Privacy Data Management and Awareness for Public Administrations: A Case Study from the Healthcare Domain

Abstract

Abstract. Development of Information Systems that ensure privacy is a challenging task that spans various fields such as technology, law and policy. Reports of recent privacy infringements indicate that we are far from not only achieving privacy but also from applying Privacy by Design principles. This is due to lack of holistic methods and tools which should enable to understand privacy issues, incorporate appropriate privacy controls during design-time and create and enforce a privacy policy during run-time. To address these issues, we present VisiOn Privacy Platform which provides holistic privacy management throughout the whole information system lifecycle. It contains a privacy aware process that is supported by a software platform and enables Data Controllers to ensure privacy and Data Subjects to gain control of their data, by participating in the privacy policy formulation. A case study from the healthcare domain is used to demonstrate the platform's benefits.

A Data Scope Management Service to Support Privacy by Design and GDPR Compliance

“…The main reason has been to empower the data subjects' data protection and rights. Before the advent of GDPR, there were many problems related to having distinct and different national regulations among the EU Countries [7], giving uncertainty on guaranteeing coherent EU citizen rights all over the Europe [31]. Such differences led to significant problems b https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_ design_and_by_default.pdf c https://cordis.europa.eu/project/id/787068 such as uncontrolled exchange, manipulation and exploitation of user data with important drawbacks and impact for the EU citizens.…”

“…Such differences led to significant problems b https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_ design_and_by_default.pdf c https://cordis.europa.eu/project/id/787068 such as uncontrolled exchange, manipulation and exploitation of user data with important drawbacks and impact for the EU citizens. The lack of a ''standard'' in Europe, for these crucial aspects, created problems also to organizations interested in enlarging their market [7]. For instance, companies having businesses in a EU country had to be compliant with the specific national data protection regulation of that Country, and if they wanted to extend services to more EU Countries, they would have had to cope with different regulations for selling the same products, by dealing differently with personal data of their customers [10].…”