E-commerce and transaction on the internet is getting more and more common in every individual’s life. More than 40 % of the worldwide Internet users have bought or made transactions through the internet. This means that there is more than 1 billion online buyers and these numbers will continue to grow. Due to the growth of E-commerce, organizations are searching and creating new technologies for obtaining and processing data regarding consumer’s privacy information. This tends to become a concern for the consumer about how the organizations treat and user the personal information about a specific individual, the purpose for this study is to examine and compare how big and small organizations works with privacy policies and personal information. The target group for this study is organizations that collects and obtain personal information. This is a comparative study with a Qualitative approach. Theory and collected data from the organizations have been compared, the interview method conducted was Semi- structured interviews. One small and one big organization have been interviewed and the collected data from the two organizations has then been compared against each other to find differences and similarities about how a small and a big organization work with privacy. The selection of the respondents for the interviews have been selected through different criteria’s where one the organizations works with E-commerce. The conclusion of this study is that there are no concrete differences regarding privacy policies between the two organizations that participated in this study although some small differences were found regarding the development of the privacy policies.

The authors of this study analysed the increasing use of personalized marketing and consumer concerns regarding the access to personal information. The purpose was to find out how companies could react to these concerns. Several theoretical concepts were explored, such as Personal Data, Personalized Marketing, Privacy Concerns, Privacy Policies, Consumer Trust and Consumer Behaviour. Facebook Inc. was analysed as an example to address the problem. An online survey was conducted on university students and two interviews were performed with representatives from the Data Inspection Board in Sweden. The main findings were that individuals seem to approve of personalized marketing but are concerned about their privacy. Companies should therefore inform their consumers on how personal data is used for personalized marketing and respect their rights and take governmental regulations into consideration.

A privacy-policy matching engine may support users in determining if their privacy preferencesmatch with a service provider’s privacy policy. Furthermore, third parties, such asData Protection Agencies (DPAs), may support users in determining if a service provider’sprivacy policy is a reasonable privacy policy for a given service by issuing recommendationsfor reasonable data handling practises for different services. These recommendations needto be matched with service provider’s privacy policies, to determine if a privacy policy isreasonable or not, and with user’s privacy preferences, to determine if a set of preferencesare reasonable or not.In this thesis we propose a design of a new privacy-policy language, called the UPrIMPolicy Language (UPL). UPL is modelled on the PrimeLife Policy Language (PPL)and tries to improve some of PPL’s shortcomings. UPL also tries to include informationdeemed mandatory for service providers according to the European Data Protection Directive95/46/EC (DPD). In order to demonstrate the features of UPL, we developed aproof-of-concept matching engine and a set of example instances of UPL. The matchingengine is able to match preferences, policies and recommendations in any combination.The example instances are modelled on four stages of data disclosure found in literature.

No description available.

Made available in DSpace on 2016-08-17T14:53:00Z (GMT). No. of bitstreams: 1 Simara Vieira da Rocha.pdf: 792628 bytes, checksum: 3ed7f28da8fc68945a5845f799bd0281 (MD5) Previous issue date: 2005-09-30 / This work describes a method for the elicitation of requirements based on goals for electronic commerce systems in agreement with security and privacy polices of a site. The method integrates the UWA approach [33] with the GBRAM method [6] for developing requirements and policies for secure electronic commerce systems. The resulting method aims to guarantee that existent security and privacy policies do not become obsolete after the adoption of new functionalities to a site. For this reason, the method provides means to set the elicited requirements in conformity with these new functionalities. On the other hand, organizations that have not established their policies yet, the proposed approach suggests some models through which it is possible to create such policies. At last, the proposed method presents a model for the document of requirements specification in agreement with the approach described in this work, as way of establishing a standard means to specify software requirements that can be as useful for the developing teams, in the attempt of facilitating the construction of systems, as for the analyzing teams, in the future maintenances or increment of functionalities to a site. / Este trabalho descreve um método para elicitação de requisitos baseado em objetivos para sistemas de comércio eletrônico, em conformidade com as políticas de segurança e privacidade existentes em um site. O método é originado pela integração das abordagens UWA [33] com a instanciação do método GBRAM [6] para o desenvolvimento de políticas e requisitos de sistemas de comércio eletrônicos seguros. O método resultante tem por objetivo garantir que as políticas de segurança e privacidade existentes nunca se tornem obsoletas com a adoção de novas funcionalidades a um site. Para tanto, provê meios para que os requisitos elicitados estejam em conformidade com as mesmas. Por outro lado, caso as organizações não tenham estabelecido suas políticas, a abordagem proposta sugere modelos através dos quais é possível a criação de tais políticas. Por fim, o método proposto ainda apresenta um modelo para o documento de especificação de requisitos, como forma de estabelecer um meio padrão para especificar requisitos de software, o qual poderá ser útil tanto para as equipes de desenvolvimento, na tentativa de facilitar a construção de sistemas, quanto para as equipes de análises, nas futuras manutenções ou acréscimo de funcionalidades ao site.

Users today are concerned about how their information is collected, stored and used by Internet sites. Privacy policy languages, such as the Platform for Privacy Preferences (P3P), allow websites to publish their privacy practices and policies in machine readable form. Currently, software agents designed to protect users' privacy follow a "take it or leave it" approach when evaluating these privacy policies. This approach is inflexible and gives the server ultimate control over the privacy of web transactions. Privacy policy negotiation is one approach to leveling the playing field by allowing a client to negotiate with a server to determine how that server collects and uses the client's data. We present a privacy policy negotiation protocol, "Or Best Offer", that includes a formal model for specifying privacy preferences and reasoning about privacy policies. The protocol is guaranteed to terminate within three rounds of negotiation while producing policies that are Pareto-optimal, and thus fair to both parties. That is, it remains fair to both the client and the server.

This thesis discusses the General Data Protection Regulation (GDPR) and its impact on individuals since the GDPR became effective in May 2018. The regulation has had significant implications for companies and organizations that handle user data as it provides fines if they are non-compliance. However, the GDPR was created to protect individuals' privacy and personal data in the European Union (EU), which has added many complexities to companies and individuals. This study aims to provide an experiment with individuals in Sweden to document their knowledge of the regulations and their ability to exercise the rights granted and to know their opinions through interviews with 19 samples of individuals. The research deals with the third chapter more than other chapters of the GDPR. The results revealed a lack of awareness among the participants, with only a small percentage having prior knowledge of the GDPR and lacking a clear understanding of the implications and practical implementation of these rights, despite the participants' enthusiasm when explaining the rights to them. Participants acknowledged the importance of their data and assessed the provisions of the GDPR. They emphasized rights such as access, rectification, and erasure as necessary to protect privacy. After obtaining nearly complete knowledge, the participants could exercise and find the GDPR rights entirely on Swedish sites, except those who were able to find the rights with only a little knowledge. The study highlights the need to enhance individuals' awareness of the GDPR and improve transparency and accessibility of privacy policies.

<p dir="ltr">Protecting personal information is growing increasingly important to the general public, to the point that major tech companies now advertise the privacy features of their products. Despite this, it remains challenging to implement applications that do not leak private information either directly or indirectly, through timing behavior, memory access patterns, or control flow side channels. Existing security and cryptographic techniques such as secure multiparty computation (MPC) provide solutions to privacy-preserving computation, but they can be difficult to use for non-experts and even experts.</p><p dir="ltr">This dissertation develops the design, theory and implementation of various language-based techniques that help programmers write privacy-critical applications under a strong threat model. The proposed languages support private structured data, such as trees, that may hide their structural information and complex policies that go beyond whether a particular field of a record is private. More crucially, the approaches described in this dissertation decouple privacy and programmatic concerns, allowing programmers to implement privacy-preserving applications modularly, i.e., to independently develop application logic and independently update and audit privacy policies. Secure-by-construction applications are derived automatically by combining a standard program with a separately specified security policy.</p><p><br></p>

Este relatório aborda o desenvolvimento de um aplicativo voltado para a segurança da informação em Smart TVs. No contexto da Internet das Coisas, nem todos estão cientes de que muitas informações de cunho privado podem ser coletadas por meio do aparelho televisivo sem o conhecimento do usuário-telespectador. O aplicativo busca justamente oportunizar esse conhecimento, tornando o cliente da Smart TV menos vulnerável no cenário contemporâneo. / This report addresses the development of an application for information security in Smart- TVs. In the internet scene of things, not everyone is aware that much private information can be collected through the television set without the knowledge of the user and viewer. The application precisely seeks to provide this knowledge to the user and viewer, thus making it less vulnerable in the contemporary scenario. / Dissertação (Mestrado)

We adapt existing approaches for privacy-preserving publishing of linked data to a setting where the data are given as Description Logic (DL) ABoxes with possibly anonymised (formally: existentially quantified) individuals and the privacy policies are expressed using sets of concepts of the DL EL. We provide a chacterization of compliance of such ABoxes w.r.t. EL policies, and show how optimal compliant anonymisations of ABoxes that are non-compliant can be computed. This work extends previous work on privacy-preserving ontology publishing, in which a very restricted form of ABoxes, called instance stores, had been considered, but restricts the attention to compliance. The approach developed here can easily be adapted to the problem of computing optimal repairs of quantified ABoxes.