A Framework for Privacy-Aware User Data Trading

Iyilade, Johnson; Vassileva, Julita

doi:10.1007/978-3-642-38844-6_28

Cited by 12 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Introduction of new purposes in the privacy policies is considered to support personalized services [11]. A framework for privacy-aware user data trading, describing the policy negotiation and user compensation for data sharing, is shown [10]. P2U does not explicitly claim to consider legal requirements of the GDPR nor another legal basis.…”

Section: Related Workmentioning

confidence: 99%

Critical Analysis of LPL according to Articles 12 - 14 of the GDPR

Gerl

Pohl

2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

On the 25th May 2018 the General Data Protection Regulation (GDPR) will enter into force implying new challenges to both legal and computer sciences.e Layered Privacy Language (LPL) is intended to model privacy policies to enforce policy-based, privacypreserving processing. In this paper, we identify requirements for privacy policies based on Art. 12 -14 of the GDPR, analyze LPL according to the derived requirements, and propose improvements for LPL accordingly. CCS CONCEPTS•Security and privacy → Domain-speci c security and privacy architectures; Privacy protections; •Social and professional topics → Privacy policies;

show abstract

Section: Related Workmentioning

confidence: 99%

Critical Analysis of LPL according to Articles 12 - 14 of the GDPR

Gerl

Pohl

2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…We believe that, as user data market evolves and users become active players in this emerging data market, rigid and inflexible policies will not suffice. Negotiation of some aspects of the policies will be required so as to provide flexibility and adaptability to various privacy personality types, purpose and context of use, as well as give incentives for users to allow sharing of their data across applications [12].…”

Section: Existing Privacy Policy Languagesmentioning

confidence: 99%

P2U: A Privacy Policy Specification Language for Secondary Data Sharing and Usage

Iyilade

Vassileva

2014

2014 IEEE Security and Privacy Workshops

Self Cite

View full text Add to dashboard Cite

Within the last decade, there are growing economic/social incentives and opportunities for secondary use of data in many sectors, and strong market forces currently drive the active development of systems that aggregate user data gathered by many sources. This secondary use of data poses privacy threats due to unwanted use of data for the wrong purposes such as discriminating the user for employment, loan and insurance. Traditional privacy policy languages such as the Platform for Privacy Preferences (P3P) are inadequate since they were designed long before many of these technologies were invented and basically focus on enabling user-awareness and control during primary data collection (e.g. by a website). However, with the advent of Web 2.0 and Social Networking Sites, the landscape of privacy is shifting from limiting collection of data by websites to ensuring ethical use of the data after initial collection. To meet the current challenges of privacy protection in secondary context, we propose a privacy policy language, Purpose-to-Use (P2U), aimed at enforcing privacy while enabling secondary user information sharing across applications, devices, and services on the Web.

show abstract

“…The marketplace will allow for trustworthy and transparent trading and exchange of user data among applications. This section describes briefly the marketplace framework, proposed in our previous work [8] to which the TR mechanism, the main contribution of this paper, is applied. As shown in Figure 1, the main players in the marketplace are:…”

Section: Introductionmentioning

confidence: 99%

“…data consumer) the user data is re-shared and for what purpose; (ii) privacy policy enforcement challenge, which ensures that a data consumer complies with the contractual obligation for which the data was shared and does not use the data for unauthorized purposes-after user data has been reshared. We addressed the challenge (i) in our earlier work [8] through the formulation of a flexible privacy policy framework called Purpose-to-Use (P2U). P2U is designed to support secondary user information sharing among applications so that a DP can offer and negotiate user data sharing with other applications (data consumers) according to an explicit user-editable and negotiable privacy policy.…”

Section: Introductionmentioning

confidence: 99%

Trust Mechanism for Enforcing Compliance to Secondary Data Use Contracts

Noorian

Iyilade

Mohkami

et al. 2014

2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications

Self Cite

View full text Add to dashboard Cite

In many research and business domains, there are efforts to develop systems that aggregate user data gathered by various data sources. This approach involves secondary sharing of user data and potentially benefits the user in terms of improved personalization and better experience. However, concerns regarding privacy arise when sharing user data with unknown third parties. These concerns can be alleviated at two stages: i) ensuring selective control of the applications to share user data with, and ii) monitoring and penalizing errant data consumers who violate the terms of their contractual agreement and potentially abuse user data. This paper addresses the second stage of data use contract enforcement.We propose a trust management mechanism for monitoring data consumers' compliance to the contractual agreements for which data was shared with them. The trust mechanism is based on user complaints about suspected privacy violations and is able to identify the data consumers who are responsible. The framework penalizes the data consumer found guilty of violating its data use agreement by decreasing its trust value. This makes the data consumer less likely to be selected to receive user data, and limits its participation in the user data marketplace, forcing it to pay a higher price for purchase of user data.

show abstract

A Framework for Privacy-Aware User Data Trading

Cited by 12 publications

References 11 publications

Critical Analysis of LPL according to Articles 12 - 14 of the GDPR

Critical Analysis of LPL according to Articles 12 - 14 of the GDPR

P2U: A Privacy Policy Specification Language for Secondary Data Sharing and Usage

Trust Mechanism for Enforcing Compliance to Secondary Data Use Contracts

Contact Info

Product

Resources

About