The conceptual and operational compatibility of data breach notification and information privacy laws

Mandatory data breach notification laws are a novel and potentially important legal instrument regarding organisational protection of personal information. These laws require organisations that have suffered a data breach involving personal information to notify those persons that may be affected, and potentially government authorities, about the breach. The Australian Law Reform Commission (ALRC) has proposed the creation of a mandatory data breach notification scheme, implemented via amendments to the Privacy Act 1988 (Cth). However, the conceptual differences between data breach notification law and information privacy law are such that it is questionable whether a data breach notification scheme can be solely implemented via an information privacy law. Accordingly, this thesis by publications investigated, through six journal articles, the extent to which data breach notification law was conceptually and operationally compatible with information privacy law. The assessment of compatibility began with the identification of key issues related to data breach notification law. The first article, Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches started this stage of the research which concluded in the second article, The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments (‘Mandatory Notification‘). A key issue that emerged was whether data breach notification was itself an information privacy issue. This notion guided the remaining research and focused attention towards the next stage of research, an examination of the conceptual and operational foundations of both laws. The second article, Mandatory Notification and the third article, Encryption Safe Harbours and Data Breach Notification Laws did so from the perspective of data breach notification law. The fourth article, The Conceptual Basis of Personal Information in Australian Privacy Law and the fifth article, Privacy Invasive Geo-Mashups: Privacy 2.0 and the Limits of First Generation Information Privacy Laws did so for information privacy law. The final article, Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws synthesised previous research findings within the framework of contextualisation, principally developed by Nissenbaum. The examination of conceptual and operational foundations revealed tensions between both laws and shared weaknesses within both laws. First, the distinction between sectoral and comprehensive information privacy legal regimes was important as it shaped the development of US data breach notification laws and their subsequent implementable scope in other jurisdictions. Second, the sectoral versus comprehensive distinction produced different emphases in relation to data breach notification thus leading to different forms of remedy. The prime example is the distinction between market-based initiatives found in US data breach notification laws compared to rights-based protections found in the EU and Australia. Third, both laws are predicated on the regulation of personal information exchange processes even though both laws regulate this process from different perspectives, namely, a context independent or context dependent approach. Fourth, both laws have limited notions of harm that is further constrained by restrictive accountability frameworks. The findings of the research suggest that data breach notification is more compatible with information privacy law in some respects than others. Apparent compatibilities clearly exist as both laws have an interest in the protection of personal information. However, this thesis revealed that ostensible similarities are founded on some significant differences. Data breach notification law is either a comprehensive facet to a sectoral approach or a sectoral adjunct to a comprehensive regime. However, whilst there are fundamental differences between both laws they are not so great to make them incompatible with each other. The similarities between both laws are sufficient to forge compatibilities but it is likely that the distinctions between them will produce anomalies particularly if both laws are applied from a perspective that negates contextualisation.

Impact of a data warehouse model for improved decision-making process in healthcare

The health system is one sector dealing with a deluge of complex data. Many healthcare organisations struggle to utilise these volumes of health data effectively and efficiently. Also, there are many healthcare organisations, which still have stand-alone systems, not integrated for management of information and decision-making. This shows, there is a need for an effective system to capture, collate and distribute this health data. Therefore, implementing the data warehouse concept in healthcare is potentially one of the solutions to integrate health data. Data warehousing has been used to support business intelligence and decision-making in many other sectors such as the engineering, defence and retail sectors. The research problem that is going to be addressed is, "how can data warehousing assist the decision-making process in healthcare". To address this problem the researcher has narrowed an investigation focusing on a cardiac surgery unit. This research used the cardiac surgery unit at the Prince Charles Hospital (TPCH) as the case study. The cardiac surgery unit at TPCH uses a stand-alone database of patient clinical data, which supports clinical audit, service management and research functions. However, much of the time, the interaction between the cardiac surgery unit information system with other units is minimal. There is a limited and basic two-way interaction with other clinical and administrative databases at TPCH which support decision-making processes. The aims of this research are to investigate what decision-making issues are faced by the healthcare professionals with the current information systems and how decision-making might be improved within this healthcare setting by implementing an aligned data warehouse model or models. As a part of the research the researcher will propose and develop a suitable data warehouse prototype based on the cardiac surgery unit needs and integrating the Intensive Care Unit database, Clinical Costing unit database (Transition II) and Quality and Safety unit database [electronic discharge summary (e-DS)]. The goal is to improve the current decision-making processes. The main objectives of this research are to improve access to integrated clinical and financial data, providing potentially better information for decision-making for both improved from the questionnaire and by referring to the literature, the results indicate a centralised data warehouse model for the cardiac surgery unit at this stage. A centralised data warehouse model addresses current needs and can also be upgraded to an enterprise wide warehouse model or federated data warehouse model as discussed in the many consulted publications. The data warehouse prototype was able to be developed using SAS enterprise data integration studio 4.2 and the data was analysed using SAS enterprise edition 4.3. In the final stage, the data warehouse prototype was evaluated by collecting feedback from the end users. This was achieved by using output created from the data warehouse prototype as examples of the data desired and possible in a data warehouse environment. According to the feedback collected from the end users, implementation of a data warehouse was seen to be a useful tool to inform management options, provide a more complete representation of factors related to a decision scenario and potentially reduce information product development time. However, there are many constraints exist in this research. For example the technical issues such as data incompatibilities, integration of the cardiac surgery database and e-DS database servers and also, Queensland Health information restrictions (Queensland Health information related policies, patient data confidentiality and ethics requirements), limited availability of support from IT technical staff and time restrictions. These factors have influenced the process for the warehouse model development, necessitating an incremental approach. This highlights the presence of many practical barriers to data warehousing and integration at the clinical service level. Limitations included the use of a small convenience sample of survey respondents, and a single site case report study design. As mentioned previously, the proposed data warehouse is a prototype and was developed using only four database repositories. Despite this constraint, the research demonstrates that by implementing a data warehouse at the service level, decision-making is supported and data quality issues related to access and availability can be reduced, providing many benefits. Output reports produced from the data warehouse prototype demonstrated usefulness for the improvement of decision-making in the management of clinical services, and quality and safety monitoring for better clinical care. However, in the future, the centralised model selected can be upgraded to an enterprise wide architecture by integrating with additional hospital units’ databases.

Automated gathering of Web information: An in-depth examination of agents interacting with search engines

The Web has become a worldwide repository of information which individuals, companies, and organizations utilize to solve or address various information problems. Many of these Web users utilize automated agents to gather this information for them. Some assume that this approach represents a more sophisticated method of searching. However, there is little research investigating how Web agents search for online information. In this research, we first provide a classification for information agent using stages of information gathering, gathering approaches, and agent architecture. We then examine an implementation of one of the resulting classifications in detail, investigating how agents search for information on Web search engines, including the session, query, term, duration and frequency of interactions. For this temporal study, we analyzed three data sets of queries and page views from agents interacting with the Excite and AltaVista search engines from 1997 to 2002, examining approximately 900,000 queries submitted by over 3,000 agents. Findings include: (1) agent sessions are extremely interactive, with sometimes hundreds of interactions per second (2) agent queries are comparable to human searchers, with little use of query operators, (3) Web agents are searching for a relatively limited variety of information, wherein only 18% of the terms used are unique, and (4) the duration of agent-Web search engine interaction typically spans several hours. We discuss the implications for Web information agents and search engines.

Teen content creators : experiences of using information to learn

As access to networked digital communities increases, a growing number of teens participate in digital communities by creating and sharing a variety of content. The affordances of social media - ease of use, ubiquitous access, and communal nature - have made creating and sharing content an appealing process for teens. Teens primarily learn the practices of encountering and using information through social interaction and participation within digital communities. This article adopts the position that information literacy is the experience of using information to learn. It reports on an investigation into teens experiences in the United States, as they use information to learn how to create content and participate within the context of social media. Teens that participate in sharing art on sites such as DeiviantArt, website creation, blogging, and/or posting edited videos via YouTube and Vimeo, were interviewed. The interviews explored teens' information experiences within particular social and digital contexts. Teens discussed the information they used, how information was gathered and accessed, and explored the process of using that information to participate in the communities.

Evaluation of an Australian solar community : implications for education and training

1.1 Background What is renewable energy education and training? A cursory exploration of the International Solar Energy Society website (www.ises.org) reveals numerous references to education and training, referring collectively to concepts of the transfer and exchange of information and good practices, awareness raising and skills development. The purposes of such education and training relate to changing policy, stimulating industry, improving quality control and promoting the wider use of renewable energy sources. The primary objective appears to be to accelerate a transition to a better world for everyone (ISEE), as the greater use of renewable energy is seen as key to climate recovery; world poverty alleviation; advances in energy security, access and equality; improved human and environmental health; and a stabilized society. The Solar Cities project – Habitats of Tomorrow – aims at promoting the greater use of renewable energy within the context of long term planning for sustainable urban development. The focus is on cities or communities as complete systems; each one a unique laboratory allowing for the study of urban sustainability within the context of a low carbon lifestyle. The purpose of this paper is to report on an evaluation of a Solar Community in Australia, focusing specifically on the implications (i) for our understandings and practices in renewable energy education and training and (ii) for sustainability outcomes. 1.2 Methodology The physical context is a residential Ecovillage (a Solar Community) in sub-tropical Queensland, Australia (latitude 28o south). An extensive Architectural and Landscape Code (A&LC) ‘premised on the interconnectedness of all things’ and embracing ‘both local and global concerns’ governs the design and construction of housing in the estate: all houses are constructed off-ground (i.e. on stumps or stilts) and incorporate a hybrid approach to the building envelope (mixed use of thermal mass and light-weight materials). Passive solar design, gas boosted solar water heaters and a minimum 1kWp photovoltaic system (grid connected) are all mandatory, whilst high energy use appliances such as air conditioners and clothes driers are not permitted. Eight families participated in an extended case study that encompassed both quantitative and qualitative approaches to better understand sustainable housing (perceived as a single complex technology) through its phases of design, construction and occupation. 1.3 Results The results revealed that the level of sustainability (i.e. the performance outcomes in terms of a low-carbon lifestyle) was impacted on by numerous ‘players’ in the supply chain, such as architects, engineers and subcontractors, the housing market, the developer, product manufacturers / suppliers / installers and regulators. Three key factors were complicit in the level of success: (i) systems thinking; (ii) informed decision making; and (iii) environmental ethics and business practices. 1.4 Discussion The experiences of these families bring into question our understandings and practices with regard to education and training. Whilst increasing and transferring knowledge and skills is essential, the results appear to indicate that there is a strong need for expanding our education efforts to incorporate foundational skills in complex systems and decision making processes, combined with an understanding of how our individual and collective values and beliefs impact on these systems and processes.

Minimizing information leakage of tree-based RFID authentication protocols using alternate tree-walking

The privacy of efficient tree-based RFID authentication protocols is heavily dependent on the branching factor on the top layer. Indefinitely increasing the branching factor, however, is not a viable option. This paper proposes the alternate-tree walking scheme as well as two protocols to circumvent this problem. The privacy of the resulting protocols is shown to be comparable to that of linear-time protocols, where there is no leakage of information, whilst reducing the computational load of the database by one-third of what is required of tree-based protocols during authentication. We also identify and address a limitation in quantifying privacy in RFID protocols.

Project alliancing and information technology in building construction : the National Museum of Australia

The construction industry demands priority from all governments because it impacts economically and socially on all citizens. A number of recent studies have identified inefficiencies in the Australian construction industry by modelling the building process. A culture of reform supported by industry and government is now emerging in the industry – one in which alternate forms of project delivery are being trialed. The Australian Building and Construction Industry Action Agenda brought together industry and government to identify actions necessary to lift Australia’s innovative and knowledge creating capacity at the sector level. A central activity under this Action Agenda was dissemination of information relating to industry best practice initiatives in innovation, project delivery and the use of information technology. Government and industry identified project alliance contracting and more advanced information technology as means to increase efficiency in construction as part of a new innovative procurement environment.

Development of a data mining-based analysis framework for multi-attribute construction project information

Data mining techniques extract repeated and useful patterns from a large data set that in turn are utilized to predict the outcome of future events. The main purpose of the research presented in this paper is to investigate data mining strategies and develop an efficient framework for multi-attribute project information analysis to predict the performance of construction projects. The research team first reviewed existing data mining algorithms, applied them to systematically analyze a large project data set collected by the survey, and finally proposed a data-mining-based decision support framework for project performance prediction. To evaluate the potential of the framework, a case study was conducted using data collected from 139 capital projects and analyzed the relationship between use of information technology and project cost performance. The study results showed that the proposed framework has potential to promote fast, easy to use, interpretable, and accurate project data analysis.

Exploring characteristics of expertise in information systems

Experts’ views and commentary have been highly respected in every discipline. However, unlike traditional disciplines like medicine, mathematics and engineering, Information System (IS) expertise is difficult to define. This paper attempts to understand the characteristics of IS-expert through a comprehensive literature review of analogous disciplines and then derives a formative research model with three main constructs. Further, this research validates the formative model to identify the characteristics of expertise using data gathered from 220 respondents using a contemporary Information System. Finally this research demonstrates how individuals with different levels of expertise differ in their views in relation to system evaluations.

Scientific Research in Information Systems : A Beginner's Guide

- ​Covers entire research process from start to end - Places particular emphasis on motivational components, modes of inquiry in scholarly conduct, theorizing and planning research - Includes aspects such as publication and ethical challenges This book is designed to introduce doctoral and other higher-degree research students to the process of scientific research in the fields of Information Systems as well as fields of Information Technology, Business Process Management and other related disciplines within the social sciences. It guides research students in their process of learning the life of a researcher. In doing so, it provides an understanding of the essential elements, concepts and challenges of the journey into research studies. It also provides a gateway for the student to inquire deeper about each element covered​. Comprehensive and broad but also succinct and compact, the book is focusing on the key principles and challenges for a novice doctoral student.

Juggling information policy, rights to information and copyright licensing to enhance the accessibility and reusability of spatial data : the Australian experience

There is still no comprehensive information strategy governing access to and reuse of public sector information, applying on a nationwide basis, across all levels of government – local, state and federal - in Australia. This is the case both for public sector materials generally and for spatial data in particular. Nevertheless, the last five years have seen some significant developments in information policy and practice, the result of which has been a considerable lessening of the barriers that previously acted to impede the accessibility and reusability of a great deal of spatial and other material held by public sector agencies. Much of the impetus for change has come from the spatial community which has for many years been a proponent of the view “that government held information, and in particular spatial information, will play an absolutely critical role in increasing the innovative capacity of this nation.”1 However, the potential of government spatial data to contribute to innovation will remain unfulfilled without reform of policies on access and reuse as well as the pervasive practices of public sector data custodians who have relied on government copyright to justify the imposition of restrictive conditions on its use.

Impact of the social networking applications for health information management for patients and physicians

Most social network users hold more than one social network account and utilize them in different ways depending on the digital context. For example, friendly chat on Facebook, professional discussion on LinkedIn, and health information exchange on PatientsLikeMe. Thus many web users need to manage many disparate profiles across many distributed online sources. Maintaining these profiles is cumbersome, time consuming, inefficient, and leads to lost opportunity. In this paper we propose a framework for multiple profile management of online social networks and showcase a demonstrator utilising an open source platform. The result of the research enables a user to create and manage an integrated profile and share/synchronise their profiles with their social networks. A number of use cases were created to capture the functional requirements and describe the interactions between users and the online services. An innovative application of this project is in public health informatics. We utilize the prototype to examine how the framework can benefit patients and physicians. The framework can greatly enhance health information management for patients and more importantly offer a more comprehensive personal health overview of patients to physicians.

Exploiting SNOMED CT concepts and relationships for clinical information retrieval : Australian e-Health Research Centre and Queensland University of Technology at the TREC 2012 Medical Track

The Australian e-Health Research Centre and Queensland University of Technology recently participated in the TREC 2012 Medical Records Track. This paper reports on our methods, results and experience using an approach that exploits the concept and inter-concept relationships defined in the SNOMED CT medical ontology. Our concept-based approach is intended to overcome specific challenges in searching medical records, namely vocabulary mismatch and granularity mismatch. Queries and documents are transformed from their term-based originals into medical concepts as defined by the SNOMED CT ontology, this is done to tackle vocabulary mismatch. In addition, we make use of the SNOMED CT parent-child `is-a' relationships between concepts to weight documents that contained concept subsumed by the query concepts; this is done to tackle the problem of granularity mismatch. Finally, we experiment with other SNOMED CT relationships besides the is-a relationship to weight concepts related to query concepts. Results show our concept-based approach performed significantly above the median in all four performance metrics. Further improvements are achieved by the incorporation of weighting subsumed concepts, overall leading to improvement above the median of 28% infAP, 10% infNDCG, 12% R-prec and 7% Prec@10. The incorporation of other relations besides is-a demonstrated mixed results, more research is required to determined which SNOMED CT relationships are best employed when weighting related concepts.

Semantic judgement of medical concepts : combining syntagmatic and paradigmatic information with the tensor encoding model

This paper outlines a novel approach for modelling semantic relationships within medical documents. Medical terminologies contain a rich source of semantic information critical to a number of techniques in medical informatics, including medical information retrieval. Recent research suggests that corpus-driven approaches are effective at automatically capturing semantic similarities between medical concepts, thus making them an attractive option for accessing semantic information. Most previous corpus-driven methods only considered syntagmatic associations. In this paper, we adapt a recent approach that explicitly models both syntagmatic and paradigmatic associations. We show that the implicit similarity between certain medical concepts can only be modelled using paradigmatic associations. In addition, the inclusion of both types of associations overcomes the sensitivity to the training corpus experienced by previous approaches, making our method both more effective and more robust. This finding may have implications for researchers in the area of medical information retrieval.

Exploring the information practices of people with end stage kidney disease

This small exploratory study sought to understand how people with End Stage Kidney Disease (ESKD) experience the information environment and what information practices they employ in order to inform the decisions they make in relation to treatment and care. Using a constructivist methodology, in-depth interviews were conducted with five people who were receiving haemodialysis in two small satellite dialysis units located in regional and rural communities in New South Wales, Australia. Thematic analysis revealed two types of patients. The first type appears to adopt a received view of information, who do not question their condition; and passively accept information. In the other type, patients were found to be engaged; they actively identified their information needs and quickly learned what that they needed to ask and who to ask. Knowing the information practices of people with ESKD is useful for nephrology nurses when providing patient education.