A Policy Framework for Subject-Driven Data Sharing

Abstract

Organizations (e.g., hospitals, university etc.) are custodians of data on their clients and use this information to improve their service. Personal data of an individual therefore ends up hosted under the administration of different data custodians. Individuals (data subjects) may want to share their data with others for various reasons. However, existing data sharing mechanisms provided by the data custodians do not provide individuals enough flexibility to share their data, especially in a cross-domain (data custodian) environment. In this paper, we propose a data sharing policy language and related framework for a data subject to capture their fine-grained data sharing requirements. This proposed language allows the data subject to define data sharing policies that consider context conditions, privacy obligations and re-sharing restrictions. Furthermore, we have implemented a prototype to demonstrate how data subjects can define their data sharing policies and how the policies can be used and enforced at runtime.

How to Control User Private Data Access in Mixed Reality Platforms using Blockchain?

“…We can also see this in the many application areas that address data sharing in more detail. From large and general areas of application such as research (Coelho et al, 2021;Köster et al, 2020;Pujol Priego & Wareham, 2020), education (Chowdhury et al, 2018), health (Kalkman et al, 2019;Vesselkov et al, 2019;Zhong et al, 2011), supply chain (Knol et al, 2014), or the public domain (Vesselkov et al, 2019), but also for specific areas of application data sharing is becoming increasingly important. More specific application areas include future transport (Becker et al, 2021), biotechnology (Fisher & Fortmann, 2010), food traceability (Gasco et al, 2018), and additive manufacturing (Morar & Kemper, 2016).…”

“…In addition, the various customer groups that cooperate in data sharing are relevant to different actors. The literature specifically identifies the data producer (Fisher & Fortmann, 2010), data buyers/user (Agahari et al, 2021;Fisher & Fortmann, 2010), data owner (Bastiaansen et al, 2020;Brathwaite, 1983;Samanthula et al, 2015), data provider (Agahari et al, 2021;Bastiaansen et al, 2019;Gelhaar et al, 2021;Vesselkov et al, 2019), data consumer (Chowdhury et al, 2018;Samanthula et al, 2015;Vesselkov et al, 2019) and data prosumer (Vesselkov et al, 2019). The role of the data prosumer is assumed by actors who act both as data consumers and data providers (Vesselkov et al, 2019).…”

“…The role of the data prosumer is assumed by actors who act both as data consumers and data providers (Vesselkov et al, 2019). Some publications also refer to an external trust organization, also called a data custodian, which is responsible for the implementation of data sharing but is not itself involved in the data sharing process (Bastiaansen et al, 2019;Chowdhury et al, 2018).…”

“…"… we define data sharing as an exchange of data between different stakeholders, and when happening on a platform, as lateral data exchange in a network. "Several definitions(Chowdhury et al, 2018;Vesselkov et al, 2019) explain the aspect of permitted "access" to datasets as a part of the definitions. Some authors also address the different roles involved in data sharing.…”

“…Some authors also address the different roles involved in data sharing. Examples are data owners(Brathwaite, 1983) or the data custodian(Chowdhury et al, 2018). In addition, individual definitions also deal with the…”