A holistic implementation of the Alliance Transparency Standards: Demystifying research governance and sensitive data processing

The increasing use of digital technologies in public health management has significantly expanded the processing of sensitive personal data, requiring legal mechanisms capable of ensuring the protection of privacy and fundamental rights. In this context, the Brazilian General Data Protection Law establishes regulatory parameters governing the processing of personal information by public and private institutions, including those operating in the healthcare sector. This study aims to analyze the legal challenges related to the application of the General Data Protection Law in the processing of sensitive data within the public health system of Manaus, Amazonas. The research is characterized as a qualitative and descriptive literature review, based on recent scientific articles and academic studies addressing personal data protection, information governance and public sector responsibility in health data processing. The results indicate that the implementation of the legislation faces challenges related to technological infrastructure, the absence of consolidated institutional information security policies and the need for training of public agents responsible for data processing. It is observed that the effectiveness of data protection regulations depends on the integration between legal norms, administrative practices and governance mechanisms capable of ensuring transparency, security and accountability in the use of personal information. The study concludes that strengthening institutional strategies aimed at protecting sensitive data represents an essential element for the consolidation of safer public health services aligned with the protection of fundamental rights, particularly within the Amazonian context.

The advent of Artificial Intelligence (AI) has revolutionized various domains, and Content Management Systems (CMS) are no exception. Traditional CMS workflows, often reliant on manual processes, have struggled to keep up with the growing demands for scalability, speed, and personalization in managing digital content. AI - powered CMS address these challenges by introducing automation, enhancing efficiency, and delivering personalized user experiences. Through the integration of AI technologies such as Natural Language Processing (NLP), Machine Learning (ML), and Computer Vision, modern CMS have evolved into intelligent platforms capable of automating workflows, optimizing content delivery, and driving data - driven decision - making. This paper explores the transformative potential of AI in CMS, focusing on its applications in workflow automation and user experience enhancement. AI enables the automation of repetitive tasks like content tagging, categorization, and scheduling, significantly reducing manual effort and human error. At the same time, it enhances user engagement by offering personalized content recommendations, optimizing search functionalities, and dynamically adapting content to user contexts. These advancements allow businesses to manage content more effectively and cater to diverse audience needs in real time. However, the integration of AI into CMS is not without challenges. Issues such as data privacy concerns, bias in AI models, and the complexity of integrating AI into legacy systems remain significant barriers. This paper addresses these challenges and proposes actionable recommendations, including the development of explainable AI systems, robust data security frameworks, and scalable architectures that accommodate diverse business needs. As businesses increasingly adopt AI - powered CMS, their potential to transform content management is undeniable. These systems not only streamline workflows and improve operational efficiency but also empower organizations to deliver meaningful and personalized experiences to users. By addressing current challenges and advancing AI technologies, the future of content management will be defined by intelligent, adaptive, and user - centric platforms that bridge the gap between technology and human creativity. This comprehensive review highlights the opportunities and challenges of leveraging AI in CMS and underscores the importance of continued research and innovation to fully realize its potential. AI - powered CMS are not merely tools for managing content but catalysts for digital transformation, enabling organizations to thrive in an increasingly dynamic digital landscape.

O presente artigo pretende aproximar o conceito de dados pessoais sensíveis de uma teoria de direitos fundamentais, por meio de uma interpretação dos princípios e valores constitucionais que justificam a proteção do direito à privacidade. Pretende-se investigar a Lei Geral de Proteção de Dados - Lei 13.709/2018 - e as políticas por ela assumidas no que diz respeito ao trata­mento de dados pessoais sensíveis tanto pelo Estado, quanto pelo Mercado. Sustenta-se a necessidade de um tratamento restrito dos dados pessoais sensíveis como forma de proteção contra o seu uso discriminatório, visando a promoção plena do exercício democrático.

Continuous monitoring activities in surveillance system generate massive amount of data to be transferred from Internet-of-Things (IoT) devices (i.e., cameras and sensors) to a centralized processing unit for analysis. However, several issues need to be addressed, including data migration over bandwidth limited and high latency communication networks, and the heterogeneous nature of data obtained from the surveillance system. The aim of this paper is to develop a scalable and lightweight intelligent distributed surveillance system that make use of an integrated framework of Internet-of-Things (IoT) and cloud computing. It leverages on the pervasiveness in IoT and ubiquitous property of cloud computing technology. This paper introduces the concept of bringing cloud closer to the IoT in order to address the resource poverty of IoT and the dependency for massive data transmission to distant cloud. For providing real-time on-site object detection, this paper instantiates a cloudlet on resource-rich nearby infrastructure which is connected to the IoT devices for distributed retrieval and processing of critical and sensitive data.

In the era of intelligent fitness technologies, the need for personalized training solutions that adapt to individual users’ physiological states, performance patterns, and exercise goals has grown considerably. This trend highlights the importance of advanced fitness recommendation systems capable of providing precise, adaptive, and data-driven training guidance. However, achieving such personalization requires continuous processing of sensitive physiological and behavioral data, which introduces critical security risks, including unauthorized access, data manipulation, and system vulnerabilities. To address these challenges, this paper presents a novel edge-enabled personalized fitness recommendation framework that integrates individualized training optimization with strong security guarantees. By leveraging the distributed and proximate processing capabilities of edge computing, the system minimizes communication exposure, reduces latency, and enables sensitive data to remain within secure edge environments or directly on the user’s device. This architectural design substantially mitigates security threats that commonly arise in centralized cloud-based processing. Comprehensive experimental evaluations demonstrate that the proposed framework not only delivers highly accurate and tailored fitness recommendations but also provides enhanced system robustness and data security compared with traditional cloud-centric approaches. The results indicate that edge computing offers a promising pathway toward secure, adaptive, and scalable personalized training technologies that support users’ performance improvement without compromising data integrity or system safety.

In a society in which knowledge is one of the main sources of wealth, the internet and Information and Communication Technology (ICT) play an important role in the rapid dissemination of information, connecting people, accelerating the production, distribution and intensive use of information on networks, which allows reflection on how the collection, storage and analysis of this information and data, sometimes sensitive, is being carried out. This research questions the consequences of the absence of personal data in the list of sensitive data provided for in the General Data Protection Law (LGPD). Therefore, the general objective of the study is to investigate the impacts and applicability of the LGPD in protecting the rights to privacy, freedom and security of personal data in Brazil. To this end, the legal bases for the processing of personal and sensitive data in the LGPD were identified, an analysis of the risks of personal data leaks and fraud and the protection measures provided for by the LGPD were carried out, and then the sanctions provided for in the LGPD and their value in liability for data crimes were assessed. This work was developed using a qualitative methodological approach, with a deductive method and bibliographic and documentary research.

The protection and processing of sensitive data in big data systems are common problems as the increase in data size increases the need for high processing power. Protection of the sensitive data on a system that contains multiple connections with different privacy policies, also brings the need to use proper cryptographic key exchange methods for each party, as extra work. Homomorphic encryption methods can perform similar arithmetic operations on encrypted data in the same way as a plain format of the data. Thus, these methods provide data privacy, as data are processed in the encrypted domain, without the need for a plain form and this allows outsourcing of the computations to cloud systems. This also brings simplicity on key exchange sessions for all sides. In this paper, we propose novel privacy preserving clustering methods, alongside homomorphic encryption schemes that can run on a common high performance computation platform, such as a cloud system. As a result, the parties of this system will not need to possess high processing power because the most power demanding tasks would be done on any cloud system provider. Our system offers a privacy preserving distance matrix calculation for several clustering algorithms. Considering both encrypted and plain forms of the same data for different key and data lengths, our privacy preserving training method’s performance results are obtained for four different data clustering algorithms, while considering six different evaluation metrics.

Preservation of privacy in data mining and machine learning has emerged as an absolute prerequisite in many practical scenarios, especially when the processing of sensitive data is outsourced to an external third party. Currently, privacy preservation methods are mainly based on randomization and/or perturbation, secure multiparty computations and cryptographic methods. In this paper, we take advantage of the partial homomorphic property of some cryptosystems to train simple machine learning models with encrypted data. Our basic scenario has three parties: multiple Data Owners, which provide encrypted training examples; the Algorithm Owner (or Application), which processes them to adjust the parameters of its models; and a semi-trusted third party, which provides privacy and secure computation services to the Application in some operations not supported by the homomorphic cryptosystem. In particular, we focus on two issues: the use of multiple-key cryptosystems, and the impact of the quantization of real-valued input data required before encryption. In addition, we develop primitives based on the outsourcing of a reduced set of operations that allows to implement general machine learning algorithms using efficient dedicated hardware. As applications, we consider the training of classifiers using privacy-protected data and the tracking of a moving target using encrypted distance measurements.

Traditionally, sensor networks are surmised to enhance safety in underground mines by providing consistent monitoring of the conditions. However, to cope with the frequent condition changes of such a hostile environment, we need a specific network architecture for the deployed nodes to enable dynamic decision making. In this article, we argue that the fog computing paradigm can be leveraged to ensure safety in the Internet of Underground-Mine Things. We emphasize on prioritizing and speeding up the processing of sensitive data by introducing a factor named "criticality index" and ensuring the fairness of bandwidth allocation using this index to comply with the resource requirement of critical data. We formulate the interaction between the fog nodes using the notions of the Stackelberg game. Simulation-based results show that using the proposed scheme, the fog nodes are able to allocate bandwidth with less average error and offset bandwidth, compared to the benchmark schemes.

This chapter discusses computing data in a cloud, current challenges to store, retrieve, process, as well as security requirements, and possible solutions. It frames the trust-based access control model that incorporates a digital signature to minimize the malicious activity for storage, retrieval, updates, and processing of sensitive data. The chapter provides the trust framework for the user and access control algorithms for data processing in the cloud environment. Cloud computing is a paradigm with unlimited on-demand services that is software as a service. It can virtualize hardware and software resources, with high processing power, storage, and pay-per-usage. Big Data technology solves many problems irrespective of volume, velocity, and source of generation. It is a continually changing technology, and many industries, customers, and government agencies are involved in usage and managing. Vulnerability assessment of the devices and software supporting these devices are essential to trust the functionality of these devices.

Data Protection Challenges in the Processing of Sensitive Data

Cloud computing is a convenient model for processing data remotely. However, users must trust their cloud provider with the confidentiality and integrity of the stored and processed data. To increase the protection of virtual machines, AMD introduced SEV, a hardware feature which aims to protect code and data in a virtual machine. This allows to store and process sensitive data in cloud environments without the need to trust the cloud provider or the underlying software. However, the virtual machine still depends on the hypervisor for performing certain activities, such as the emulation of special CPU instructions, or the emulation of devices. Yet, most code that runs in virtual machines was not written with an attacker model which considers the hypervisor as malicious. In this work, we introduce a new class of attacks in which a malicious hypervisor manipulates external interfaces of an SEV or SEV-ES virtual machine to make it act against its own interests. We start by showing how we can make use of virtual devices to extract encryption keys and secret data of a virtual machine. We then show how we can reduce the entropy of probabilistic kernel defenses in the virtual machine by carefully manipulating the results of the CPUID and RDTSC instructions. We continue by showing an approach for secret data exfiltration and code injection based on the forgery of MMIO regions over the VM's address space. Finally, we show another attack which forces decryption of the VM's stack and uses Return Oriented Programming to execute arbitrary code inside the VM. While our approach is also applicable to traditional virtualization environments, its severity significantly increases with the attacker model of SEV-ES, which aims to protect a virtual machine from a benign but vulnerable hypervisor.

This paper proposes a new identity, and its underlying meta-data, model. The approach enables secure spanning of identity meta-data across many boundaries such as health-care, financial and educational institutions, including all others that store and process sensitive personal data. It introduces the new concepts of Compound Personal Record (CPR) and Compound Identifiable Data (CID) ontology, which aim to move toward own your own data model. The CID model ensures authenticity of identity meta-data; high availability via unified Cloud-hosted XML data structure; and privacy through encryption, obfuscation and anonymity applied to Ontology-based XML distributed content. Additionally CID via XML ontologies is enabled for identity federation. The paper also suggests that access over sensitive data should be strictly governed through an access control model with granular policy enforcement on the service side. This includes the involvement of relevant access control model entities, which are enabled to authorize an ad-hoc break-glass data access, which should give high accountability for data access attempts.

Production of a natural language description for the function of a source code segment is commonly referred to as source code summarization. Useful comments in source code can facilitate more rapid onboarding of new engineers and contribute to decreased maintenance costs. Unfortunately, the documentation task can also be labor intensive. In this paper, we introduce a new model agnostic tool for AI driven automation of source code summarization at scale. The initial version of the adVanced AI Driven Enhancement to Readability for Spurce Code (VADER-SC) software offers numerous options for customization and the ability to leverage a variety of AI models to enable experimentation in resource constrained environments, while also scaling up to benefit from larger models in contexts with increased compute resources. It further supports private cloud, self-hosted, and air-gapped network configurations for environments with strict intellectual property protections or processing of sensitive or controlled data. Qualitative and quantitative results suggest model selection, fine-tuning, and multi-shot tailoring significantly impact the quality of generated comments. VADER-SC could be an enabler for practitioners to explore large-scale automation of AI driven source code summarization and researchers may find it enables studies with larger volumes of disparate data across a diversity of AI model options and target programming languages.

Using administrative and judicial remedies under data protection laws to challenge the processing of sensitive personal data by international sport governing bodies