Requirements for private communications over public spheres

Abstract

Purpose In the Web 2.0 era, users massively communicate through social networking services (SNS), often under false expectations that their communications and personal data are private. This paper aims to analyze privacy requirements of personal communications over a public medium. Design/methodology/approach This paper systematically analyzes SNS services as communication models and considers privacy as an attribute of users’ communication. A privacy threat analysis for each communication model is performed, based on misuse scenarios, to elicit privacy requirements per communication type. Findings This paper identifies all communication attributes and privacy threats and provides a comprehensive list of privacy requirements concerning all stakeholders: platform providers, users and third parties. Originality/value Elicitation of privacy requirements focuses on the protection of both the communication’s message and metadata and takes into account the public–private character of the medium (SNS platform). The paper proposes a model of SNS functionality as communication patterns, along with a method to analyze privacy threats. Moreover, a comprehensive set of privacy requirements for SNS designers, third parties and users involved in SNS is identified, including voluntary sharing of personal data, the role of the SNS platforms and the various types of communications instantiating in SNS.

Patient personal data protection: comparing the health-care regulations in Indonesia, Singapore and the European Union

“…Personal data can be identified through a citizen card such as name, residence number, address, date of birth and surname. Telephone numbers, social security numbers and vehicle registration numbers are also information that can make a person identifiable (Addae et al , 2017; Vemou and Karyda, 2019). Even computerized files, cookies and Web traffic surveillance tools can be used as data to identify a person (Giakoumopoulos et al , 2018).…”

Comparative study of personal data protection regulations in Indonesia, Hong Kong and Malaysia

“…Some other examples of an identifier that can be used to identify a person are phone number, social security number and vehicle registration number (Addae et al , 2017; Vemou and Karyda, 2019). The digital era has made identification possible with the information contained in computerized files, cookies and web traffic surveillance tools (Giakoumopoulos et al , 2018).…”

“…Article 4.1 of GDPR further defines that an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social identity of that natural person. Some other examples of an identifier that can be used to identify a person are phone number, social security number and vehicle registration number (Addae et al, 2017;Vemou and Karyda, 2019). The digital era has made identification possible with the information contained in computerized files, cookies and web traffic surveillance tools (Giakoumopoulos et al, 2018).…”

“…Personal data transfer The PDP Act should cover the matter of data transfer within and outside the country, which includes: a) The types of personal data that can be transferred b) The prohibition of transfer and exceptions c) The matter of consent from the personal data owner (Aaronson, 2019;Vemou and Karyda, 2019;Younies and Al-Tawil, 2020) 7.…”