a qualitative method has been used through semi-structured interviews. Respondents have key positions in the preparatory work for GDPR within three municipal organizations. One respondent for each organization. As a theoretical reason, Kotter's eight- step change model and previous research on the importance of an individual perspective in change work have been used and the empirical material has been analyzed using content analysis and opinion concentration. The results show that the preparation work for the change looks different in different organizations. You then have a problem of communicating the vision of change when instructions from the EU and the Data Inspectorate for the new regulation are not fully met. Furthermore, the study demonstrates the importance of organizational understanding and knowledge of change, by the change leader, to introduce a new way of working in a municipal organization.

The New Technologies of Information and Communication, especially the Internet, have significantly impacted the way in which the human being relates to everything that surrounds him. In the Information Society, there is a need to extend the concept of privacy, to cover situations in which data or personal information are made available on the global computer network without having an effective public interest. Thus, a doctrinal and jurisprudential current emerges, which is in line with the idea that the excess memory caused by the Internet's ample storage capacity has made human beings unable to detach themselves from the past, being persecuted, For the rest of his life, for his misunderstandings. It speaks of the possibility of applying the right to virtual forgetfulness, due to the protection of the dignity of the human person and the right to privacy, as the prerogative of the human being not to be eternally persecuted for acts or facts of the past that Have no legitimate public interest. The right to forgetfulness comes from the criminal field, and its application, in a civil sphere, especially in relation to the possibility of suppression or concealment of personal data or personal information of the Internet search engines, is what makes the subject new and relevant. Thus, the present research investigates how the Supreme Courts of Brazil and the Spanish Supreme Court are facing the issue in question. We sought to present meeting points between the criteria adopted for decision-making, establishing theoretical frameworks that allow the weighting between conflicting rights, namely, freedom of expression and protection of privacy. / As Novas Tecnologias da Informação e da Comunicação, em especial a Internet, têm impactado significativamente a maneira como o ser humano se relaciona com tudo aquilo que o cerca. Na Sociedade da Informação, surge a necessidade de ampliação do conceito de privacidade, para abarcar situações nas quais os dados ou as informações pessoais são disponibilizados na rede mundial de computadores sem que tenham efetivo interesse público. Surge, assim, uma corrente doutrinária e jurisprudencial que vai ao encontro da ideia de que o excesso de memória, provocado pela ampla capacidade de armazenamento da Internet, resta por fazer com que o ser humano fique impossibilitado de se desligar do passado, sendo perseguido, por toda a vida, por seus equívocos. Fala-se, assim, na possibilidade de aplicação do direito ao esquecimento virtual, decorrente da tutela da dignidade da pessoa humana e do direito à privacidade, como a prerrogativa que tem o ser humano de não ser perseguido eternamente por atos ou fatos do passado que não tenham legítimo interesse público. O direito ao esquecimento é oriundo do campo penal, sendo que sua aplicação, em âmbito cível, em especial em relação à possibilidade de supressão ou ocultamento de dados ou informações pessoais verdadeiras dos mecanismos de busca da Internet, é o que torna o tema novo e relevante. Sendo assim, a presente pesquisa investiga como os Tribunais Superiores do Brasil e o Tribunal Supremo Espanhol vêm enfrentando o tema em questão. Buscou-se apresentar pontos de encontro entre os critérios adotados para a tomada de decisão, estabelecendo balizas teóricas que possibilitem a realização da ponderação entre os direitos em conflito, quais sejam, a liberdade de expressão e a tutela da privacidade.

Orientador : Ricardo Dahab. / Tese (doutorado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-08-21T17:02:27Z (GMT). No. of bitstreams: 1 GalloFilho_RobertoAlves_D.pdf: 5999506 bytes, checksum: 6ef66e76246dddb7de30593abff60bc5 (MD5) Previous issue date: 2012 / Resumo A concepção de sistemas seguros demanda tratamento holístico, global. A razão é que a mera composição de componentes individualmente seguros não garante a segurança do conjunto resultante2. Enquanto isso, a complexidade dos sistemas de informação cresce vigorosamente, dentre outros, no que se diz respeito: i) ao número de componentes constituintes; ii) ao número de interações com outros sistemas; e iii) 'a diversidade de natureza dos componentes. Este crescimento constante da complexidade demanda um domínio de conhecimento ao mesmo tempo multidisciplinar e profundo, cada vez mais difícil de ser coordenado em uma única visão global, seja por um indivíduo, seja por uma equipe de desenvolvimento. Nesta tese propomos um framework para a concepção, desenvolvimento e deployment de sistemas baseados em hardware que é fundamentado em uma visão única e global de segurança. Tal visão cobre um espectro abrangente de requisitos, desde a integridade física dos dispositivos até a verificação, pelo usuário final, de que seu sistema está logicamente íntegro. Para alcançar este objetivo, apresentamos nesta tese o seguinte conjunto de componentes para o nosso framework: i) um conjunto de considerações para a construção de modelos de ataques que capturem a natureza particular dos adversários de sistemas seguros reais, principalmente daqueles baseados em hardware; ii) um arcabouço teórico com conceitos e definições importantes e úteis na construção de sistemas seguros baseados em hardware; iii) um conjunto de padrões (patterns) de componentes e arquiteturas de sistemas seguros baseados em hardware; iv) um modelo teórico, lógico-probabilístico, para avaliação do nível de segurança das arquiteturas e implementações; e v) a aplicação dos elementos do framework na implementação de sistemas de produção, com estudos de casos muito significativos3. Os resultados relacionados a estes componentes estão apresentados nesta tese na forma de coletânea de artigos. 2 Técnicas "greedy" não fornecem necessariamente os resultados ótimos. Mais, a presença de componentes seguros não é nem fundamental. 3 Em termos de impacto social, econômico ou estratégico / Abstract: The conception of secure systems requires a global, holistic, approach. The reason is that the mere composition of individually secure components does not necessarily imply in the security of the resulting system4. Meanwhile, the complexity of information systems has grown vigorously in several dimensions as: i) the number of components, ii) the number of interactions with other components, iii) the diversity in the nature of the components. This continuous growth of complexity requires from designers a deep and broad multidisciplinary knowledge, which is becoming increasingly difficult to be coordinated and attained either by individuals or even teams. In this thesis we propose a framework for the conception, development, and deployment of secure hardware-based systems that is rooted on a unified and global security vision. Such a vision encompasses a broad spectrum of requirements, from device physical integrity to the device logical integrity verification by humans. In order to attain this objective we present in this thesis the following set of components of our framework: i) a set of considerations for the development of threat models that captures the particular nature of adversaries of real secure systems based on hardware; ii) a set of theoretical concepts and definitions useful in the design of secure hardware-based systems; iii) a set of design patterns of components and architectures for secure systems; iv) a logical-probabilistic theoretical model for security evaluation of system architectures and implementations; and v) the application of the elements of our framework in production systems with highly relevant study cases. Our results related to these components are presented in this thesis as a series of papers which have been published or submitted for publication. 4Greedy techniques do not inevitably yield optimal results. More than that, the usage of secure components is not even required / Doutorado / Ciência da Computação / Doutor em Ciência da Computação

The right to private and family life and the right to the protection of personal data are two fundamental rights of the EU. The protection of these rights is addressed in the new General Data Protection Regulation (GDPR), the Directive on Privacy and Electronic Communications (ePrivacyDirective) and the upcoming new Regulation on Privacy and Electronic Communications (draft ePrivacy Regulation). In this thesis these three legal acts are evaluated in light of profiling through ultrasound tracking technology. Their technology neutrality and their functioning as safeguards of the two fundamental rights against the use of profiling through ultrasound tracking technology is tested. The GDPR is found to differentiate between profiling in the context of automatic decision-making and profiling in other contexts. The process of profiling is described in general terms. It is shown how tracking technologies in general and ultrasound tracking technology in particular have a central role in the profiling process.It is found that ultrasound tracking technology enables far wider tracking and data collection than the other tracking technologies. Differences and similarities between ultrasound tracking technology and other tracking technologies are described. According to the findings, the three legal instruments, the GDPR, the ePrivacy Directive and the draft ePrivacy Regulation, all live up to their aim of technology neutrality on theoretical level, since profiling through ultrasound tracking technology is within the material scope of all of them. An exemption is Article 8(2) of the draft ePrivacy Regulation that, unlike Article 9 of the ePrivacyDirective, does not stretch to cover location tracking through ultrasound technology. However, as will be shown, there are risks related to the practical implementation of these legal frameworks.

<p>La tolérance et la gestion des fautes dans les grilles de données/calcul est d’une importance capitale. En effet, comme dans tout autre système distribué, les composants d’une grille sont susceptibles de tomber en panne à tout moment. Mais le risque de panne croît avec la taille du système, et est donc plus exacerbé dans un système de grille. En plus, tout en essayant de mettre à profit les ressources offertes par la grille, les applications tournant sur celle-ci sont de plus en plus complexes (ex. impliquent des interactions complexes, prennent des jours d’exécution), ce qui les rend plus vulnérables aux fautes. Le plus difficile dans la gestion des fautes dans une grille, c’est qu’il est difficile de savoir si une faute qui survient sur une entité de la grille est induite malicieusement ou accidentellement.<p><p>Dans notre travail de thèse, nous utilisons le terme faute, au sens large, pour faire référence à tout étant inattendu qui survient sur tout composant de la grille. Certains de ces états provoquent des comportements aussi inattendus et perceptibles au niveau de la grille tandis que d’autres passent inaperçues. De plus, certaines de ces fautes sont le résultat d’une action malveillante alors que d’autres surviennent accidentellement ou instantanément. Dans ce travail de thèse, nous avons traité le cas de ces fautes induites malicieusement, et qui généralement passent inaperçues. Nous avons considéré en particulier le problème de la confidentialité et de l’intégrité des données stockées à long-terme sur la grille.<p><p>L’étude de la confidentialité des données a été faite en deux temps dont la première partie concerne la confidentialité des données actives. Dans cette partie, nous avons considéré une application liée à la recherche des similitudes d’une séquence d’ADN dans une base de données contenant des séquences d’ADN et stockée sur la grille. Pour cela, nous avons proposé une méthode qui permet d’effectuer la comparaison sur un composant distant, mais tout en gardant confidentielle la séquence qui fait l’objet de la comparaison. <p>Concernant les données passives, nous avons proposé une méthode de partage des données confidentielles et chiffrés sur la grille.<p> <p>En rapport avec l’intégrité des données, nous avons considéré le cas des données anonymes dans le cadre de l’intégrité des données passives. Pour les données actives, nous avons considéré le problème de la corruption des jobs exécutés sur la grille. Pour chacune des cas, nous avons proposé des mécanismes permettant de vérifier l’authenticité des données utilisées ou produites par ces applications.<p> / Doctorat en Sciences / info:eu-repo/semantics/nonPublished

This thesis is focused on consumer protection in the European Union with a special emphasis on online shopping. The first section defines the term 'consumer protection', its development, institutional support, instruments and financing. Also, this part describes the digital market of the European Union, hindrances to the growth of online shopping as well as strategies which are created in order to form a digital single market in the European Union. The second section focuses on protection of personal data, alternative dispute resolutions, current legislation regarding consumers rights on internet and new proposals from the European Commission. The new proposals dominate the second part of this thesis and are discussed with an expert. A survey has been conducted to find out more about the Czech experience with problem solving when shopping online. Moreover, this thesis does not leave out court orders from the European Union´s Court of Justice which have led to the uniform application and interpretation of the consumer protection in the European Union.

This project reviews Arrowhead Credit Union's Information Security Program structure and contents.

Cette recherche s’intéresse à un sujet d’actualité portant sur la vie privée des mineurs en ligne, plus particulièrement sur la protection des données personnelles. Depuis l’avènement des nouvelles technologies de l’information et des communications (NTIC) et la venue du web 2.0, la protection des données personnelles demeure question d’actualité en plus d’être fort complexe. Cette question demeure encore plus criante lorsqu’il s’agit de mineurs. La présente recherche s’intéresse d’abord à l’utilisation d’Internet par les mineurs, à la notion de vulnérabilité du mineur et de l’insuffisance des règles actuelles. Elle s’intéresse également à la distinction conceptuelle entre « mineur » et « enfant » avant de s’arrêter plus longuement aux principales formes d’infractions qui portent atteinte à la vie privée et à l’intégrité des mineurs. Plus loin dans ce mémoire, on s’intéresse aux dispositions législatives et réglementaires au Canada, aux États-Unis et au sein de l’Union européenne. Dans la dernière partie on montre les différences significatives entre le Canada, les États-Unis et l’Union européenne. Dans la conclusion de ce mémoire, nous revenons sur les faits saillants de cette recherche comparative en insistant sur le fait qu’il est complexe de protéger les données personnelles des mineurs et qu’il existe des différences importantes dans les législations et les règlements en vigueur sur le plan national et international. / This research study addresses a current concern regarding the privacy of minors online, more specifically the protection of personal data. Since the emergence of new information and communication technologies (NICT) and the introduction of Web 2.0, the protection of personal data remains a relevant and very complex issue. This issue is even more critical when it comes to minors. This research study first looks at Internet use by minors, the notion of a minor person’s vulnerability and the limitations of the current rules. It also examines the conceptual distinction between "minor" and "child" before focusing on the main aspect of violation of a minor's privacy and integrity. Later in this master’s thesis, the legislative and regulatory provisions in Canada, the United States and the European Union are examined. The final section highlights the significant differences between Canada, the United States and the European Union. In the conclusion for this dissertation, we will look back at the highlights of this comparative study, emphasizing that the task of protecting the personal data of minors is complex and that there are significant disparities in the laws and regulations in force at the national and international levels.