The conceptual and operational compatibility of data breach notification and information privacy laws

Mandatory data breach notification laws are a novel and potentially important legal instrument regarding organisational protection of personal information. These laws require organisations that have suffered a data breach involving personal information to notify those persons that may be affected, and potentially government authorities, about the breach. The Australian Law Reform Commission (ALRC) has proposed the creation of a mandatory data breach notification scheme, implemented via amendments to the Privacy Act 1988 (Cth). However, the conceptual differences between data breach notification law and information privacy law are such that it is questionable whether a data breach notification scheme can be solely implemented via an information privacy law. Accordingly, this thesis by publications investigated, through six journal articles, the extent to which data breach notification law was conceptually and operationally compatible with information privacy law. The assessment of compatibility began with the identification of key issues related to data breach notification law. The first article, Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches started this stage of the research which concluded in the second article, The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments (‘Mandatory Notification‘). A key issue that emerged was whether data breach notification was itself an information privacy issue. This notion guided the remaining research and focused attention towards the next stage of research, an examination of the conceptual and operational foundations of both laws. The second article, Mandatory Notification and the third article, Encryption Safe Harbours and Data Breach Notification Laws did so from the perspective of data breach notification law. The fourth article, The Conceptual Basis of Personal Information in Australian Privacy Law and the fifth article, Privacy Invasive Geo-Mashups: Privacy 2.0 and the Limits of First Generation Information Privacy Laws did so for information privacy law. The final article, Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws synthesised previous research findings within the framework of contextualisation, principally developed by Nissenbaum. The examination of conceptual and operational foundations revealed tensions between both laws and shared weaknesses within both laws. First, the distinction between sectoral and comprehensive information privacy legal regimes was important as it shaped the development of US data breach notification laws and their subsequent implementable scope in other jurisdictions. Second, the sectoral versus comprehensive distinction produced different emphases in relation to data breach notification thus leading to different forms of remedy. The prime example is the distinction between market-based initiatives found in US data breach notification laws compared to rights-based protections found in the EU and Australia. Third, both laws are predicated on the regulation of personal information exchange processes even though both laws regulate this process from different perspectives, namely, a context independent or context dependent approach. Fourth, both laws have limited notions of harm that is further constrained by restrictive accountability frameworks. The findings of the research suggest that data breach notification is more compatible with information privacy law in some respects than others. Apparent compatibilities clearly exist as both laws have an interest in the protection of personal information. However, this thesis revealed that ostensible similarities are founded on some significant differences. Data breach notification law is either a comprehensive facet to a sectoral approach or a sectoral adjunct to a comprehensive regime. However, whilst there are fundamental differences between both laws they are not so great to make them incompatible with each other. The similarities between both laws are sufficient to forge compatibilities but it is likely that the distinctions between them will produce anomalies particularly if both laws are applied from a perspective that negates contextualisation.

Charity law, advocacy and the aid/watch decision : compatibility of charitable purposes and political objects — the view from Australia

Introduction In 1952 the Nathan report stated that: Some of the most valuable activities of voluntary societies consist, however, in the fact that they may be able to stand aside from and criticize State action or inaction, in the interests of the inarticulate man in the street. Some 60 years later it remained the case that if a voluntary society wanted to gain or retain charitable status then, contrary to the Nathan report, the one thing it could not do was set itself up with the purpose of criticizing State action or inaction. This legal position was adopted by the authorities in Australia with the Australian Taxation Office (ATO) noting in Taxation Ruling TR2005/21: 102. An institution or fund is not charitable if its purpose is advocating a political party or cause, attempting to change the law or government policy, or propagating or promoting a particular point of view. So, why, if it is such a valuable activity, have governments steadfastly refused to allow charities to have as their purpose the freedom to advocate in this way and how has this situation been affected by the recent High Court of Australia decision in Aid/Watch v Commissioner of Taxation? This article proposes to address such questions. Beginning with some background history, it explains that, initially, the current constraints did not apply. Then it looks at the nature of these constraints: how does the law define what constitutes the type of political activity that a charity must not undertake? What is the rationale for prohibition? How has the judiciary contributed to the development of the law in this area in recent years? This will lead into a consideration of the Aid/Watch case and the implications arising from the recent final decision. The article concludes by reflecting on what has changed and why the view on this contentious matter now looks different from Australia.

How quantum theory is developing the field of information retrieval

This position paper provides an overview of work conducted and an outlook of future directions within the field of Information Retrieval (IR) that aims to develop novel models, methods and frameworks inspired by Quantum Theory (QT).

Automata modeling for cognitive interference in users' relevance judgement

Quantum theory has recently been employed to further advance the theory of information retrieval (IR). A challenging research topic is to investigate the so called quantum-like interference in users’ relevance judgement process, where users are involved to judge the relevance degree of each document with respect to a given query. In this process, users’ relevance judgement for the current document is often interfered by the judgement for previous documents, due to the interference on users’ cognitive status. Research from cognitive science has demonstrated some initial evidence of quantum-like cognitive interference in human decision making, which underpins the user’s relevance judgement process. This motivates us to model such cognitive interference in the relevance judgement process, which in our belief will lead to a better modeling and explanation of user behaviors in relevance judgement process for IR and eventually lead to more user-centric IR models. In this paper, we propose to use probabilistic automaton(PA) and quantum finite automaton (QFA), which are suitable to represent the transition of user judgement states, to dynamically model the cognitive interference when the user is judging a list of documents.

Towards semantic search and inference in electronic medical records : an approach using concept-based information retrieval

For more than a decade research in the field of context aware computing has aimed to find ways to exploit situational information that can be detected by mobile computing and sensor technologies. The goal is to provide people with new and improved applications, enhanced functionality and better use experience (Dey, 2001). Early applications focused on representing or computing on physical parameters, such as showing your location and the location of people or things around you. Such applications might show where the next bus is, which of your friends is in the vicinity and so on. With the advent of social networking software and microblogging sites such as Facebook and Twitter, recommender systems and so on context-aware computing is moving towards mining the social web in order to provide better representations and understanding of context, including social context. In this paper we begin by recapping different theoretical framings of context. We then discuss the problem of context- aware computing from a design perspective.

Cardiac ARIA Index: Measuring Accessibility to Cardiovascular Services in Rural and Remote Australia via Applied Geographic Spatial Technology

Cardiovascular disease (CVD) continues to impose a heavy burden in terms of cost, disability and death in Australia. Evidence suggests that increasing remoteness, where cardiac services are scarce, is linked to an increased risk of dying from CVD. Fatal CVD events are reported to be between 20% and 50% higher in rural areas compared to major cities. The Cardiac ARIA project, with its extensive use of geographic Information Systems (GIS), ranks each of Australia’s 20,387 urban, rural and remote population centres by accessibility to essential services or resources for the management of a cardiac event. This unique, innovative and highly collaborative project delivers a powerful tool to highlight and combat the burden imposed by cardiovascular disease (CVD) in Australia. Cardiac ARIA is innovative. It is a model that could be applied internationally and to other acute and chronic conditions such as mental health, midwifery, cancer, respiratory, diabetes and burns services. Cardiac ARIA was designed to: 1. Determine by expert panel, what were the minimal services and resources required for the management of a cardiac event in any urban, rural or remote population locations in Australia using a single patient pathway to access care. 2. Derive a classification using GIS accessibility modelling for each of Australia’s 20,387 urban, rural and remote population locations. 3. Compare the Cardiac ARIA categories and population locations with census derived population characteristics. Key findings are as follows: • In the event of a cardiac emergency, the majority of Australians had very good access to cardiac services. Approximately 71% or 13.9 million people lived within one hour of a category one hospital. • 68% of older Australians lived within one hour of a category one hospital (Principal Referral Hospital with access to Cardiac Catheterisation). • Only 40% of indigenous people lived within one hour of the category one hospital. • 16% (74000) of indigenous people lived more than one hour from a hospital. • 3% (91,000) of people 65 years of age or older lived more than one hour from any hospital or clinic. • Approximately 96%, or 19 million, of people lived within one hour of the four key services to support cardiac rehabilitation and secondary prevention. • 75% of indigenous people lived within one hour of the four cardiac rehabilitation services to support cardiac rehabilitation and secondary prevention. Fourteen percent (64,000 persons) indigenous people had poor access to the four key services to support cardiac rehabilitation and secondary prevention. • 12% (56,000) of indigenous people were more than one hour from a hospital and only had access one the four key services (usually a medical service) to support cardiac rehabilitation and secondary prevention.

Thomas Young’s investigations in gradient-index optics

Purpose: James Clerk Maxwell is usually recognized as being the first, in 1854, to consider using inhomogeneous media in optical systems. However, some fifty years earlier Thomas Young, stimulated by his interest in the optics of the eye and accommodation, had already modeled some applications of gradient-index optics. These applications included using an axial gradient to provide spherical aberration-free optics and a spherical gradient to describe the optics of the atmosphere and the eye lens. We evaluated Young’s contributions. Method: We attempted to derive Young’s equations for axial and spherical refractive index gradients. Raytracing was used to confirm accuracy of formula. Results: We did not confirm Young’s equation for the axial gradient to provide aberration-free optics, but derived a slightly different equation. We confirmed the correctness of his equations for deviation of rays in a spherical gradient index and for the focal length of a lens with a nucleus of fixed index surrounded by a cortex of reducing index towards the edge. Young claimed that the equation for focal length applied to a lens with part of the constant index nucleus of the sphere removed, such that the loss of focal length was a quarter of the thickness removed, but this is not strictly correct. Conclusion: Young’s theoretical work in gradient-index optics received no acknowledgement from either his contemporaries or later authors. While his model of the eye lens is not an accurate physiological description of the human lens, with the index reducing least quickly at the edge, it represented a bold attempt to approximate the characteristics of the lens. Thomas Young’s work deserves wider recognition.

Can the Cardiac ARIA Index Improve Cardiac Care for Australia's Indigenous Population?

Background: Timely access to appropriate cardiac care is critical for optimising outcomes. Our aim was to derive an objective, comparable, geographic measure reflecting access to cardiac services for Australia's 20,387 population locations. Methods: An expert panel defined a single patient care pathway. Using geographic information systems (GIS) the numeric/alpha index was modelled in two phases. The acute phase index (numeric) ranged from 1 (access to tertiary centre with PCI ≤1 h) to 8 (no ambulance service, >3 h to medical facility, air transport required). The aftercare index was modelled into 5 alphabetic categories; A (Access to general practitioner, pharmacy, cardiac rehabilitation, pathology ≤1 h) to E (no services available within 1 h). Results: Approximately 70% or 13.9 million people lived within a CardiacARIAindex category 1A location. Disparity continues in access to category 1A cardiac services for 5.8 million (30%) of all Australians, 60% of Aboriginal and Torres Strait Islander people and 32% of people over 65 years of age. In a cardiac emergency only 40% of the Indigenous population reside within one hour of category 1 hospital. Approximately 30% (81,491 Indigenous persons) are more than one to three hours from basic cardiac services. Conclusion: Geographically, the majority of Australian's have timely access for survival of a cardiac event. The CardiacARIAindex objectively demonstrates that the healthcare system may not be providing for the needs of 60% of Indigenous people residing outside the 1A geographic radius. Innovative clinical practice maybe required to address these disparities.

Where not to have a Heart Attack in Australia!: The Cardiac ARIA Index

Background/aims: Access to appropriate health care following an acute cardiac event is important for positive outcomes. The aim of the Cardiac ARIA index was to derive an objective, comparable, geographic measure reflecting access to cardiac services across Australia. Methods: Geographic Information Systems (GIS) were used to model a numeric-alpha index based on acute management from onset of symptoms to return to the community. Acute time frames have been calculated to include time for ambulance to arrive, assess and load patient, and travel to facility by road 40–80 kph. Results: The acute phase of the index was modelled into five categories: 1 [24/7 percutaneous cardiac intervention (PCI) ≤1 h]; 2 [24/7 PCI 1–3 h, and PCI less than an additional hour to nearest accident and emergency room (A&E)]: 3 [Nearest A&E ≤3 h (no 24/7 PCI within an extra hour)]: 4 [Nearest A&E 3–12 h (no 24/7 PCI within an extra hour)]: 5 [Nearest A&E 12–24 h (no 24/7 PCI within an extra hour)]. Discharge care was modelled into three categories based on time to a cardiac rehabilitation program, retail pharmacy, pathology services, hospital, GP or remote clinic: (A) all services ≤30 min; (B) >30 min and ≤60 min; (C) >60 min. Examples of the index indicate that the majority of population locations within capital cities were category 1A; Alice Springs and Byron Bay were 3A; and the Northern Territory town of Maningrida had minimal access to cardiac services with an index ranking of 5C. Conclusion: The Cardiac ARIA index provides an invaluable tool to inform appropriate strategies for the use of scarce cardiac resources.

A requirements framework for semantic business process modelling

The emergence of semantic technologies to deal with the underlying meaning of things, instead of a purely syntactical representation, has led to new developments in various fields, including business process modeling. Inspired by artificial intelligence research, technologies for semantic Web services have been proposed and extended to process modeling. However, the applicablility of semantic Web services for semantic business processes is limited because business processes encompass wider requirements of business than Web services. In particular, processes are concerned with the composition of tasks, that is, in which order activities are carried out, regardless of their implementation details; resources assigned to carry out tasks, such as machinery, people, and goods; data exchange; and security and compliance concerns.