How do Firms ask for Consumers’ Data Permission? The Value of Companies Data Practices.

On May 25, 2018, the EU introduced the General Data Protection Regulation (GDPR) that offers EU citizens a shelter for their personal information by requesting companies to explain how people’s information is used clearly. To comply with the new law, European and non-European companies interacting with EU citizens undertook a massive data re-permission-request campaign. However, if on the one side the EU Regulator was particularly specific in defining the conditions to get customers’ data access, on the other side, it did not specify how the communication between firms and consumers should be designed. This has left firms free to develop their re-permission emails as they liked, plausibly coupling the informative nature of these privacy-related communications with other persuasive techniques to maximize data disclosure. Consequently, we took advantage of this colossal wave of simultaneous requests to provide insights into two issues. Firstly, we investigate how companies across industries and countries chose to frame their requests. Secondly, we investigate which are the factors that influenced the selection of alternative re-permission formats. In order to achieve these goals, we examine the content of a sample of 1506 re-permission emails sent by 1396 firms worldwide, and we identify the dominant “themes” characterizing these emails. We then relate these themes to both the expected benefits firms may derive from data usage and the possible risks they may experience from not being completely compliant to the spirit of the law. Our results show that: (1) most firms enriched their re-permission messages with persuasive arguments aiming at increasing consumers’ likelihood of relinquishing their data; (2) the use of persuasion is the outcome of a difficult tradeoff between costs and benefits; (3) most companies acted in their self-interest and “gamed the system”. Our results have important implications for policymakers, managers, and customers of the online sector.

Big data in health IoE in emergency situations: between the right to privacy and digital health innovation

The chapters of the thesis focus on a limited variety of selected themes in EU privacy and data protection law. Chapter 1 sets out the general introduction on the research topic. Chapter 2 touches upon the methodology used in the research. Chapter 3 conceptualises the basic notions from a legal standpoint. Chapter 4 examines the current regulatory regime applicable to digital health technologies, healthcare emergencies, privacy, and data protection. Chapter 5 provides case studies on the application deployed in the Covid-19 scenario, from the perspective of privacy and data protection. Chapter 6 addresses the post-Covid European regulatory initiatives on the subject matter, and its potential effects on privacy and data protection. Chapter 7 is the outcome of a six-month internship with a company in Italy and focuses on the protection of fundamental rights through common standardisation and certification, demonstrating that such standards can serve as supporting tools to guarantee the right to privacy and data protection in digital health technologies. The thesis concludes with the observation that finding and transposing European privacy and data protection standards into scenarios, such as public healthcare emergencies where digital health technologies are deployed, requires rapid coordination between the European Data Protection Authorities and the Member States guarantee that individual privacy and data protection rights are ensured.

Security and privacy of resource constrained devices

The thesis aims to present a comprehensive and holistic overview on cybersecurity and privacy & data protection aspects related to IoT resource-constrained devices. Chapter 1 introduces the current technical landscape by providing a working definition and architecture taxonomy of ‘Internet of Things’ and ‘resource-constrained devices’, coupled with a threat landscape where each specific attack is linked to a layer of the taxonomy. Chapter 2 lays down the theoretical foundations for an interdisciplinary approach and a unified, holistic vision of cybersecurity, safety and privacy justified by the ‘IoT revolution’ through the so-called infraethical perspective. Chapter 3 investigates whether and to what extent the fast-evolving European cybersecurity regulatory framework addresses the security challenges brought about by the IoT by allocating legal responsibilities to the right parties. Chapters 4 and 5 focus, on the other hand, on ‘privacy’ understood by proxy as to include EU data protection. In particular, Chapter 4 addresses three legal challenges brought about by the ubiquitous IoT data and metadata processing to EU privacy and data protection legal frameworks i.e., the ePrivacy Directive and the GDPR. Chapter 5 casts light on the risk management tool enshrined in EU data protection law, that is, Data Protection Impact Assessment (DPIA) and proposes an original DPIA methodology for connected devices, building on the CNIL (French data protection authority) model.

Patient data sharing for the improvement of healthcare and medical research: towards a moral duty of patients to share health-related data?

The project answers to the following central research question: ‘How would a moral duty of patients to transfer (health) data for the benefit of health care improvement, research, and public health in the eHealth sector sit within the existing confidentiality, privacy, and data protection legislations?’. The improvement of healthcare services, research, and public health relies on patient data, which is why one might raise the question concerning a potential moral responsibility of patients to transfer data concerning health. Such a responsibility logically would have subsequent consequences for care providers concerning the further transferring of health data with other healthcare providers or researchers and other organisations (who also possibly transfer the data further with others and other organisations). Otherwise, the purpose of the patients’ moral duty, i.e. to improve the care system and research, would be undermined. Albeit the arguments that may exist in favour of a moral responsibility of patients to share health-related data, there are also some moral hurdles that come with such a moral responsibility. Furthermore, the existing European and national confidentiality, privacy and data protection legislations appear to hamper such a possible moral duty, and they may need to be reconsidered to unlock the full use of data for healthcare and research.

Sociological and philosophical aspects of human interaction with technology: advancing concepts

It is not possible to imagine our lives today without technology. From the moment we get up in the morning until the time that we go to bed at night, technology is present in almost every moment, even if we are not aware of it. Some of the most basic activities we need to perform regularly could not be carried out without technology. Sociological and Philosophical Aspects of Human Interaction with Technology: Advancing Concepts presents a careful blend of conceptual, theoretical and applied research in regards to the relationship between technology and humans. This book explores the importance of these interactions, aspects related with trust, communication, data protection, usability concerning organizational change, and e-learning. The advancement of these theories and practices will benefit from this publication as it provides a voice for the users.

Gestão de dados pessoais em saúde

Na presente dissertação pretendemos averiguar da pertinência prática do actual modelo de protecção de dados clínicos, ou seja, se nele está devidamente consagrada a autonomia e a individualidade do utente; pretendemos ainda perceber a tendência evolutiva do sistema português de protecção de dados clínicos, nomeadamente a sua capacidade de inovação e adaptação aos sistemas internacionais, respeitando o nosso ordenamento jurídico. Concretamente, pretendemos perceber de que forma esta informação estará protegida, bem como até onde os utentes estarão consciencializados dos perigos que enfrentam. Embora este seja um problema mundial, o facto é que a Gestão do Sistema de Protecção de Dados Pessoais e Clínicos suscita polémica e interpretações diferentes, dada a sensibilidade ética do tema, a integridade humana. Além deste facto, estamos perante uma problemática que irá sempre envolver vários interesses e consequentemente um confronto de posições. Este trabalho procura ilustrar de que forma se lida com a gestão de dados pessoais no nosso país, de que modo se harmonizam os diferentes interesses e perspectivas, que prioridades se encontram na orientação governamental nesta matéria, quais as penalizações para os eventuais incumpridores e qual o futuro possível dos dados pessoais em saúde, tendo como objectivo comum uma eficácia e sustentabilidade dos mecanismos utilizados. Vamos encontrar interesses divergentes, compromissos permissivos ou restritivos de tratamento de dados, tendências que suportam interesses privados e públicos que se vão concretizar em escolhas eficientes de gestão de dados. Esta diversidade de comportamentos vai ser objecto de estudo e análise neste trabalho, procurando aferir das vantagens e desvantagens de um sistema de informação em saúde: universal com a população coberta, e integrado a fim de compartilhar informações de todos os pacientes, de todas as unidades de prestação de cuidados de saúde.

A engenharia de requisitos como processo inovador nas organizações

Trabalho realizado sob orientação do Prof. António Brandão Moniz para a disciplina “Factores Sociais da Inovação” do Mestrado Engenharia Informática realizado na Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa

INbreast: Toward a Full-field Digital Mammographic Database

Rationale and Objectives Computer-aided detection and diagnosis (CAD) systems have been developed in the past two decades to assist radiologists in the detection and diagnosis of lesions seen on breast imaging exams, thus providing a second opinion. Mammographic databases play an important role in the development of algorithms aiming at the detection and diagnosis of mammary lesions. However, available databases often do not take into consideration all the requirements needed for research and study purposes. This article aims to present and detail a new mammographic database. Materials and Methods Images were acquired at a breast center located in a university hospital (Centro Hospitalar de S. João [CHSJ], Breast Centre, Porto) with the permission of the Portuguese National Committee of Data Protection and Hospital's Ethics Committee. MammoNovation Siemens full-field digital mammography, with a solid-state detector of amorphous selenium was used. Results The new database—INbreast—has a total of 115 cases (410 images) from which 90 cases are from women with both breasts affected (four images per case) and 25 cases are from mastectomy patients (two images per case). Several types of lesions (masses, calcifications, asymmetries, and distortions) were included. Accurate contours made by specialists are also provided in XML format. Conclusion The strengths of the actually presented database—INbreast—relies on the fact that it was built with full-field digital mammograms (in opposition to digitized mammograms), it presents a wide variability of cases, and is made publicly available together with precise annotations. We believe that this database can be a reference for future works centered or related to breast cancer imaging.

Defining health law or the edgewood syndrome

ABSTRACT - The authors’ main purpose is to present ideas on defining Health Law by highlighting the particularities of the field of Health Law as well as of the teaching of this legal branch, hoping to contribute to the maturity and academic recognition of Health Law, not only as a very rich legal field but also as a powerful social instrument in the fulfillment of fundamental human rights. The authors defend that Health Law has several characteristics that distinguish it from traditional branches of law such as its complexity and multidisciplinary nature. The study of Health Law normally covers issues such as access to care, health systems organization, patients’ rights, health professionals’ rights and duties, strict liability, healthcare contracts between institutions and professionals, medical data protection and confidentiality, informed consent and professional secrecy, crossing different legal fields including administrative, antitrust, constitutional, contract, corporate, criminal, environmental, food and drug, intellectual property, insurance, international and supranational, labor/employment, property, taxation, and tort law. This is one of the reasons why teaching Health Law presents a challenge to the teacher, which will have to find the programs, content and methods appropriate to the profile of recipients which are normally non jurists and the needs of a multidisciplinary curricula. By describing academic definitions of Health Law as analogous to Edgewood, a fiction house which has a different architectural style in each of its walls, the authors try to describe which elements should compose a more comprehensive definition. In this article Biolaw, Bioethics and Human Rights are defined as complements to a definition of Health Law: Biolaw because it is the legal field that treats the social consequences that arise from technological advances in health and life sciences; Bioethics which evolutions normally influence the shape of the legal framework of Health; and, finally Human Rights theory and declarations are outlined as having always been historically linked to medicine and health, being the umbrella that must cover all the issues raised in the area of Health Law. To complete this brief incursion on the definition on Health Law the authors end by giving note of the complex relations between this field of Law and Public Health. Dealing more specifically on laws adopted by governments to provide important health services and regulate industries and individual conduct that affect the health of the populations, this aspect of Health Law requires special attention to avoid an imbalance between public powers and individual freedoms. The authors conclude that public trust in any health system is essentially sustained by developing health structures which are consistent with essential fundamental rights, such as the universal right to access health care, and that the study of Health Law can contribute with important insights into both health structures and fundamental rights in order to foster a health system that respects the Rule of Law.-------------------------- RESUMO – O objectivo principal dos autores é apresentar ideias sobre a definição de Direito da Saúde, destacando as particularidades desta área do direito, bem como do ensino deste ramo jurídico, na esperança de contribuir para a maturidade e para o reconhecimento académico do mesmo, não só como um campo juridicamente muito rico, mas, também, como um poderoso instrumento social no cumprimento dos direitos humanos fundamentais. Os autores defendem que o Direito da Saúde tem diversas características que o distinguem dos ramos tradicionais do direito, como a sua complexidade e natureza multidisciplinar. O estudo do Direito da Saúde abrangendo normalmente questões como o acesso aos cuidados, a organização dos sistemas de saúde, os direitos e deveres dos doentes e dos profissionais de saúde, a responsabilidade civil, os contratos entre instituições de saúde e profissionais, a protecção e a confidencialidade de dados clínicos, o consentimento informado e o sigilo profissional, implica uma abordagem transversal de diferentes áreas legais, incluindo os Direitos contratual, administrativo, antitrust, constitucional, empresarial, penal, ambiental, alimentar, farmacêutico, da propriedade intelectual, dos seguros, internacional e supranacional, trabalho, fiscal e penal. Esta é uma das razões pelas quais o ensino do Direito da Saúde representa um desafio para o professor, que terá de encontrar os programas, conteúdos e métodos adequados ao perfil dos destinatários, que são normalmente não juristas e às necessidades de um currículo multidisciplinar. Ao descrever as várias definições académicas de Direito da Saúde como análogas a Edgewood, uma casa de ficção que apresenta um estilo arquitectónico diferente em cada uma de suas paredes, os autores tentam encontrar os elementos que deveriam compor uma definição mais abrangente. No artigo, Biodireito, Bioética e Direitos Humanos são descritos como complementos de uma definição de Direito da Saúde: o Biodireito, dado que é o campo jurídico que trata as consequências sociais que surgem dos avanços tecnológicos na área da saúde e das ciências da vida; a Bioética cujas evoluções influenciam normalmente o quadro jurídico da Saúde; e, por fim, a teoria dos Direitos Humanos e as suas declarações as quais têm estado sempre historicamente ligadas à medicina e à saúde, devendo funcionar como pano de fundo de todas as questões levantadas na área do Direito da Saúde. Para finalizar a sua breve incursão sobre a definição de Direito da Saúde, os autores dão ainda nota das complexas relações entre este último e a Saúde Pública, onde se tratam mais especificamente as leis aprovadas pelos governos para regular os serviços de saúde, as indústrias e as condutas individuais que afectam a saúde das populações, aspecto do Direito da Saúde que requer uma atenção especial para evitar um desequilíbrio entre os poderes públicos e as liberdades individuais. Os autores concluem afirmando que a confiança do público em qualquer sistema de saúde é, essencialmente, sustentada pelo desenvolvimento de estruturas de saúde que sejam consistentes com o direito constitucional da saúde, tais como o direito universal ao acesso a cuidados de saúde, e que o estudo do Direito da Saúde pode contribuir com elementos

Relatório de estágio curricular realizado na Comissão Nacional de Protecção de Dados

The personal data protection is presented as an indisputably complex and transversal subject and gives an account of this report, a result of curricular internship at the Portuguese Commission for Data Protection. The Commission is the competent authority for the control and supervision of personal data processing. The subject around which this report was prepared is the protection of personal data, analyzed in several aspects. The protection of personal data is, for some time, a topic that raises many concerns, because it is closely linked to fundamental rights constitutionally protected. Fundamental rights inherent in each of us are a result of Article 1 of the Constitution of the Portuguese Republic, in the sense that the dignity of the human person is affirmed as the first value around which the Portuguese legal system will have to be based. In other words, is the dignity of the human person the highest value in the Portuguese legal system. Was the development of societies to the point that we know today that has led to the importance to the personal data of citizens. In modern societies, it is possible to know everything about everyone and the curiosity of others seems not to worry about the injuries that affect the rights of citizens. Where new technologies make excuses for the excessive processing of personal data and where subjects do not seem to bother about their personal data crossing the world, it is important that jurisdictions give value the protection of personal data and the implications of its misuse, in that as these are the mirror of identity each of us and can be used against their owners, causing irreparable damage to the their fundamental rights. Being understood as protection of personal data the possibility of each citizen to decide the use of their data and how they can be used, we can say that its protection depends essentially on each of us, as holders of personal data. Therefore, the protection of our data begins in ourselves.

O impacto das redes socias na cessação do contrato de trabalho: liberdade de expressão versus justa causa de despedimento

Dissertação de mestrado em Direito e Informática

Erstellung einer Blitzschutzrichtlinie für die Produktpalette der FAM im Auftrag der "Gesellschaft für Prozeßautomation mbH" (GPA)"

On the basis of the global use of the FAM installations and systems, their location, type and height, a lightning protection system is required, which protects humans and machines from danger of a lightning. At the beginning the development, the threat and the potential for destruction of lightning are described. Besides the resulting solid normative calculation models and tables are presented. Then, the product portfolio of the FAM is characterized. From this demonstration models are selected; on the one hand a model for the totality of all portable devices and the other hand a model which defines the power plants. Subsequently, the risk management and a strengths and weaknesses analysis are performed. After that, with graphical and mathematical models, these weaknesses as well as the functional equipotential bonding and grounding system and its dimensioning are investigated and solutions are demonstrated. The following is a coordination of lightning protection standard with other directives and standards in order to classify the resulting internal lightning protection and protective measures against electromagnetic pulse and to generate a uniform protection and application platform. Furthermore, problems of the economy of protective circuit is shown and a solution is given. Finally, the indicated possible solutions are replaced by definitions. The main classification and structure of lightning protection directive are shown and exemplarily applied.

IPH response to the HIQA consultation on the National Demographic Dataset and Guidance for use in health and social care settings in Ireland

The remit of the Institute of Public Health in Ireland (IPH) is to promote cooperation for public health between Northern Ireland and the Republic of Ireland in the areas of research and information, capacity building and policy advice. Our approach is to support Departments of Health and their agencies in both jurisdictions, and maximise the benefits of all-island cooperation to achieve practical benefits for people in Northern Ireland and the Republic of Ireland. IPH have previously responded to consultations to the Department of Health’s Discussion Paper on the Proposed Health Information Bill (June 2008), the Health Information and Quality Authority on their Corporate Plan (Oct 2007), and the Road Safety Authority of Ireland Road Safety Strategy (Jul 2012). IPH supports the development of a national standard demographic dataset for use within the health and social care services. Provided necessary safeguards are put in place (such as ethics and data protection) and the purpose of collecting the information is fully explained to subjects, mandatory provision of a minimum demographic dataset is usually the best way to achieve the necessary coverage and data quality. Demographic information is needed in several forms to support the public health function: Detailed aggregated information for comparison to population counts in order to assess equity of access to healthcare as well as examining population patterns and trends in morbidity and mortality Accurate demographic information for the surveillance of infectious disease outbreaks, monitoring vaccination programmes, setting priorities for public health interventions Linked to other data outside of health and social care such as population data, survey data, and longitudinal studies for research and analysis purposes.   Identify and address public health issues to tackle health inequalities, and to monitor the success of such efforts to tackle them.

Framework for Corporate and Financial Governance for Regulatory Bodies under the aegis of the Department of Health and Children

The document should be read as supplementary to existing requirements as set out both in statute â?" particularly legislation specific to your organisation, the Health Acts 1947-2004, Ombudsman Act, 1980, Data Protection Acts 1988 & 2003, Freedom of Information Acts 1997-2003, Ethics in Public Office Acts 1995 & 2001, Ombudsman for Children Act, 2002 and the Comptroller and Auditor General (Amendment) Act, 1993 – and in Government approved guidelines, including the Code of Practice for the Governance of State Bodies (2001), Public Financial Procedures, The Role and Responsibilities of Accounting Officers (2003) and Risk Management Guidance for Government Departments and Offices (2004). Read the report (PDF, 1.4mb)  

Plan de actualización informática de las oficinas de la Mutua

Aquest projecte ha procurat reflectir les diferents opcions que té la Mútua a l'hora d'actualitzar el seu sistema informàtic. Després d'estudiar la viabilitat de les diferents opcions proposa solucions per a tots els aspectes plantejats.