The aim of this bachelor thesis is to examine which adaptions Swedish e-commerce businesses have done to prepare for the new General Data Protection Regulation (GDPR). Using a qualitative method this study investigates how these companies have prepared themselves and what they have done to get their digital platforms such as websites, email and social media in order to be GDPR proof. The method which is used is semi structured interviews. The result of the study shows that the companies have been missing concrete guidelines on how the adaptions should be done from the Swedish government. The majority of the adaptions are therefor built on the businesses own adaptions of the new regulation. The conclusion reached in this thesis is that it has been hard for the companies to convert the law’s requirements into practical technical solutions.

Konceptet av sakernas internet handlar om att datorer ska kunna agera utan mänsklig interaktion. Detta gör att smarta larm med kameror själva kan avgöra när ett larm ska utlösas och kan då ta åtgärder som att ta bilder på hemmet som kameror är installerade i samt på individer. Detta skapar vissa etiska frågor kopplade till dataintegriteten. För att kunna kontrollera företagens användning av mängder data som kan genereras idag och för att ge individer rättigheter över hur deras data behandlas har EU tagit fram en förordning kallad General Data Protection Regulation (GDPR). Denna kommer att förändra utveckling och drift av smarta kameror, eftersom bilder är personuppgifter som omfattas av förordningen. Därför är tydliga strategier kring vilka förändringar företag som utvecklar eller driftar kameror behöver införa för att uppfylla GDPR kraven nödvändiga för att upprätthålla användarnas dataintegritet. Projektets syfte är därför att redogöra för huvudsakliga förändringar som behöver införas hos företag identiska till studieobjekten samtidigt som inställningen till förändringen beaktas, vilket är en nyckelfaktor till en lyckad implementering. Detta uppnås genom datainsamling via intervjuer som utfördes hos företag ledande inom utveckling och drift av smarta kameror. Resultatet bekräftar hypotesen om att kamera och säkerhetsföretag är sakkunniga inom säkerhet och integritet, samt visar att företag handskas med fem, följande, huvudsakliga förändringar: finna lösningar på insamling av informerade samtycken, dokumentation som måste bli mer utförlig, kontraktskrivning med leverantörer måste ges mer uppmärksamhet, att möjliggöra framförallt i backenden när en kund begär ut all data, samt privacy by design och ett helhetsperspektiv som behöver implementeras mer under utvecklingsprocessen. Vidare kan arbetet användas som beslutsunderlag i liknande organisationer som studieobjekten, eftersom det ger även förslag på förbättringsområden vilka har för avsikt att förstärka möjligheten till en lyckad tillfredsställelse av GDPR kraven. / The concept of the Internet of Things is about computers being able to act without human interaction. This allows smart alarms with cameras to determine themselves when an alarm is triggered and can take action like taking pictures at home that cameras are installed in as well as on individuals. This creates some ethical issues related to data privacy. In order to control companies' use of amounts of data that can be generated today and to give individuals rights over how their data is processed, the EU has developed a regulation called the General Data Protection Regulation (GDPR). This will change the development and operation of smart cameras, as images are personal data that are covered by the regulation. Therefore, clear strategies about the changes that needs to be implemented to meet the GDPR requirements is necessary to maintain users' data privacy. The purpose of the project is therefore to account for major changes that need to be introduced to companies identical to the study objects while taking into account the attitude towards the change, which is a key factor for successful implementation. This is achieved through data acquisition through interviews conducted by companies leading in the development and operation of smart cameras. The result confirms the hypothesis that camera and security companies are experts in security and integrity, as well as demonstrating that companies are dealing with five, the following major changes: finding solutions for collecting informed consent, documentation that needs to be more detailed, contracting with suppliers must be paid more attention to, make it technically possible for a customer to request and get all data, as well as Privacy by Design and an overall perspective that needs to be implemented during the development process. In addition, the work can be used as a basis for decision making in similar organizations as the study objects who develop IoT products, as it also provides suggestions for improvement areas that intend to enhance the possibility of a successful satisfaction of the GDPR requirements.

Sedan införandet av dataskyddsförordningen GDPR den 25 maj 2018 har internetanvändare i alla EU/ESS länder blivit mötta av en förfrågan om godkännande av cookies vid varje besök av en ny hemsida. Frågan ska enligt lag tydligt informera användare om att cookies används, i vilket syfte och hur länge de sparas. Beväpnad med denna information ska användaren sedan ha möjlighet att ta ett välinformerat beslut om hen godkänner webbplatsens användning av cookies och därmed insamlingen av hens personuppgifter. Denna lagstiftning gäller för samtliga webbplatser oavsett offentlig eller privat avsändare och avser att skapa ett skydd för varje individs digitala integritet. Cookies har använts i funktionssyfte sedan internets begynnelse men har under de senare åren använts med stor framgång primärt i marknadsföringssyfte i form av riktad marknadsföring av kommersiella webbplatser. Det finns stor vinning för många företag att användare godkänner dessa cookie-förfrågningar vilket gör att stor vikt läggs vid hur dessa förfrågningar designas. Dark Patterns är ett begrepp på former av konverteringsinriktad design som används för att få användare att utföra handlingar som ej gynnar dem i längden, men som skapar mervärde för aktören bakom. Dessa designval används flitigt över hela internet och har även identifierats i cookie-förfrågningar. Följande studie undersöker hur dessa cookie-förfrågningar är utformade, vilka dark patterns som finns att identifiera i deras gränssnitt samt användares inställning till 15 statliga respektive 15 kommersiella webbplatser. Data för studien har samlats in genom en kvantitativ enkätundersökning med 102 respondenter samt en kvalitativ innehållsanalys av samtliga webbplatser. Empiri från tidigare forskning har använts för att jämföra och styrka studiens slutsats. Användningen av dark patterns har identifierats på både statliga och kommersiella webbplatser men i en högre grad i den sistnämnda. Dessa designval har visats påverka användarens interaktion med förfrågan på ett sätt som är positivt för aktören. Studien har däremot även visat att en lika stor faktor för användarens medvetna beslut är det anseende aktören för webbplatsen har. Avslutningsvis visar studien att dagens internetanvändare generellt är trötta på konstanta förfrågningar med samma eller liknande information, och vad som var avsett att skapa en trygghetskänsla hos användaren har i stället bara blivit ett evigt störningsmoment. / Since the implementation of the General Data Protection Regulation (GDPR) on May 25th, 2018, users in EU/EEC countries have encountered cookie approval requests upon accessing new websites. By legal demand, these cookie prompts must provide information on the use of cookies, their purpose, and the duration of data retention. With this knowledge, users are expected to make informed decisions regarding their consent to the website's cookies and data collection utilization. This legislation applies universally to all websites, regardless of their public or private nature, to protect individuals’ digital privacy. While cookies have served functional purposes since the early days of the Internet, their recent substantial adoption for targeted marketing by commercial websites has provided significant advantages for many companies. Consequently, precise attention is placed on the design of these cookie requests themselves. Dark Patterns represent a form of conversion-oriented design tactics employed to impact users to perform certain actions that may not be beneficial in the long term but generate value for the entity implementing them. These design choices are prevalent across the internet and have also been identified within the context of cookie prompts. This study observes the design elements of such cookie prompts, identifies the presence of dark patterns within their interfaces, and examines user attitudes toward these prompts. The research analyzes 15 government websites and 15 commercial websites through a qualitative content analysis that uncovers hidden information. As a complement, an additional quantitative survey was formed by collecting data from 102 respondents. The study leverages empirical evidence from previous research to strengthen its findings and comparisons. Findings show that the use of dark patterns on both government and commercial websites is evident, with a more noticeable occurrence on commercial ones. These design choices have been observed to influence user interactions with the requests to favor the sender implementing the dark patterns. However, the research also demonstrates that the senders' reputation equally influences users' conscious decision-making process. In conclusion, the study indicates that contemporary internet users generally experience weariness due to persistent requests featuring repetitive or similar information. What was initially intended to instill a sense of user security has instead become an enduring source of disruption.

Dataskyddsförordningen (GDPR) blev den 25e maj 2018 obligatorisk att följa för alla organisationer inom Europa som samlar in och behandlar personuppgifter. Dataskyddsförordningen ersatte Personuppgiftslagen som tidigare varit den lag som inom Sverige reglerat hur organisationer får behandla personuppgifter. En central del av Dataskyddsförordningen är den enskildes rättigheter som består av 8 punkter och redogör för vilka rättigheter som en enskild har när en organisation behandlar personuppgifter. Mycket av det som tidigare gällde i personuppgiftslagen har utökats genom den enskildes rättigheter och därmed har organisationer som behandlar personuppgifter fått förändra sin verksamhet för att möta de nya kraven. Syftet med arbetet är att reda ut på vilka sätt som den enskildes rättigheter har påverkat en organisation för att kunna efterleva de nya kraven. Genom en litteraturstudie identifierades forskning som publicerades innan Dataskyddsförordningen blev obligatorisk som analyserar och redogör för hur organisationer bör påverkas av Dataskyddsförordnigen. Med hjälp av en kvalitativ metod beståendes av intervjuer genomfördes en fallstudie för att ta reda på vilken faktiskt påverkan som den enskildes rättigheter inneburit i form av vilka anpassningar som organisationen behövt göra för att anses vara i fas med lagkraven. Resultatet analyserades och jämfördes med den forskning som identifierats för att kunna dra slutsatser kring den faktiska påverkan som rättigheterna inneburit. Resultatet visar på vilka sätt som den enskildes rättigheter har påverkat organisationen i form av nya administrativa processer, rutiner och teknisk funktionalitet för att kunna möta de krav som den enskildes rättigheter kräver. / The General Data Protection Regulation (GDPR) became mandatory on 25 May 2018 for all organizations within Europe who collect and process personal data. The General Data Protection Regulation replaced the Personal Data Act, which previously was the law that regulated in Sweden how organizations may process personal data. A central part of the GDPR is the individual's rights which consist of 8 rights and describe what rights an individual has when an organization processes their personal data. Much of what previously applied in the Personal Data Act has been expanded through the individual's rights and thus organizations that process personal data have had to change their organization to meet the new requirements. The purpose of this thesis is to sort out in what ways the individual's rights have affected an organization in order to comply with the new requirements. By the use of a literature study, research has been identified that was published prior to the GDPR became mandatory which analyzes and describes how organizations should be affected by the data protection ordinance. With the help of a qualitative method, interviews were conducted via a case study to find out what actual impact the individual's rights lead to in the form of which adjustments the organization needed to make in order to be considered in phase with the legal requirements. The result of the interviews was analyzed and compared with the previously identified research to be able to draw conclusions about the actual impact of the new rights. The result shows in what ways the individual's rights have affected the organization in the form of new administrative processes, routines and technical functionality in order to meet the requirements that the individual's rights require.

On May 25, 2018, the Directive, 95/46/EC, is superseded by the General Data Protection Regulation (GDPR), (EU) 2016/679. Companies and organizations will have to revise routines, restructure organizations' processes and rebuild IT systems. The purpose of this study is to identify the critical success factors for implementing GDPR in the Swedish banking and finance sector. The study carried out a literature study as a foundation for the qualitative interviews with which empirical was gathered. Subjects for interviews was data protection officers (DPO) at four banks, as well as the Swedish Data Protection Authority and Forum för dataskydd, a national forum for DPO:s. The study's results showed a number of significant success factors for implementation processes. Based on these success factors, three were identified as critical to the implementation of GDPR from a computer science perspective: data governance, privacy-by-design, and documentation. / Den 25 maj 2018 ersattes dataskyddsdirektivet, 95/46/EG, med EU-förordningen 2016/679, General Data Protection Regulation (GDPR). För företag och organisationer kommer detta bland annat innebära nya rutiner, omstrukturering av organisationers processer och ombyggnation av IT-system. Syftet med denna studie är att identifiera de kritiska framgångsfaktorerna för implementering av GDPR inom den svenska bank- och finanssektorn. I studien genomfördes litteraturstudie som låg till grund för insamlande av empiri genom kvalitativa intervjuer med dataskyddsombud vid fyra banker. Intervjuer genomfördes även med Datainspektionen och Forum för dataskydd. Studiens resultat visade på ett flertal betydande framgångsfaktorer för implementeringsprocesser. Utifrån dessa framgångsfaktorer identifierades tre som kritiska för implementation av GDPR ur ett datavetenskapligt perspektiv: data governance, privacy-by-design samt dokumentation.

As modern technology continues to affect civilization, the issue of electronic rights grows in a global conversation. The right to be forgotten is a data protection regulation specific to the European Union but its consequences are creating an international stir in the fields of mass communication and law. Freedom of expression and privacy rights are both founding values of the United States which are protected by constitutional amendments written before the internet also changed those fields. In a study that analyzes the legal process of when these two fundamental values collide, this research offers insight into both personal and judicial views of informational priority. This thesis conducts a legal analysis of cases that cite the infamous precedents of Melvin v. Reid and Sidis v. F-R Pub. Corp., to examine the factors on which U.S. courts of law determinewhether freedom or privacy rules.

The position of the data protection officer in the light of labour law Abstract The data protection officer is a specialist in law and practices in the area of data protection. His task is to help to controller and processor to fulfil their obligations associated with data processing. He can perform his function as an employee of a controller or a processor or on the basis of a service contract. His status has certain specifications that the character of some labour law provisions doesn't count with. Although uncertainty about the possibility to give him a dismissal or ask him for damages does not cause problems due to only recent changes of legal regulation yet, disputes that may arise in the future will be expected not only before the Czech courts. The main problem of the issue is, whether the labour law regulation can be extended without further delay to the employed data protection officer in the light of his specific independent position, which is guaranteed him by data protection law. The aim of the thesis is to try to solve problematic aspects of the establishment of the data protection officer in the light of Czech labour law institutes. The main purpose of the thesis is to assess the way in which the prohibition of penalizing the data protection officer is projected in the form of the employment...

New privacy regulations bring new challenges to organizations that are handling and processing personal data regarding persons within the EU. These challenges come mainly in the form of policies and procedures but also with some opportunities to use technology often used in other sectors to solve problems. In this thesis, we look at the new General Data Protection Regulation (GDPR) in the EU that comes into full effect in May of 2018, we analyze what some of the requirements of the regulation means for the industry of processing personal data, and we look at the possible solution of using hardware security modules (HSMs) to reach compliance with the regulation. We also conduct an empirical study using the Delphi method to ask security professionals what they think the most important aspects of securing personal data, and put that data in relation to the identified compliance requirements of the GDPR to see what organizations should focus on in their quest for compliance with the new regulation. We found that a successful implementation of HSMs based on industry standards and best practices address four of the 35 identified GDPR compliance requirements, mainly the aspects concerning compliance with anonymization through encryption, and access control. We also deduced that the most important aspect of securing personal data according to the experts of the Delphi study is access control followed by data inventory and classification.

The aim of this essay is to examine how the swedish municipality of Botkyrka hasendeavoured to meet the legal obligations prescribed by the General Data ProtectionRegulation (GDPR) and what impact this legislation is expected to have on the informationmanagement-structures currently in use within the municipality itself. Research has beenperformed through a case study consisting of semi-structured interviews. The study showsthat several important measures has been taken in order to meet the demands set by theregulation, but that the absence of a conclusive swedish legislation on the matter is keepingthe municipality from knowing what exactly is expected of them.

The European General Data Protection Regulation (GDPR) will soon come into force, it is a regulation which spells out increased compliance demands for data protection by design. Failure to comply can lead to huge financial penalties, something IT companies controlling and processing personal data should not ignore. As the one-year countdown begins, studies have revealed under-preparedness of organizations affected by the GDPR. None of the studies so far has offered an integrated overview of the barriers faced by IT companies to embrace data protection by design. This study aims to help fill this gap and to investigate. A study based on expert’s knowledge has been carried out, using an integrated approach. Five experts from advocacy, legal and IT industry were interviewed, aiming to answer the following research question: “What are the barriers for IT companies to embrace data protection by design and how should these barriers be overcome?” An integrated overview of the barriers will then be presented, which includes the managerial, engineering and legal obstacles. The study goes on to present pathways to embrace data protection by design. A key contribution to this study is that managerial, legal and engineering barriers have shown to be directly interconnected and influence on each other. As such a much broader view must be undertaken to fully understand the different barriers that face IT companies in embracing data protection by design.