Protecting Privacy with a Declarative Policy Framework

The rapid growth of the Internet has been accompanied by a proliferation of e-services targeting consumers. E-services are available for banking, shopping, learning, government online, and healthcare. However, each of these services requires a consumer’s personally identifiable information (PII) in one form or another. This leads to concerns over privacy. In order for e-services to be successful, privacy must be protected (Ackerman, Cranor, & Reagle, 1999). An effective and flexible way of handling privacy is management via privacy policies. In this approach, a consumer of an e-service has a personal privacy policy that describes what private information the consumer is willing to give up to the e-service, with which parties the provider of the e-service may share the private information, and how long the private information may be kept by the provider. The provider likewise has a provider privacy policy describing similar privacy constraints as in the consumer’s policy, but from the viewpoint of the provider, (i.e., the nature of the private information and the disclosure/retention requirements that are needed by the e-service). Before the consumer engages the e-service, the provider’s privacy policy must match with the consumer’s privacy policy. In this way, the consumer’s privacy is protected, assuming that the provider complies with the consumer’s privacy policy. Note that policy compliance is outside the scope of this work but see Yee and Korba (July, 2004). Initial attempts at conserving consumer privacy for e-services over the last few years have focused on the use of Web site privacy policies that state the privacy rules or preferences of the Web site or service provider. Some of these policies are merely statements in plain English and it is up to the consumer to read it. This has the drawback that very few consumers take the trouble to read it. Even when they do take the time to look at it, online privacy policies have been far too complicated for consumers to understand and suffer from other deficiencies (Lichtenstein, Swatman, & Babu, 2003; Jensen & Potts, 2004). Still other privacy policies are specified using P3P (W3C) that allows a consumer’s browser to automatically check the privacy policy via a browser plug-in. This, of course, is better than plain English policies but a major drawback is that it is a “take-it-or-leave-it” approach. There is no recourse for the consumer who has a conflict with the Web site’s P3P policy, except to try another Web site. In this case, we have advocated a negotiations approach to resolve the conflict (Yee & Korba, Jan., May, 2003). However, this requires a machine-processable personal privacy policy for the consumer. We assume that providers in general have sufficient resources to generate their privacy policies. Certainly, the literature is full of works relating to enterprise privacy policies and models (e.g., Barth & Mitchell, 2005; Karjoth & Schunter 2002). Consumers, on the other hand, need help in formulating machine-processable privacy policies. In addition, the creation of such policies needs to be as easy as possible or consumers would simply avoid using them. Existing privacy specification languages such as P3P, APPEL (W3C; W3C, 2002), and EPAL (IBM) are far too complicated for the average internet user to understand. Understanding or changing a privacy policy expressed in these languages effectively requires knowing how to program. Moreover, most of these languages suffer from inadequate expressiveness (Stufflebeam, Anton, He, & Jain, 2004). What is needed is an easy, semi-automated way of seeding a personal privacy policy with a consumer’s privacy preferences. In this work, we present two semi-automated approaches for obtaining consumer personal privacy policies for e-services through seeding. This article is based on our work in Yee and Korba (2004). The section “Background” examines related work and the content of personal privacy policies. The section “Semi-Automated Seeding of Personal Privacy Policies” shows how personal privacy policies can be semi-automatically seeded or generated. The section “Future Trends” identifies some of the developments we see in this area over the next few years. We end with ”Conclusion”.

In conventional centralized authorization models, the evaluation performance of policy decision point (PDP) decreases obviously with the growing numbers of rules embodied in a policy. Aiming to improve the evaluation performance of PDP, a distributed policy evaluation engine called XDPEE is presented. In this engine, the unicity of PDP in the centralized authorization model is changed by increasing the number of PDPs. A policy should be decomposed into multiple subpolicies each with fewer rules by using a decomposition method, which can have the advantage of balancing the cost of subpolicies deployed to each PDP. Policy decomposition is the key problem of the evaluation performance improvement of PDPs. A greedy algorithm with O(nlgn) time complexity for policy decomposition is constructed. In experiments, the policy of the LMS, VMS, and ASMS in real applications is decomposed separately into multiple subpolicies based on the greedy algorithm. Policy decomposition guarantees that the cost of subpolicies deployed to each PDP is equal or approximately equal. Experimental results show that (1) the method of policy decomposition improves the evaluation performance of PDPs effectively and that (2) the evaluation time of PDPs reduces with the growing numbers of PDPs.

An often key component to coordinating surveillance activities across distributed networks is the design and implementation of a common data model (CDM). The purpose of this study was to evaluate two drug safety surveillance CDMs from an ecosystem perspective to better understand how differences in CDMs and analytic tools affect usability and interpretation of results. Humana claims data from 2007 to 2012 were mapped to Observational Medical Outcomes Partnership (OMOP) and Mini-Sentinel CDMs. Data were described and compared at the patient level by source code and mapped concepts. Study cohort construction and effect estimates were also compared using two different analytical methods--one based on a new user design implementing a high-dimensional propensity score (HDPS) algorithm and the other based on univariate self-controlled case series (SCCS) design--across six established positive drug-outcome pairs to learn how differences in CDMs and analytics influence steps in the database analytic process and results. Claims data for approximately 7.7 million Humana health plan members were transformed into the two CDMs. Three health outcome cohorts and two drug cohorts showed differences in cohort size and constituency between Mini-Sentinel and OMOP CDMs, which was a result of multiple factors. Overall, the implementation of the HDPS procedure on Mini-Sentinel CDM detected more known positive associations than that on OMOP CDM. The SCCS method results were comparable on both CDMs. Differences in the implementation of the HDPS procedure between the two CDMs were identified; analytic model and risk period specification had a significant impact on the performance of the HDPS procedure on OMOP CDM. Differences were observed between OMOP and Mini-Sentinel CDMs. The analysis of both CDMs at the data model level indicated that such conceptual differences had only a slight but not significant impact on identifying known safety associations. Our results show that differences at the ecosystem level of analyses across the CDMs can lead to strikingly different risk estimations, but this can be primarily attributed to the choices of analytic approach and their implementation in the community-developed analytic tools. The opportunities of using CDMs are clear, but our study shows the need for judicious comparison of analyses across the CDMs. Our work emphasizes the need for ongoing efforts to ensure sustainable transparent platforms to maintain and develop CDMs and associated tools for effective safety surveillance.

BackgroundIn 2017, the Supreme Court of India ruled that privacy is a fundamental right of every citizen. Although mobile phone apps have the potential to help people with noncommunicable diseases, such as diabetes and mental illness, they often contain complex privacy policies, which consumers may not understand. This complexity may impede the ability of consumers to make decisions regarding privacy, a critical issue due to the stigma of mental illness.ObjectiveOur objective is to determine whether mental health apps have more complex privacy policies than diabetes apps.MethodsThe study used privacy policies extracted from apps. The apps pertained to diabetes or mental health, and were all of Indian origin. Privacy policy reading complexity was compared between the two types of apps using a series of 15 readability measures. The universe of applicable apps on the Google Play store, as viewed between May and June 2017, was considered. The measures of readability were compared using chi-square tests.ResultsNo significant difference was found between the privacy policy readability of the diabetes apps versus the mental health apps for each of the measures considered. The mean Flesch-Kincaid Grade Level was 13.9 for diabetes apps and 13.6 for mental health apps; therefore, the mean policy grade level for both types of apps was written at a college level. Privacy policies in the 25th percentile of complexity were also written at a college level for both types of apps.ConclusionsPrivacy policy complexity may be a barrier for informed decision making.

BackgroundCOVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users’ permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users’ privacy.ObjectiveThis study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies’ readability, and the information included in them.MethodsWe used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user’s privacy. We assessed the privacy policies’ readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.ResultsWe identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=−0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=−0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one’s data, the lower the apps’ ratings and transparency index.ConclusionsMany contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

As the amount of data being collected by service providers increases, privacy concerns increase for the data owners that must provide private data to get services. Legislative acts require enterprises protect the privacy of their customers and privacy policy frameworks such as P3P assist enterprises in demonstrating their privacy policies to customers (i.e. publishing privacy policy on websites). Unfortunately, defining these standards does not guarantee that the privacy policies are actually enforced since privacy is not central to conventional access control models. Furthermore, a privacy-preserving model should consider the privacy preferences of both data provider and data collector. This paper presents a Lattice-based Privacy Aware Access Control (LPAAC) Model. The key contribution is providing a privacy preserving model that enforces privacy policies and facilitates customization of privacy agreements and preferences of both data providers and organizations that collect data.

Modeling Privacy Aware Health Information Exchange Systems

Online platforms process personal data through privacy policies while pledging to protect users' personal information. Although derived from traditional privacy concepts, privacy policies differ significantly in nature-personal information protection carries stronger public law attributes, rendering privacy policies primarily compliance instruments that should integrate both self-regulation and government regulation approaches. With the rapid expansion of platforms' private power, privacy policies, despite their enhanced role, have exhibited alienating effects: failures in self-regulation, erosion of user rights, and circumvention of governmental oversight. To address these issues, a meta-regulatory approach is imperative, requiring tripartite collaboration among platforms, users, and regulatory authorities to refine privacy policy frameworks.

As the need for more pervasive and more complex access controls grows, the challenge of ensuring the performance of access control systems is becoming apparent. Researchers have proposed several solutions to mitigate performance problems, including: adjusting the policy set; re-engineering the policy decision point (PDP); and decomposing the policies and distributing their evaluation. However, since the benefits and tradeoffs depend heavily upon the actual scenario, security administrators typically do not have objective justification for adopting particular mitigation actions. In response, we present the ATLAS framework, comprising: 1) DomainManager , which facilitates modelling the domain as closely as possible and automatically generates large numbers of representative policies and associated requests; 2) STACS , which enables controlled experiments to be performed using the generated policies/requests, to collect comprehensive measurements of PDP performance; and 3) PARPACS , which aids the understanding and worth of the measurement data and, by using rigorous validation techniques, reduces the risk of spurious insights or incorrect recommendations. We present a discussion of ATLAS as applied to an enterprise communication scenario, where access control is realised via XACML PDPs. Notable insights include that the SunXacml 2.0 PDP performs relatively poorly in terms of policy evaluation performance and that adding additional memory and/or processor cores to a XACML PDP server is not guaranteed to improve performance significantly.

Empowering the access to public procurement opportunities by means of linking controlled vocabularies. A case study of Product Scheme Classifications in the European e-Procurement sector

An efficient policy evaluation engine for XACML policy management

In this paper, we consider a problem of monopolistic information management technologies. Most service providers have an access to any information. Even though the information is really a personal data, service providers can access with it merely with the user's first subscription. A collaborative privacy management system (Co- PMS) is suggested to satisfy the requirement. In this scheme, each user will provide ones own privacy policy by using a policy creation interface. The policy negotiation engine performs collaborative process with the certain service's data disclosure policy. This architecture provides more powerful right to each user to access ones own privacy policy and personal information. It also reinforces the security because of diverse privacy policy. It will develop the privacy policy based on security systems. We also expect the encrypted privacy policy to be used as an authentication certification.

Despite growing enthusiasm surrounding the utility of clinical informatics to improve cancer outcomes, data availability remains a persistent bottleneck to progress. Difficulty combining data with protected health information often limits our ability to aggregate larger more representative datasets for analysis. With the rise of machine learning techniques that require increasing amounts of clinical data, these barriers have magnified. Here, we review recent efforts within clinical informatics to address issues related to safely sharing cancer data. We carried out a narrative review of clinical informatics studies related to sharing protected health data within cancer studies published from 2018-2022, with a focus on domains such as decentralized analytics, homomorphic encryption, and common data models. Clinical informatics studies that investigated cancer data sharing were identified. A particular focus of the search yielded studies on decentralized analytics, homomorphic encryption, and common data models. Decentralized analytics has been prototyped across genomic, imaging, and clinical data with the most advances in diagnostic image analysis. Homomorphic encryption was most often employed on genomic data and less on imaging and clinical data. Common data models primarily involve clinical data from the electronic health record. Although all methods have robust research, there are limited studies showing wide scale implementation. Decentralized analytics, homomorphic encryption, and common data models represent promising solutions to improve cancer data sharing. Promising results thus far have been limited to smaller settings. Future studies should be focused on evaluating the scalability and efficacy of these methods across clinical settings of varying resources and expertise.

Privacy has been acknowledged to be a critical requirement for many business (and non-business) environments. Therefore, the definition of an expressive and easy-to-use privacy related access control model, based on which privacy policies can be specified, is crucial. In this work we introduce a family of models (P-RBAC) that extend the well known RBAC model in order to provide full support for expressing highly complex privacy-related policies, taking into account features like purposes and obligations. We also compare our work with access control and privacy policy frameworks such as P3P, EPAL, and XACML.

The proposed method includes generation of a “common data model” (CDM) containing all the required parametric information for both CAD and CAE analysis. CDM stores and supplies the associative data to both CAD and CAE models and thus maintaining the associative dependencies between them. As the common data model gets modified according to designer's intent, the changes in it are consistently reflected in both CAD and CAE models through regeneration and analysis iteration. The same data model can be used to work with different CAD and CAE packages since it is totally independent from the software tools used. The data model is reusable and the whole process can be automated so that the embedded expertise in the cycles of the adaptive design and manufacturing can be consistently applied iteratively during product development processes.