FedGR: Federated Graph Neural Network for Recommendation Systems

The European General Data Protection Regulation (GDPR), which has been in effect since 25th May, 2018, tightens the requirements regarding data protection for anyone collecting or processing personal data within the European Union (EU) and is connected with heavy fines in case of violations. The topic of data privacy for cyber-physical systems and the related requirements towards development and operation are, however, not new. Many regional laws and regulations pursuing the goals of confidentiality, integrity, availability, storage and purpose limitation, minimisation, transparency and accuracy of personal data have already been in place long before the introduction of the GDPR. But for many companies, dealing with the formal requirements defined by the GDPR is a new and challenging task. We developed a clearly structured approach based on established and proven workflows aimed at integrating data protection topics into existing development processes and thereby achieving compliance with data protection regulations. This approach follows the widely used V-model for development and is inspired by concepts from functional safety development. Both the discipline of functional safety and that of data privacy aim to protect the end-user against harm caused by malfunctions of the system they are using. In the first case this refers to physical harm, while in the second to harm due to violations of fundamental rights and freedoms of natural persons. In the age of digitalisation there are currently indications for a paradigm shift that puts both kinds of harm on the same level. The approach starts by defining the scope of collection and processing of private data as well as the relevant functions and interfaces. Based on this, the threats related to the loss or breach of personal data are analysed and corresponding goals are formulated. A high-level strategy for reaching those goals and preventing data privacy infringements is then derived. This strategy is further refined into concrete technical and process solutions for which verification and validation criteria are defined.

The high take-up rate of artificial intelligence (AI) by different sectors has triggered critical interest in data security, privacy, and ethics compliance. This work discusses the design and process blueprint for the establishment of AI pipelines that comply with the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and different sectoral standards. The aim is to offer a sound methodology to incorporate compliance checks at every stage of the AI lifecycle, from data collection to deployment. Our method focuses on incorporating privacy-preserving methods, secure data engineering principles, and auditability. Through a comparative analysis of AI development processes and regulatory requirements, we identify friction points and suggest technical as well as organizational solutions. The paper also analyzes case studies to test the proposed framework and addresses its implication for AI governance and ethical AI deployment. The research highlights the need for cross-disciplinary cooperation between legal professionals, data scientists, and organizational stakeholders to provide end-to-end compliance. We propose certain tools and technologies, including federated learning and secure multiparty computation, that enable the enforcement of regulatory requirements without undermining model effectiveness. This paper makes a contribution to current discussion by offering a guidebook to action for businesses to enact ethical AI while preserving competitive edge in a highly regulated digital environment. Keywords- AI pipeline, GDPR, HIPAA, data privacy, compliance, ethical AI, data governance, security standards, machine learning, privacy-preserving computation

The graph neural network (GNN) has recently become an emerging research topic for processing non-euclidean data structures since the data used in various popular application domains are usually modeled as a graph, such as social networks, recommendation systems, and computer vision. Previous GNN accelerators commonly utilize the hybrid architecture to resolve the issue of “hybrid computing pattern” in GNN training. Nevertheless, the hybrid architecture suffers from poor utilization of hardware resources mainly due to the dynamic workloads between different phases in GNN. To address these issues, existing GNN accelerators adopt a unified structure with numerous processing elements and high bandwidth memory. However, the large amount of data movement between the processor and memory could heavily downgrade the performance of such accelerators in real-world graphs. As a result, the processing-in-memory architecture, such as the ReRAM-based crossbar, becomes a promising solution to reduce the memory overhead of GNN training. In this work, we present the TCAM-GNN, a novel TCAM-based data processing strategy, to enable high-throughput and energy-efficient GNN training over ReRAM-based crossbar architecture. Several hardware co-designed data structures and placement methods are proposed to fully exploit the parallelism in GNN during training. In addition, we propose a dynamic fixed-point formatting approach to resolve the precision issue. An adaptive data reusing policy is also proposed to enhance the data locality of graph features by the bootstrapping batch sampling approach. Overall, TCAM-GNN could enhance computing performance by 4.25× and energy efficiency by 9.11× on average compared to the neural network accelerators.

The GDPR (General Data Protection Regulation) is a regulation for data protection and privacy for citizens of the EU. It also addresses the export of personal data outside the EU, thus creating a regulation the affects most, as all, of the commercial companies, government institutions, and other sectors that maintain personal information of their customers or audiences. Social Networks are, of course, major interested parties both for the GDPR since their core definitions involve both private user’s information, and data ownership issues. Thus, there is an urgent need for a sustainable and reliable privacy model for these networks, that does not currently exist. In our previous research we have devised a comprehensive Trust-based model for security in Social Networks, that uses Trust, Access Control and Flow Control. In this paper we use this model, and add an element of context to it, for creating an implementation in Social Networks, that will better enforce the GDPR and rights management regulations.KeywordsGDPRSocial networks securityFlow controlAccess controlTrust

A survey of graph neural network based recommendation in social networks

Semi-supervised node classification on graph-structured data has many applications such as fraud detection, fake account and review detection, user’s private attribute inference in social networks, and community detection. Various methods such as pairwise Markov Random Fields (pMRF) and graph neural networks were developed for semi-supervised node classification. pMRF is more efficient than graph neural networks. However, existing pMRF-based methods are less accurate than graph neural networks, due to a key limitation that they assume a heuristics-based constant edge potential for all edges. In this work, we aim to address the key limitation of existing pMRF-based methods. In particular, we propose to learn edge potentials for pMRF. Our evaluation results on various types of graph datasets show that our optimized pMRF-based method consistently outperforms existing graph neural networks in terms of both accuracy and efficiency. Our results highlight that previous work may have underestimated the power of pMRF for semi-supervised node classification.

Purpose This article aims to examine the tension between freedom of expression and personal data protection, focusing on criminal conviction and offence data under the General Data Protection Regulation (GDPR). It analyses how legal frameworks, particularly Article 85 of the GDPR, attempt to reconcile public access to information with individual data privacy rights harmoniously. Design/methodology/approach Using a legal doctrinal approach primarily, this study examines GDPR provisions, especially Article 85, alongside relevant case law. The principle of proportionality serves as a key analytical tool to assess the necessity and justification of legal restrictions on data processing. Findings The research underscores the delicate balance between freedom of expression and data protection concerning criminal records. Article 85 plays a crucial role in establishing journalistic exemptions while ensuring data privacy. The principle of proportionality is vital in preventing disproportionate restrictions, requiring case-by-case evaluations. The study highlights the evolving nature of privacy-publicity conflicts, with the right to be forgotten serving as a safeguard against undue harm from outdated or minor convictions. Research limitations/implications This study has limitations, including its reliance on case-specific analyses, which overlook the broader impacts of the evolving digital media landscape, particularly social media and user-generated content. The focus on European legal frameworks (e.g. GDPR) restricts generalisability to non-EU jurisdictions with differing standards. Additionally, the analysis emphasises journalistic exemptions, neglecting other forms of expression – such as academic, artistic and literary – that also require balancing against personal data protection rights. Practical implications The research provides practical guidance for balancing data protection and freedom of expression, particularly under GDPR Article 85. It underscores the need for case-by-case assessments, ensuring proportionality and necessity when handling criminal conviction data. Policymakers and legal practitioners can use these insights to refine journalistic exemptions and prevent data misuse, especially in digital media contexts. Organisations, including media platforms, are encouraged to adopt responsible data-handling practices to safeguard privacy while enabling public interest reporting. Finally, the findings stress the importance of dynamic frameworks that adapt to evolving societal and technological contexts, supporting fair outcomes for both data protection and expression rights. Social implications This research highlights the delicate balance between individual data protection rights and freedom of expression, particularly regarding criminal conviction data. Its implications extend to societal concerns over data privacy, the potential misuse of personal information and the long-term impact on individuals, especially those with minor or outdated offences. As digital media evolves, these issues become more pressing, with the rise of social media and user-generated content complicating the legal landscape. Ensuring that privacy is upheld without stifling public access to essential information is crucial for maintaining both rights and societal transparency in an increasingly interconnected world. Originality/value This study enriches the debate on data protection and freedom of expression in crime-related data processing. By addressing journalistic exemptions and the evolving media landscape, it provides a nuanced perspective on safeguarding privacy while maintaining transparency in an era of digital accessibility.

The Interplay Between the NIS Directive and the GDPR in a Cybersecurity Threat Landscape

In recent years, along with the blooming of Machine Learning (ML)-based applications and services, ensuring data privacy and security have become a critical obligation. ML-based service providers not only confront with difficulties in collecting and managing data across heterogeneous sources but also challenges of complying with rigorous data protection regulations such as EU/UK General Data Protection Regulation (GDPR). Furthermore, conventional centralised ML approaches have always come with long-standing privacy risks to personal data leakage, misuse, and abuse. Federated learning (FL) has emerged as a prospective solution that facilitates distributed collaborative learning without disclosing original training data. Unfortunately, retaining data and computation on-device as in FL are not sufficient for privacy-guarantee because model parameters exchanged among participants conceal sensitive information that can be exploited in privacy attacks. Consequently, FL-based systems are not naturally compliant with the GDPR. This article is dedicated to surveying of state-of-the-art privacy-preservation techniques in FL in relations with GDPR requirements. Furthermore, insights into the existing challenges are examined along with the prospective approaches following the GDPR regulatory guidelines that FL-based systems shall implement to fully comply with the GDPR.

Recent studies have shown that the problems of cold processing and data sparsity in recommender systems can be well alleviated with the help of knowledge graph information. Meanwhile, since the information in recommender systems can be represented by graph data structure, graph neural network has great advantages in recommendatory system. Therefore, graph neural network can better mine the deep relationship between objects in the recommender systems which combines with information from knowledge graph. This paper reviews the application of graph neural network in knowledge graph aided recommendation systems. Specifically, this paper firstly sorts out the related knowledge of knowledge graph, recommendation system and graph neural network, including the cold processing and data sparsity, the structure of knowledge graph, and the basic modules of graph neural network. This paper also summarizes the methods such as KGAT and CKAN used in knowledge graph aided recommendation systems in recent years, and gives some discussion on the development of this field.

After four (4) years of preparation and debate the General Data Protection Regulation (GDPR) was approved by the EU Parliament on 14 April 2016. Enforcement date is 25 May 2018. The EU General Data Protection Regulation replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, but also to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. This Regulation is a legal act which is mandatory and fully valid for all EU Member States. Thereby, Member States may additionally regulate certain areas of personal data protection. Apart from being more appropriate for today's era of fast speed Internet and Internet of things (IOT), the new Regulation is essentially more extensive, more accurate, and involves the questions of personal data risk. Considering the fact that personal data is being processed in the E-business and E-government, and in addition to introduction of some smart-city functions, it's possible to indirectly collect personal data. The GDPR is extremely important and it's one of the key legal documents for the further development of the digital economy and administration. As this year's MIPRO almost coincides with the date of full implementation of the Regulation, it was an additional incentive to decide on a subject of invited lecture on GDPR.

Privacy preservation and the protection of speech data is in high demand, not least as a result of recent regulation, e.g. the General Data Protection Regulation (GDPR) in the EU. While there has been a period with which to prepare for its implementation, its implications for speech data is poorly understood. This assertion applies to both the legal and technology communities, and is hardly surprising since there is no universal definition of 'privacy', let alone a clear understanding of when or how the GDPR applies to the capture, storage and processing of speech data. In aiming to initiate the discussion that is needed to establish a level of harmonisation that is thus far lacking, this contribution presents some reflections of both legal and technology communities on the implications of the GDPR as regards speech data. The article outlines the need for taxonomies at the intersection of speech technology and data privacy - a discussion that is still very much in its infancy - and describes the ways to safeguards and priorities for future research. In being agnostic to any specific application, the treatment should be of interest to the speech communication community at large.

Graph neural networks (GNNs) have made rapid developments in the recent years. Due to their great ability in modeling graph-structured data, GNNs are vastly used in various applications, including high-stakes scenarios such as financial analysis, traffic predictions, and drug discovery. Despite their great potential in benefiting humans in the real world, recent study shows that GNNs can leak private information, are vulnerable to adversarial attacks, can inherit and magnify societal bias from training data and lack interpretability, which have risk of causing unintentional harm to the users and society. For example, existing works demonstrate that attackers can fool the GNNs to give the outcome they desire with unnoticeable perturbation on training graph. GNNs trained on social networks may embed the discrimination in their decision process, strengthening the undesirable societal bias. Consequently, trust-worthy GNNs in various aspects are emerging to prevent the harm from GNN models and increase the users’ trust in GNNs. In this paper, we give a comprehensive survey of GNNs in the computational aspects of privacy, robustness, fairness, and explainability. For each aspect, we give the taxonomy of the related methods and formulate the general frameworks for the multiple categories of trustworthy GNNs. We also discuss the future research directions of each aspect and connections between these aspects to help achieve trustworthiness.

Data breaches inevitably happen. Information gets lost, stolen or otherwise released into the hands of people who were never intended to see it - and those people often have malicious intent. The GDPR (General Data Protection Regulation) is legislation for data protection and privacy of the residents of the European Union (EU) that replaced the previously existing Data Protection Directive 95/46/EC in spring 2018 as the primary law regulating on how companies protect EU citizens’ personal data. Under the terms of GDPR, not only do organisations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it are obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners - or face penalties for not doing so. The GDPR's goal is to impose a uniform data security regulation on all EU members, removing the need for each member state to design their own data protection rules and ensuring that laws are consistent across the EU. The present paper discusses in brief the overview of GDPR, its provisions, penalties for non-compliance and many such queries which we generally have regarding this data protection regulation.

The General Data Protection Regulation (GDPR), enacted in the European Union in 2018, has significantly transformed the landscape of personal data management and protection. This article provides an overview of GDPR's impact, focusing on its applicability, fundamental principles and influence on data management practices, particularly within the European Society of Thoracic Surgeons (ESTS) database. GDPR's reach extends to all entities collecting and processing personal data of European Union residents, regardless of their location. It encompasses various data types, emphasizing meticulous handling and protection of identifiable information. Special categories of data, such as health and sensitive attributes, require even more stringent protection. The regulation sets legal, fair and transparent data processing principles, emphasizing accuracy, purpose limitation and data minimization. It also stresses accountability, leading to the appointment of Data Protection Officers and significant penalties for non-compliance. The ESTS database, designed to enhance thoracic surgical research and care, collects data on European procedures. It follows GDPR principles by pseudonymizing data, ensuring secure data transmission and providing clear instructions for data submission. The database contributes to research, policymaking and practice improvement in thoracic surgery by offering a comprehensive dataset for analysis. Here, we aim to shed light on the complexities of GDPR implementation and emphasize the need for comprehensive data management strategies to ensure compliance and enhance privacy protection with the contribution to the ESTS database. GDPR compliance comes with challenges, including potential human dignity and privacy rights violations. Data breaches can result in unauthorized disclosures, and non-compliance can lead to substantial fines and reputational damage. The implementation of GDPR encourages organizations to prioritize ethical data practices, security measures and transparent data handling. In conclusion, GDPR has revolutionized personal data protection by emphasizing accountability, transparency and individual rights. It has impacted organizations globally, promoting responsible data management practices. Adhering to GDPR ensures privacy protection, trust-building and overall enhancement of data management in today's data-driven environment.