This diploma thesis solves the proposal for personal data protection according to the Regulation (EU) 2016/679 of 27 April 2016 (generally known under the abbreviation GDPR) in a chosen company. The thesis begins with a theoretical background followed by the part devoted to the analysis of the company. These results are further confronted with the own solution which is presenting the proposals and recommendations to bring the selected company into line with the GDPR.

This thesis analyses current state of the system for implementation of standard ISO 27701: 2019 extention. This standard extends already established standard ISO 27001. The thesis evaluates set of controls to the requirements of standard ISO 27701: 2019. Theoretical part contains information regarding the information security, describes a set of ISO 27000 standards as well as European and Czech legal acts related to information security. Following analysis of the company is performed with the application of security measures while implementing the extension standard ISO 27701. Contribution of this thesis is evaluation of the analysis which results from implementation of recommended standard to address the increased number of security threats and the protection of security information.

The full enforcement of the General Data Protection Regulation (GDPR) that began on May 25, 2018 forced any organization that collects and/or processes personal data from European Union citizens to comply with a series of stringent and comprehensive privacy regulations. Many software organizations struggled to comply with the entirety of the GDPR's regulations both leading up and even after the GDPR deadline. Previous studies on the subject of the GDPR have primarily focused on finding implications for users and organizations using surveys or interviews. However, there is a dearth of in-depth studies that investigate compliance practices and compliance challenges in software organizations. In particular, small and medium enterprises are often neglected in these previous studies, despite small and medium enterprises representing the majority of organizations in the EU. Furthermore, organizations that practice continuous integration have largely been ignored in studies on GDPR compliance. Using design science methodology, we conducted an in-depth study over the span of 20 months regarding GDPR compliance practices and challenges in collaboration with a small, startup organization. Our first step helped identify our collaborator's business problems. Subsequently, we iteratively developed two artifacts to address those business problems: a set of privacy requirements operationalized from GDPR principles, and an automated GDPR tool that tests these GDPR-derived privacy requirements. This design science approach resulted in five implications for research and for practice about ongoing challenges to compliance. For instance, our research reveals that GDPR regulations can be partially operationalized and tested through automated means, which is advantageous for achieving long term compliance. In contrast, more research is needed to create more efficient and effective means to disseminate and manage GDPR knowledge among software developers. / Graduate

This thesis investigates how to remove personal data from logs using machine learning when rule-based scripts are not enough and manual scanning is too extensive. Three types of machine learning models were created and compared. One word model using logistic regression, another word model using LSTM and a sentence model also using LSTM. Data logs were cleaned and annotated using rule-based scripts, datasets from various countries and dictionaries from various languages. The created dataset for the sentence based model was imbalanced, and a lite version of data augmentation was applied. A hyperparameter optimization library was used to find the best hyperparameter combination. The models learned the training and the validation set well but did perform worse on the test set consisting of log data from a different server logging other types of data. / Detta examensarbete undersöker om det är möjligt att skapa ett program som automatiskt identifierar och tar bort persondata från dataloggar med hjälp av maskinlärning. Att förstå innebörden av vissa ord kräver också kontext: Banan kan syfta på en banan som man kan äta eller en bana som man kan springa på. Kan en maskinlärningsmodell ta nytta av föregående och efterkommande ord i en sekvens av ord för att få en bättre noggrannhet på om ordet är känsligt eller ej. Typen av data som förekommer i loggarna kan vara bland annat namn, personnummer, användarnamn och epostadress. För att modellen ska kunna lära sig att känna igen datan krävs det att det finns data som är färdigannoterad med facit i hand. Telefonnummer, personnummer och epostadress kan bara se ut på ett visst sätt och behöver nödvändigtvis ingen maskininlärning för att kunna pekas ut. Kan man skapa en generell modell som fungerar på flera typer av dataloggar utan att använda regelbaserade algoritmer. Resultaten visar att den annoterade datan som användes för träning kan ha skiljt allt för mycket från de loggar som har testats på (osedd data), vilket betyder att modellen inte är bra på att generalisera.

Data collection and online personalization has become essential part of modern marketing, and thus, embedded into consumer’s everyday life. This has emerged a lot of negative attention in the media and privacy concerns among consumers – however, their attitudes towards privacy seems to be controversial with lack of privacy enhancing behavior. The purpose of this study was to find out what is consumers take on online personalization, data collection and GDPR. In order to the tackle the causing reasons of such perceptions, focus group discussions were performed. The emerging thoughts were analyzed with the concepts of privacy paradox and information asymmetry – how structural imbalance between the advertisement network, companies and consumers impacted to their thinking about personalization and which factors caused the unwillingness to enhance one’s privacy, despite the attitudes that would predict different behavior. The results showed, that many respondents do not mind personalization if they perceive it relevant. However, the intrusive nature of its practices made the participants, directly or indirectly, reluctant towards it, as it was highlighted that it is not personalization per se that made the respondents uncomfortable, but how it was done. Due to the advertisement networks’ opaque nature, the participants founded challenging to comprehend how personalization was performed. Thus, conspiracy theories about surveillance, such as tapping via smartphone, were broad up to explain companies’ ability to know and target them so well. The main channel for companies to inform consumers about their privacy policy is terms and conditions. However, due to several reasons, the decision making for one’s privacy face many hinders, that may influence in how consumers perceive their privacy and how their personal data is collected and used. A controversiality between GDPR’s, companies’ and consumers’ view on privacy self-management is evident, as the regulation and companies rely too much on consumer’s own responsibility.

>Magister Scientiae - MSc / Headline reports on data breaches worldwide have resulted in heightened concerns about information security vulnerability. In Africa, South Africa is ranked among the top ‘at-risk’ countries with information security vulnerabilities and is the most the most cybercrime-targeted country. Globally, such cyber vulnerability incidents greatly affect the education sector, due, in part, to the fact that it holds more Personal Identifiable Information (PII) than other sectors. PII refers to (but is not limited to) ID numbers, financial account numbers, and biomedical research data. In response to rising threats, South Africa has implemented a regulation called the Protection of Personal Information Act (POPIA), similar to the European Union General Data Protection Regulation (GDPR), which seeks to mitigate cybercrime and information security vulnerabilities. The extent to which African institutions, especially in South Africa, have embraced and responded to these two information security regulations remains vague, making it a crucial matter for biomedical researchers. This study aimed to assess whether the participating universities have proper and reliable information security practices, measures and management in place and whether they fall in line with both national (POPIA) and international (GDPR) regulations. In order to achieve this aim, the study undertook a qualitative exploratory analysis of information security management across three universities in South Africa. A Technology, Organizational, and Environmental (TOE) model was employed to investigate factors that may influence effective information security measures. A Purposeful sampling method was employed to interview participants from each university. From the technological standpoint, Bring Your Own Device (BYOD) policy, whereby on average, a student owns and connects between three to four internet-enabled devices to the network, has created difficulties for IT teams, particularly in the areas of authentication, explosive growth in bandwidth, and access control to security university servers. In order to develop robust solutions to mitigate these concerns, and which are not perceived by users as overly prohibitive, executive management should acknowledge that security and privacy issues are a universal problem and not solely an IT problem and equip the IT teams with the necessary tools and mechanisms to allow them to overcome commonplace challenges. At an organisational level, information security awareness training of all users within the university setting was identified as a key factor in protecting the integrity, confidentiality, and availability of information in highly networked environments. Furthermore, the University’s information security mission must not simply be a link on a website, it should be constantly re-enforced by informing users during, and after, the awareness training. In terms of environmental factors, specifically the GDPR and POPIA legislations, one of the most practical and cost-effective ways universities can achieve data compliance requirements is to help staff (both teaching and non-teaching), students, and other employees understand the business value of all information. Users which are more aware of sensitivity of data, risks to the data, and their responsibilities when handling, storing, processing, and distributing data during their day to day activities will behave in a manner that would makes compliance easier at the institutional level. Results obtained in this study helped to elucidate the current status, issues, and challenges which universities are facing in the area of information security management and compliance, particularly in the South African context. Findings from this study point to organizational factors being the most critical when compared to the technological and environmental contexts examined. Furthermore, several proposed information security policies were developed with a view to assist biomedical practitioners within the institutional setting in protecting sensitive biomedical data.

This thesis analyzes how the General Data Protection Regulation (GDPR) and the European Union was portrayed in selected Czech and German printed media throughout the year 2018 and investigates whether Euroscepticism - in its widest sense - expresses itself within the articles. The research on Euroscepticism in media so far has largely focused on "historic" events and "significant" questions of the European integration, not on technical-legal topics, i.e. topics with presumably lesser impact on the future course of the European project. An analysis of Euroscepticism in media texts dealing with a specific EU legislative act has so far been lacking. The paper at hand therefore examines whether Euroscepticism manifests itself also in connection to such topics. As denying and/or criticizing EU's policies is accepted by most academics as an expression of Euroscepticism, next to denying the EU as such, this study defines Euroscepticism as any criticism on part of the EU and the GDPR, since this regulation can be understood as embodiment of EU's policy on data protection. The paper uses a comparative research design, using the method of content analysis of six printed daily newspapers, namely Frankfurter Allgemeine Zeitung, Süddeutsche Zeitung, Bild, Mladá fronta DNES, Právo, and Blesk. The results...

Protection of Personal Data Prior to Employment Abstract The development of new technologies has completely changed the view on how personal data is being processed in labor relations. Screening job seekers on social networks or using artificial intelligence to analyze a candidate's predispositions are, at first sight, much less intense and conspicuous forms of invasion of privacy than traditional surveillance methods such as the use of security cameras. Employees and job seekers are therefore in a very disadvantageous position, which has not yet been reflected on the level of EU legislation. The legal regulation of personal data protection is very specific in its abstraction. When processing personal data, it is necessary to keep in mind the basic principles of data handling, and each processing should therefore be (among other things) purposefully limited, minimized, transparent and correct. However, these concepts are so abstract that their interpretation is the subject to countless debates even among personal data protection experts. In view of the above, it is understandable that it may be very difficult for many employers to know what specific measures of data protection are to be applied. For this reason, in practice, there is considerable formalism in the application of some institutes which stems...

No description available.

>Magister Scientiae - MSc / Headline reports on data breaches worldwide have resulted in heightened concerns about information security vulnerability. In Africa, South Africa is ranked among the top ‘at-risk’ countries with information security vulnerabilities and is the most cybercrime-targeted country. Globally, such cyber vulnerability incidents greatly affect the education sector, due, in part, to the fact that it holds more Personal Identifiable Information (PII) than other sectors. PII refers to (but is not limited to) ID numbers, financial account numbers, and biomedical research data.