La sous-traitance des données du patient au regard de la Directive 95/46

La gestion des données du patient occupe une place significative dans la pratique de l’art de guérir. Il arrive fréquemment que des personnes participent à la production ou à la gestion des données du patient alors que, praticiens de la santé ou non, elles ne travaillent pas sous l’autorité ou la direction du praticien ou de l’équipe en charge du patient. Au regard de la directive 95/46/CE relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel, ces tiers revêtent la qualité de sous–traitant lorsqu’ils traitent des données pour compte du responsable du traitement de données. Ce dernier doit choisir un sous–traitant qui apporte des garanties suffisantes au regard des mesures de sécurité technique et d’organisation relatives aux traitements à effectuer, et il doit veiller au respect de ces mesures. L’existence de labels de sécurité pourrait faciliter le choix du sous–traitant. S’agissant de données très sensibles comme les données génétiques, il serait opportun d’envisager un contrôle préalable par l’autorité de contrôle ou par un détaché à la protection des données. Il demeure alors à déterminer le véritable responsable du traitement des données du patient, ce qui dépend fortement du poids socialement reconnu et attribué aux différents acteurs de la relation thérapeutique.

The legality of online Privacy-Enhancing Technologies

L’utilisation d’Internet prend beaucoup d’ampleur depuis quelques années et le commerce électronique connaît une hausse considérable. Nous pouvons présentement acheter facilement via Internet sans quitter notre domicile et avons accès à d’innombrables sources d’information. Cependant, la navigation sur Internet permet également la création de bases de données détaillées décrivant les habitudes de chaque utilisateur, informations ensuite utilisées par des tiers afin de cerner le profil de leur clientèle cible, ce qui inquiète plusieurs intervenants. Les informations concernant un individu peuvent être récoltées par l’interception de données transactionnelles, par l’espionnage en ligne, ainsi que par l’enregistrement d’adresses IP. Afin de résoudre les problèmes de vie privée et de s’assurer que les commerçants respectent la législation applicable en la matière, ainsi que les exigences mises de l’avant par la Commission européenne, plusieurs entreprises comme Zero-knowledge Systems Inc. et Anonymizer.com offrent des logiciels permettant la protection de la vie privée en ligne (privacy-enhancing technologies ou PETs). Ces programmes utilisent le cryptage d’information, une méthode rendant les données illisibles pour tous à l’exception du destinataire. L’objectif de la technologie utilisée a été de créer des systèmes mathématiques rigoureux pouvant empêcher la découverte de l’identité de l’auteur même par le plus déterminé des pirates, diminuant ainsi les risques de vol d’information ou la divulgation accidentelle de données confidentielles. Malgré le fait que ces logiciels de protection de la vie privée permettent un plus grand respect des Directives européennes en la matière, une analyse plus approfondie du sujet témoigne du fait que ces technologies pourraient être contraires aux lois concernant le cryptage en droit canadien, américain et français.

Economic Impact of Identity Theft in India: Lessons from Western Countries

In this computerized, globalised and internet world our computer collects various types of information’s about every human being and stores them in files secreted deep on its hard drive. Files like cache, browser history and other temporary Internet files can be used to store sensitive information like logins and passwords, names addresses, and even credit card numbers. Now, a hacker can get at this information by wrong means and share with someone else or can install some nasty software on your computer that will extract your sensitive and secret information. Identity Theft posses a very serious problem to everyone today. If you have a driver’s license, a bank account, a computer, ration card number, PAN card number, ATM card or simply a social security number you are more than at risk, you are a target. Whether you are new to the idea of ID Theft, or you have some unanswered questions, we’ve compiled a quick refresher list below that should bring you up to speed. Identity theft is a term used to refer to fraud that involves pretending to be someone else in order to steal money or get other benefits. Identity theft is a serious crime, which is increasing at tremendous rate all over the world after the Internet evolution. There is widespread agreement that identity theft causes financial damage to consumers, lending institutions, retail establishments, and the economy as a whole. Surprisingly, there is little good public information available about the scope of the crime and the actual damages it inflicts. Accounts of identity theft in recent mass media and in film or literature have centered on the exploits of 'hackers' - variously lauded or reviled - who are depicted as cleverly subverting corporate firewalls or other data protection defenses to gain unauthorized access to credit card details, personnel records and other information. Reality is more complicated, with electronic identity fraud taking a range of forms. The impact of those forms is not necessarily quantifiable as a financial loss; it can involve intangible damage to reputation, time spent dealing with disinformation and exclusion from particular services because a stolen name has been used improperly. Overall we can consider electronic networks as an enabler for identity theft, with the thief for example gaining information online for action offline and the basis for theft or other injury online. As Fisher pointed out "These new forms of hightech identity and securities fraud pose serious risks to investors and brokerage firms across the globe," I am a victim of identity theft. Being a victim of identity theft I felt the need for creating an awareness among the computer and internet users particularly youngsters in India. Nearly 70 per cent of Indian‘s population are living in villages. Government of India already started providing computer and internet facilities even to the remote villages through various rural development and rural upliftment programmes. Highly educated people, established companies, world famous financial institutions are becoming victim of identity theft. The question here is how vulnerable the illiterate and innocent rural people are if they suddenly exposed to a new device through which some one can extract and exploit their personal data without their knowledge? In this research work an attempt has been made to bring out the real problems associated with Identity theft in developed countries from an economist point of view.

Reviewing the EU ETS review? Report of the CEPS TAsk Force on "Does the ETS market produce the 'right' price signal"? CEPS Task Force Report, 12 November 2012

Drawing on discussions within a CEPS Task Force on the revised EU emissions trading system, this report provides a comprehensive assessment of the pros and cons of the various measures put forward by different stakeholders to address the level and stability of the price of carbon in the EU. It argues that the European Commission, the member states, the European Parliament and other stakeholders need to give serious consideration to introducing some kind of ‘dynamic’ adjustment provision to address the relatively inelastic supply. The report also suggests that there is a need to improve communication of market-sensitive information, for example by leaving the management of the ETS to a specialised body.

The influence of age and gender on food choice: a focus group exploration

With 25% of the UK population predicted to be obese by 2010, the costs to individuals and society are set to rise. Due to the extra economic and social pressures obesity causes, there is an increasing need to understand what motivates and prevents consumers from eating a healthy diet so as to be able to tailor policy interventions to specific groups in society. In so doing, it is important to explore potential variations in attitudes, motivation and behaviour as a function of age and gender. Both demographic factors are easily distinguished within society and a future intervention study which targets either, or both, of these would likely be both feasible and cost-effective for policy makers. As part of a preliminary study, six focus groups (total n = 43) were conducted at the University of Reading in November 2006, with groups segmented on the basis of age and gender. In order to gather more sensitive information, participants were also asked to fill out a short anonymous questionnaire before each focus group began, relating to healthy eating, alcohol consumption and body dissatisfaction. Making use of thematic content analysis, results suggested that most participants were aware of the type of foods that contribute to a healthy diet and the importance of achieving a healthy balance within a diet. However, they believed that healthy eating messages were often conflicting, and were uncertain about where to find information on the topic. Participants believed that the family has an important role in educating children about eating habits. Despite these similarities, there were a number of key differences among the groups in terms of their reasons for making food choices. Older participants (60+ years old) were more likely to make food choices based on health considerations. Participants between the ages of 18–30 were less concerned with this link, and instead focused on issues of food preparation and knowledge, prices and time. Younger female participants said they had more energy when they ate healthier diets; however, very often their food choices related to concern with their appearance. Older female participants also expressed this concern within the questionnaire, rather than in the group discussions. Overall, these results suggest that consumer motivations for healthy eating are diverse and that this must be considered by government, retailers and food producers.

Can company-fund manager meetings convey informational benefits? Exploring the rationalisation of equity investment decision making by UK fund managers

Conventional economic theory, applied to information released by listed companies, equates ‘useful’ with ‘price-sensitive’. Stock exchange rules accordingly prohibit the selec- tive, private communication of price-sensitive information. Yet, even in the absence of such communication, UK equity fund managers routinely meet privately with the senior execu- tives of the companies in which they invest. Moreover, they consider these brief, formal and formulaic meetings to be their most important sources of investment information. In this paper we ask how that can be. Drawing on interview and observation data with fund managers and CFOs, we find evidence for three, non-mutually exclusive explanations: that the characterisation of information in conventional economic theory is too restricted, that fund managers fail to act with the rationality that conventional economic theory assumes, and/or that the primary value of the meetings for fund managers is not related to their investment decision making but to the claims of superior knowledge made to clients in marketing their active fund management expertise. Our findings suggest a disconnect between economic theory and economic policy based on that theory, as well as a corre- sponding limitation in research studies that test information-usefulness by assuming it to be synonymous with price-sensitivity. We draw implications for further research into the role of tacit knowledge in equity investment decision-making, and also into the effects of the principal–agent relationship between fund managers and their clients.

Understanding consumer evaluations of personalised nutrition services in terms of the privacy calculus: a qualitative study

Background: Personalised nutrition (PN) may provide major health benefits to consumers. A potential barrier to the uptake of PN is consumers’ reluctance to disclose sensitive information upon which PN is based. This study adopts the privacy calculus to explore how PN service attributes contribute to consumers’ privacy risk and personalisation benefit perceptions. Methods: Sixteen focus groups (n = 124) were held in 8 EU countries and discussed 9 PN services that differed in terms of personal information, communication channel, service provider, advice justification, scope, frequency, and customer lock-in. Transcripts were content analysed. Results: The personal information that underpinned PN contributed to both privacy risk perception and personalisation benefit perception. Disclosing information face-to-face mitigated the perception of privacy risk and amplified the perception of personalisation benefit. PN provided by a qualified expert and justified by scientific evidence increased participants’ value perception. Enhancing convenience, offering regular face-to face support, and employing customer lock-in strategies were perceived as beneficial. Conclusion: This study suggests that to encourage consumer adoption, PN has to account for face-to-face communication, expert advice providers, support, a lifestyle-change focus, and customised offers. The results provide an initial insight into service attributes that influence consumer adoption of PN.

Introducing personal liability under the continuous disclosure regime : The essentials and non-essentials

Under the Federal Government's CLERP 9 legislation, expected at the time of writing to come into force in July 2004, personal liability will be introduced for the first time under the continuous disclosure regime. Individuals who are 'involved' in a failure to immediately disclose materially price sensitive information to the market will be subject to a civil penalty, in addition to the company being liable. According to the author, the introduction of personal liability per se is not contentious and indeed is a favourable change; what is questionable, however, is whether 'involvement' in a contravention is the appropriate test for imposing personal liability in relation to breaches of the continuous disclosure provisions. Based on the case law to date on the meaning of 'involved', there is particular uncertainty as to whether an individual would need to have actual knowledge that non-disclosed information is 'materially price sensitive' in order to satisfy the test of 'involved' in the context of continuous disclosure, or whether mere knowledge that the information has not been disclosed would be sufficient. This uncertainty arises due to the vague concept of 'essential matters' which the courts have developed as a test for what degree of knowledge a person needs to have in order to be 'involved'. The author argues that all the confusion as to what 'involved' means could be addressed by removing the word 'essential' from the dialogue, so that the test of 'involvement' would simply be based on whether the particular person had actual knowledge of each of the factual elements constituting the offence.

A trusted approach to e-commerce

It has been well documented that lack of trust between commercial entities and purchasers can restrict the potential of e-commerce. This may be because the purchaser is required to provide sensitive information to the commercial entity or because the purchaser may be suspicious that after payment has been processed, the goods purchased will not arrive. The challenge for the researcher is to determine the e-commerce model which maximizes the trust relationship. In this paper, we introduce a measure of the trust based on the information distributed to the parties in the transaction and isolate the instances which maximize trust for the purchaser. This leads us to propose four new models for e-commerce which would improve consumer trust and therefore likely lead to an increase in on-line commerce. We demonstrate that no new technologies are needed in order to implement these new models.

Diabetes service provision : a qualitative study of the experiences and views of Pakistani and Indian patients with Type 2 diabetes

Aims To explore Pakistani and Indian patients' experiences of, and views about, diabetes services in order to inform the development of culturally sensitive services.

Design Qualitative, interview study involving 23 Pakistani and nine Indian patients with Type 2 diabetes recruited from general practices and the local community in Edinburgh, Scotland. Data collection and analysis occurred concurrently and recruitment continued until no new themes emerged from the interviews.

Results Respondents expressed gratitude for the availability of free diabetes services in Britain, as they were used to having to pay to access health care on the Indian subcontinent. Most looked to services for the prompt detection and treatment of complications, rather than the provision of advice about managing their condition. As respondents attached importance to receiving physical examinations, they could be disappointed when these were not offered by health-care professionals. They disliked relying on interpreters and identified a need for bilingual professionals with whom they could discuss their diabetes care directly.

Conclusions Gratitude for free services in Britain may instil a sense of indebtedness which makes it difficult for Pakistanis and Indians to be critical of their diabetes care. Health-care professionals may need to describe their roles carefully, and explain how different diabetes services fit together, to avoid Pakistani and Indian patients perceiving treatment as unsatisfactory. Whilst linkworker schemes may meet patients' need to receive culturally sensitive information in their first language, work is needed to assess their effectiveness and sustainability.

Attack vector analysis and privacy-preserving social network data publishing

This paper addresses the problem of privacy-preserving data publishing for social network. Research on protecting the privacy of individuals and the confidentiality of data in social network has recently been receiving increasing attention. Privacy is an important issue when one wants to make use of data that involves individuals' sensitive information, especially in a time when data collection is becoming easier and sophisticated data mining techniques are becoming more efficient. In this paper, we discuss various privacy attack vectors on social networks. We present algorithms that sanitize data to make it safe for release while preserving useful information, and discuss ways of analyzing the sanitized data. This study provides a summary of the current state-of-the-art, based on which we expect to see advances in social networks data publishing for years to come.

Zero permission android applications - attacks and defenses

Google advertises the Android permission framework as one of the core security features present on its innovative and flexible mobile platform. The permissions are a means to control access to restricted AP/s and system resources. However, there are Android applications which do not request permissions at all.In this paper, we analyze the repercussions of installing an Android application that does not include any permission and the types of sensitive information that can be accessed by such an application. We found that even app/icaaons with no permissions are able to access sensitive information (such the device ID) and transmit it to third-parties.

Towards designing privacy-preserving signature-based IDS as a service : a study and practice

With the advent of Cloud Computing, IDS as a service (IDSaaS) has been proposed as an alternative to protect a network (e.g., financial organization) from a wide range of network attacks by offloading the expensive operations such as the process of signature matching to the cloud. The IDSaaS can be roughly classified into two types: signature-based detection and anomaly-based detection. During the packet inspection, no party wants to disclose their own data especially sensitive information to others, even to the cloud provider, for privacy concerns. However, current solutions of IDSaaS have not much discussed this issue. In this work, focus on the signature-based IDSaaS, we begin by designing a promising privacy-preserving intrusion detection mechanism, the main feature of which is that the process of signature matching does not reveal any specific content of network packets by means of a fingerprint-based comparison. We further conduct a study to evaluate this mechanism under a cloud scenario and identify several open problems and issues for designing such a privacy-preserving mechanism for IDSaaS in a practical environment.

Comparative mobile platforms security solutions

 Mobile platform security solution has become especially important for mobile computing paradigms, due to the fact that increasing amounts of private and sensitive information are being stored on the smartphones' on-device memory or MicroSD/SD cards. This paper aims to consider a comparative approach to the security aspects of the current smartphone systems, including: iOS, Android, BlackBerry (QNX), and Windows Phone.