“Vi använder cookies för att förbättra webbplatsen och din användarupplevelse”, är troligtvis en mening som många känner igen. Idag är det svårt att använda internet utan att stöta på små pop-up-meddelanden som vill ha ditt samtycke kring datainsamling, så kallade cookies. Medvetenhet och förståelse kring cookies är en grundläggande del i EU´s General Data Protection Regulation (GDPR). Den infördes för att ge användare makt över sin personliga data, delvis genom informerat samtycke. Trots lagen godkänner majoriteten av användarna cookies utan att reflektera. Att inte ge samtycke till datainsamling genom cookies tillhör ovanligheten, vilket gör det intresseväckande att undersöka vilka faktorer som samspelar med valet att faktiskt neka cookies. Studien syftar till att undersöka hur tre faktorer; ålder, kunskap och oro, påverkar internetanvändares inställning till att neka cookies. En kvantitativ metod, i form av en besöksenkät har använts för att samla in empiri. Insamlingen har skett utanför mataffärer i tre olika kommuner i Västra Götalandsregionen, och resulterade i sammanlagt giltiga 200 svar. Resultaten från studien visar att ålder och oro är faktorer som kan leda till att internetanvändare nekar cookies; en tredje faktor kunskap visar däremot inget samband med nekandet. Både internetanvändare som lämnar ifrån sig data, och aktörer som hanterar personlig data kan dra nytta av resultatet från studien. / "We use cookies to improve your experience on the website". This is most likely a phrase that you may recognize. Today, it is difficult to use the internet without encountering small pop-up messages asking for your consent regarding data collection through so-called cookies. Awareness and understanding regarding cookies are two fundamental parts of the EU's General Data Protection Regulation (GDPR). The law exists to provide internet users with control over their own personal data, through informed consent. Despite the law, the vast majority of users accept cookies without reflecting. Denying consent to data collection through cookies is an unusual choice among users, which makes it interesting to investigate which factors affect the choice to reject cookies. The study aims to investigate three factors; age, cookie knowledge and privacy concern, and how they affect internet users' attitudes towards rejecting cookies online. A quantitative method, in the form of a public survey, was conducted in three cities in the Swedish region Västra Götaland. Empirical evidence was collected outside grocery stores where a total of 200 responses were collected. The results from the study show a connection between rejecting cookies and the factors age as well as privacy concerns. No correlation between cookie knowledge and cookie rejection could be provided. Internet users who provide data, as well as actors who handle personal data could benefit from this study. The study is conducted in Swedish.

Den expansiva digitala utvecklingen har bidragit till nya avancerade produkter och tjänster, många av dessa hjälper oss med dagliga bestyr och underlättar vardagen. En virtuell assistent är en produkt som med hjälp av artificiell intelligens är designad för att förenkla vardagen. För att kunna uppnå sitt syfte krävs insamling av data, vilket konsumenten själv måste godkänna. Därmed blir det ett ställningstagande gentemot bekvämlighet i användning av virtuella assistenter och förhållande till integritet. I denna undersökning studeras den komplexa relationen till integritet hos konsumenterna, när det kommer till nytta och strategiskt utnyttjande vid godkännande av datainsamling. Dessutom undersöks hur konsumenterna tror att utvecklingen av assisterna kommer att se ut i framtiden. Aspekterna som behandlas är, enligt tidigare forskning i ämnet, kritiska för klyftan som bildas mellan användning och synen på datainsamling kopplat till integritet. Därför har ämnet undersökts på en djupgående nivå genom intervju med sju respondenter givit sin syn på det hela Slutsatserna som undersökningen presenterar grundas med teori och den insamlade empirin, som visar på att det existerar ett komplext förhållande mellan integritet och datautlämning i samband med virtuella assistenter. Resultatet visar på att behovet av användning i många fall väger tyngre än personlig integritet, men det finns ingen tydlig gräns mellan variablerna. Studien drar dessutom slutsatsen att det finns en utvecklingspotential, både funktionellt och fysiskt. Däremot finns det också en kritisk inställning gentemot utvecklingen när det kommer till utbredning av datainsamling. / The expansive digital development has contributed to new advanced products and services, many of which help us with daily tasks and make everyday life easier. A virtual assistant is a product that, with the help of artificial intelligence, is designed to simplify life. In order to be able to achieve their purpose, collection of data is required, which the consumer must approve themselves. Thus, it becomes a stance towards convenience in the use of virtual assistants and the relationship towards integrity. This study examines the complex relationship against consumer integrity, when it comes to utility and strategic utilization of approving data collection. The study also examines how consumers believe that the development of virtual assistants will appear in the future. The aspects that are treated are, according to previous research in the subject, critical of the gap that is formed between use and the view of data collection linked to integrity. Therefore, the subject has been investigated at on a depth level through interviews with seven respondents who have given their views on the subject. The conclusions that the study presents are based on theory and the collected empirical data, which shows that there is a complex relationship between integrity and data disclosure in virtual assistants. The results show that the need for usage in many cases outweighs personal integrity, but there is no clear boundary between these variables. The study also concludes that there is a development potential, both functionally and physically. Although, there is a critical attitude towards the development when it comes to the expansion of data collection.

In Sweden, camera surveillance in places where the public own access is regulated by a permit. This entails a lack of permit requirement for camera surveillance in places where the public does not own access. Such places can consist of a privacy- sensitive character. Surveillance constitutes processing of personal data where- upon the General Data Protection Regulation (GDPR) must be complied with.Article 6 of the GDPR stipulates various legal bases that must be met in the processing of personal data. The ones who conduct surveillance in places where the public does not own access often fails to make correct legal assessments of Article 6(1)(e) and 6(1)(f) of the GDPR, as displayed by various supervisory de- cisions issued by the Swedish Authority for Privacy Protection. In this light, the purpose of the thesis is to examine and analyze how the ones who conduct sur- veillance and the Swedish Authority for Privacy Protection consider the personal integrity of the camera monitored individual in the assessments of Article 6(1)(e) and 6(1)(f) of the GDPR during camera surveillance without permit requirement in places where the public does not own access. Because of the differences be- tween the legal assessments made by the ones who conduct camera surveillance and the Swedish Authority for Privacy Protection, the thesis also intends to shed light on the consequences that arise for the camera monitored individual by the fact that their personal integrity is assessed in different ways.The thesis also aims to evaluate the Swedish Authority for Privacy Protec- tions’ supervisory work in relation to both personal integrity and the compliance with Article 6(1)(e) and 6(1)(f) of the GDPR during camera surveillance without permit requirement in places where the public does not own access. The Swedish Authority for Privacy Protections’ supervisory work is important as most of the camera surveillance takes place without a permit requirement and the fact that there is a lack of knowledge prevailing to the number of cameras in use. It is important that the Swedish Authority for Privacy Protections’ supervisory work is well-functioning since the ones who conduct surveillance carry out the legal assessments incorrectly. The risk with insufficient supervisory work is that per- sonal integrity is violated and that the GDPR is ineffectual in the long run.In general, it can be said that the legal assessments of Article 6(1)(e) and 6(1)(f) of the GDPR are poorly carried out by both the ones who conduct surveillance and the Swedish Authority for Privacy Protection. This primarily affects the cam- era monitored individuals’ personal integrity. Because of the indications of short- comings in the supervisory work, there are several improvement measures that can be taken to maintain personal integrity and ensure that the Swedish Authority for Privacy Protection continue to constitute an important function.

Nowadays, the long-term identifier of a user in a mobile network, namely International Mobile Subscriber Identity or IMSI, is transmitted in clear text over the radiointerface. Given that this interface is used as a shared medium, anyone with a radio transceiver and processing software can thus read such identifier. This fact constitutes a threat to user privacy, considering that the user is traceable by following the presence of the identifier in the network. Moreover, the menace has been known in the literature for the last 25 years, but no countermeasures have been deployed because the severity was judged not to be sufficiently high. However, the current situation is different. One the one hand, the user is made more vulnerable: the needed equipment for catching IMSIs over the radio interface is becoming cheaper, while user-related connected devices are arising in the form of Internet of Things. On the other hand, mobile devices are now computationally more powerful, and the upcoming standardization of 5G represents an opportunity to address such issues. This dissertation presents a proposal to encrypt the IMSI based on Elliptic Curve Integrated Encryption Scheme, a public-key approach in which the long-term subscription identifier is concealed over the radio interface. By doing so, the IMSI is never publicly disclosed, and thus privacy is enhanced. Besides, research was conducted to show the technical feasibility of the proposal. First, the impact of the encrypted identifier on the network was studied. Secondly,the execution time needed for Android devices to perform encryption operations was measured. In both cases, the results were favorable, drawing the conclusion that there are no impediments to the adoption of the presented solution. The Thesis was developed in cooperation with Ericsson AB, Security Research. / Den långsiktiga identifieraren för en användare i ett mobilt nätverk, IMSI (International Mobile Subscriber Identity), överförs i klartext via radiogränssnittet. Med detta gränssnitt som delat medium kan någon med en radiomottagare och mjukvara läsasåna identierare. Detta utgör ett hot mot användarnas personliga integritet med tanke på att användaren kan spåras genom att följa förekomsten av identifierare i nätverket. Dessutom har hotet varit känt under de senaste 25 åren, men inga åtgärder har använts eftersom att risken bedömdes inte vara tillräckligt hög. Däremot är den nuvarande situationen annorlunda. Å ena sidan är användaren mer sårbar: den utrustning som behövs för att fånga IMSI över radiogränssnittet blir billigare medan antalet användarrelaterade anslutna enheter ökar. Å andra sidan kan moderna mobila enheter utföra mycket mer beräkningar, och den kommande standardiseringen av 5G utgör en möjlighet att lösa sådana problem. Rapporten presenterar ett förslag för att kryptera IMSI baserat på ECIES (Elliptic Curve Integrated Encryption Scheme), en asymmetrisk-kryptografi algoritm där den långsiktiga identifieraren är dold över radiogränssnittet. Genom att göra så avslöjas aldrig IMSI, och därmed förbättras den personliga integriteten. Dessutom har forskning bedrivits för att visa den tekniska genomförbarheten avförslaget. Först studerades effekten av den krypterade identifieraren i nätverket. Sedan mättes exekveringstiden som krävs för Android-enheter för att utföra krypteringsoperationer. I båda fallen var resultaten gynnsamma, och därav dras slutsatsen att det inte finns några hinder för antagandet av den presenterade lösningen. Denna rapport framställdes i samarbete med Ericsson AB, Security Research.

Sammanfattning Vi lever i en alltmer digitaliserad värld där utvecklad teknik kan bidra till att lösa flertalet samhällsproblem. Till exempel är intresset av avancerad AI-teknik inom sjukvård alltmer efterfrågat. AI-teknik har stor potential att stödja sjukvårdspersonal och individer, förkorta köer och förbättra vården. Tekniken bygger på insamlandet av stora mängder data som ska programmeras till att härma intelligent beteende. Åtskilliga känsliga personuppgifter behandlas i och med insamlandet av denna data. Inom ramen för den pågående debatten om personlig integritet skapas samtidigt en potentiell konfliktyta där företagshemligheter riskerar att avslöjas när information lämnas ut vid utövandet av enskildas dataskyddsrättigheter.  Konfliktytan aktualiseras till exempel om registerutdraget inkluderar delar av företags affärsplaner, arbetsmetodik och teknikens uppbyggnad. Ett annat exempel rör systematiskt utlämnande av personuppgifter efter begäran från en mängd registrerade, där sammanställningen i sig kan betraktas som företagshemligheter. Hur ser gränsdragningen ut för dessa motstående intressen? Hur förhåller man sig till balansgången mellan skydd av personlig integritet och skydd för företagshemligheter?  En adekvat intresseavvägning möjliggör för företag att skydda företagshemligheter samtidigt som enskildas personliga integritet inte äventyras. Hur denna intresseavvägning ska se ut är dock fortfarande oklart, vilket ligger till grund för denna uppsats. / Abstract We live in an increasingly digitized world where technology can help solve many societal challenges. For example, the interest in advanced AI technology in healthcare is increasingly in demand. AI technology has great potential to support healthcare professionals as well as individuals, shorten queues and improve healthcare. The technology is based on the collection of large amounts of data to be programmed to mimic intelligent behaviour. A great number of sensitive personal data are processed when such data is collected. Within the framework of the ongoing debate on personal integrity, a potential conflict area arises at the same time, where trade secrets risk being disclosed while information is provided as individual data protection rights are exercised.  The conflict area is raised, for instance, in cases where the register extract includes parts of the company’s business plans, work methodology and the structure of the technology. Another example concerns systematic disclosure of personal data upon request from a great number of registered persons, where the compilation itself can be regarded as trade secrets. What will the boundaries of these opposing interests be like? How does one relate to the balance between the protection of privacy and the protection of trade secrets?  An adequate balance of interests enables companies to protect trade secrets while not compromising individual privacy. However, how this balance of interests should be framed is still unclear, which has given rise to this thesis.

No description available.

<p>EU direktiv 2005/0182 röstades igenom i början av år 2006. All trafik-data kring Internet- och telekommunikation ska lagras mellan sex må-nader och ett år. Direktivet kommer innebära gemensamma regler för EU:s medlemsstater. Syftet med direktivet är att data ska lagras för till-gänglig vid utredning, avslöjande och åtal av grov organiserad brottslig-het och terrorism.</p><p>Studien innehåller tre problemområden som behandlar andra gällande direktiv och konventioner, personlig integritet och etik. Först undersöks det nya direktivet i relation till European Convention on human rights (ECHR) Vidare förs diskussioner kring lagring av trafikdata och lokali-seringsdata i förhållande till personlig integritet. Även etikens syn på hur lagring av personuppgifter ska hanteras och rättfärdigas tas upp.</p><p>Studien har kommit fram till ett resultat kring varje problemområde. I relation till redan gällande direktiv och konventioner visar studien att det är väldigt öppet för tolkningar. Dock är det framförallt mot artikel 8 i ECHR som det nya direktivet strider mot.</p><p>Peter Seipel har definierat sex olika teorier kring synen på personlig in-tegritet. Direktivets påverkan på den personliga integriteten har analy-serats med hjälp av dessa teorier. Sammanfattningsvis kan det konstate-ras att lagring av trafikdata och lokaliseringsdata kan ses som ett in-trång i den personliga integriteten, frågan är om detta intrång är berät-tigat?</p><p>Inom etiken är synen på direktivet koncentrerat till vems nytta direkti-vet är och vilket mål direktivet ska uppnå. Ofta hamnar olika regler och ställningstagande i konflikt med varandra där två saker kan ses som rätt, men de båda inte kan samexistera.</p> / <p>At the beginning of year 2006 EU directive 2005/0182 was approved by the European parliament. The directive contains rules concerning the retention of traffic and localization data created with electronically communication. This data will be stored between six months and 1 year depending on the data type. The intension is to use the data to detect, investigate and prosecute heavy criminals and terrorists.</p><p>This study contains three different problem areas, if the directive op-poses to existing directives and conventions. The relationship between personal integrity and storage of personal information is also investi-gated. The last area is ethical issues with the storing of personal data.</p><p>The result is divided into three parts, one for each problem area. It shows that the new directive don’t comply with article 8 in the European convention on human rights. Although all the articles presented are open for wide interpretation.</p><p>Peter Seipel has made a categorization of six different views of the per-sonal integrity. It is clear that the new directive will affect the personal integrity.</p><p>The ethical view on the directive is concentrated to who will benefit from the changes and witch goals are the directive set to meet. Often the rules of ethics will conflict with each other because of two sets of rules can’t exist together.</p>

Since social media is used more today than just a few years ago, it is easier to share our lives to the public in just a few seconds. Social media is easily accessible on smartphones, tablets and computers which allow us users to use them whenever we want. Instagram is an example of a very popular social media today. In this paper we focus on how younger women think about their privacy when using and publishing pictures on Instagram. We have been using a qualitative research method in which ten people were interviewed. All respondents agreed that privacy is important when publishing pictures or videos on Instagram, but there were also some differences between users with public and private accounts. This study’s result demonstrate that previous experience of risk associated with sharing private information and user's purpose of sharing on social media, affects younger women's ways of thinking about their privacy on Instagram. This is because previous experience of risks affects the user's trust towards a social network, which often determines what purpose the user has by sharing. The purpose of sharing may in many cases outweigh the risks associated with the partition itself, when likes, comments, and an increased number of followers encourage the user to continue with its behavior.

EU direktiv 2005/0182 röstades igenom i början av år 2006. All trafik-data kring Internet- och telekommunikation ska lagras mellan sex må-nader och ett år. Direktivet kommer innebära gemensamma regler för EU:s medlemsstater. Syftet med direktivet är att data ska lagras för till-gänglig vid utredning, avslöjande och åtal av grov organiserad brottslig-het och terrorism. Studien innehåller tre problemområden som behandlar andra gällande direktiv och konventioner, personlig integritet och etik. Först undersöks det nya direktivet i relation till European Convention on human rights (ECHR) Vidare förs diskussioner kring lagring av trafikdata och lokali-seringsdata i förhållande till personlig integritet. Även etikens syn på hur lagring av personuppgifter ska hanteras och rättfärdigas tas upp. Studien har kommit fram till ett resultat kring varje problemområde. I relation till redan gällande direktiv och konventioner visar studien att det är väldigt öppet för tolkningar. Dock är det framförallt mot artikel 8 i ECHR som det nya direktivet strider mot. Peter Seipel har definierat sex olika teorier kring synen på personlig in-tegritet. Direktivets påverkan på den personliga integriteten har analy-serats med hjälp av dessa teorier. Sammanfattningsvis kan det konstate-ras att lagring av trafikdata och lokaliseringsdata kan ses som ett in-trång i den personliga integriteten, frågan är om detta intrång är berät-tigat? Inom etiken är synen på direktivet koncentrerat till vems nytta direkti-vet är och vilket mål direktivet ska uppnå. Ofta hamnar olika regler och ställningstagande i konflikt med varandra där två saker kan ses som rätt, men de båda inte kan samexistera. / At the beginning of year 2006 EU directive 2005/0182 was approved by the European parliament. The directive contains rules concerning the retention of traffic and localization data created with electronically communication. This data will be stored between six months and 1 year depending on the data type. The intension is to use the data to detect, investigate and prosecute heavy criminals and terrorists. This study contains three different problem areas, if the directive op-poses to existing directives and conventions. The relationship between personal integrity and storage of personal information is also investi-gated. The last area is ethical issues with the storing of personal data. The result is divided into three parts, one for each problem area. It shows that the new directive don’t comply with article 8 in the European convention on human rights. Although all the articles presented are open for wide interpretation. Peter Seipel has made a categorization of six different views of the per-sonal integrity. It is clear that the new directive will affect the personal integrity. The ethical view on the directive is concentrated to who will benefit from the changes and witch goals are the directive set to meet. Often the rules of ethics will conflict with each other because of two sets of rules can’t exist together.

The need to collect electronic communications for foreign intelligence purposes has increased in the past two decades, primarily due to the increase of international threats such as terrorism and proliferation of weapons of mass destruction. Meanwhile, digitalization and technical innovation have given rise to new possibilities for government surveillance and expanded the scope of the types of communications that may be collected. This gives rise to issues concerning the balance between effective foreign intelligence activities and the protection of personal integrity. This thesis performs a comparative analysis of the protection of personal integrity in signals intelligence in Sweden and the United States, by examining the protection of personal integrity under the Swedish Instrument of Government and Article 8 of the European Convention of Human Rights (European Convention) compared to the Fourth Amendment to the United States Constitution, and the requirements for signals intelligence under the Swedish Act (2008:717) on Signals Intelligence in Defense Intelligence Operations (the Surveillance Act) and § 702 of the Foreign Intelligence Surveillance Act (FISA, as amended). The analysis further includes a review of the safeguards adopted in each legal system to limit the collection of communications and to ensure that personal integrity is considered in signals intelligence operations. In regard to the protection of personal integrity, the analysis concludes that Swedish law, combined with the European Convention, offers a wider and more extensive protection for individuals when compared to the United States’ framework. However, all provisions include a requirement of proportionality or reasonableness intended to balance the need for effective law enforcement with the protection of personal integrity. The analysis further concludes that the Fourth Amendment has limited impact on signals intelligence carried out under § 702 FISA due to its limitations to the people of the United States, and that individuals' ability to exercise their rights is greater under the European Convention. The European Convention further offers protection beyond Sweden's borders, resulting in some protection for non-Swedish persons. As for the signals intelligence conducted under the Surveillance Act and § 702 FISA, several similarities and differences are identified. Both regulations limit the signals intelligence to be carried out for certain purposes. However, a notable difference is that, while signals intelligence under both the Surveillance Act and § 702 FISA are limited to foreign conditions, Swedish signals intelligence may be conducted on communications that cross Sweden’s borders. Meanwhile, collection under § 702 FISA may only target non-US persons outside of the United States. Despite this difference, signals intelligence under both regulations result in the collection of communications of the country’s own citizens. To limit the collection, both the Swedish National Defense Radio Establishment (Sw. Försvarets Radioanstalt, FRA) and the United States National Security Agency (NSA) apply certain safeguards. These include the use of search terms in Swedish signals intelligence and selectors in American signals intelligence. While they are both used to make relevant selections in the collection of communications, there are some notable difference between the two. For example, selectors consist of, inter alia, an email address or phone number, while search terms should not, as a general rule, target a specific individual. Further, there is no warrant requirement for collections under § 702 FISA compared to the Surveillance Act, which requires court approval. Lastly, in regard to the control and review of Swedish and American signals intelligence, the analysis concludes that such activities are conducted in different manners in both legal systems. This includes both internal and external controls. However, the Swedish control units appear to have greater opportunities to intervene by, for example, controlling the FRA's access to signal carriers and interrupting an ongoing collection if needed.