The post Different Steps Of GPS Trajectories Watermarking appeared first on Smash Hit.

We have successfully held our final smashHit event on the 21-23th of November at the EBDVF2022 – European Big Data Value Forum 2022 in Prague! We had the possibility to present smashHit to a wide interested audience at our booth, where we shared our dissemination material and the event participants could interact and discuss in-person with the members of the smashHit consortium. Apart from our presence at the booth during the 3 event days, we had a session, titled “An Innovative Approach to Compliant Consent”, which consisted of a general smashHit presentation and an interesting subsequent panel discussion, involving Business Case and development members from the consortium, as well as Kimmo Rossi from the European Commission.

In the first part of the session, a presentation of the overall smashHit journey was given by consortium members Nick Walker (LN), Pekka Koponen (FVH), Mohammad Al-Rifai (VW) and Ana Correia (ATB), addressing the following key aspects:

• The Market Challenge – what are we trying to solve?
• The Impact of Solving the Challenges – what does solving the challenge mean?
• The building blocks of the solution – how have we solved the challenge?
• The future plan – what do we plan next?

After the presentation, we had an intensive panel discussion, moderated by Christian Wolff (ATB), involving consortium members Nick Walker (LN), Pekka Koponen (FVH), Mohammad Al-Rifai (VW), Iván Carillo (ATOS), as well as Kimmo Rossi from the European Commission. During the discussion we had the possibility to dive deeper into the topics raised in the presentation and by the audience, such as current consent barriers for data sharing, and ongoing and potential standardisation activities for smashHit components. Kimmo Rossi also gave interesting insights on ongoing activities in the consent and data spaces field from the European Commission’s point of view.

More information can be found on the official programme page, including the presentations at: https://european-big-data-value-forum.eu/2022-edition/programme/. Additionally, we have streamed the full session live on our smashHit’s Youtube channel, and the video can now be found on demand at the following link: https://youtu.be/2Jn5nHfbQ3I

The post The smashHit session at the EBDVF2022 was a success! appeared first on Smash Hit.

In our presentation we will be discussing the smashHit platform, presented by Ana Teresa Correia (ATB), Nick Walker (LN), Pekka Koponen (FVH) and Dr. Mohammed Al-Rifai (VW), addressing the important questions such as:

• The Market Challenge – what are we trying to solve?
• The Impact of Solving the Challenges – what does solving the challenge mean?
• The building blocks of the solution – how have we solved the challenge?
• The future plan – what do we plan next?

After the presentation, we will have the panel session in a larger round of people, comprised of Nick Walker (LN), Pekka Koponen (FVH), Dr. Mohammed Al-Rifai (VW), Kimmo Rossi (European Commission), Carmen (ATOS), Friederike (LUH), and it will be moderated by Christian Wolff (ATB). In this session panelists will discuss and address the questions and points raised by the EBDVF attendees.

You can find more information on the official programme page https://european-big-data-value-forum.eu/2022-edition/programme/ under the track name Data Spaces and the name of the session An Innovative Approach to Compliant Consent. We are scheduled for Tuesday, 22.11. 17:00-18:00, which we will be streaming live in our smashHit’s Youtube channel https://www.youtube.com/channel/UCnKnDSPB6fmn6kzKo716baA/featured.

On a last note, in case you haven’t checked it out yet, you can also have a look at recently published white papers on our smashHit website https://smashhit.eu/whitepapers/ .

The post smashHit’s Closing Event At EBDVF appeared first on Smash Hit.

Approaches to requirements identification and specification

Privacy and data protection requirements emanate from several sources. These include regulatory, industrial and user/stakeholders’ needs. Apart from the GDPR, several other instruments of specific application impose privacy and data protection-related requirements. In addition, industrial standards are relevant for extracting requirements relating to privacy and data protection. System developers are thus expected to analyse the specific environment that their system will operate and identify specific regulations that apply to such environment to extract these requirements. In the smashHit project, for example, part of the tools developed in the project aims to address data subjects’ consent management within the automobile ecosystem, involving stakeholders such as data subjects, auto manufacturers, insurance, and others. Given the involvement of personal data, the project’s legal requirements stem from the GDPR and other relevant sources within this ecosystem.

Identifying privacy and data protection requirements require a systematic and multi-disciplinary approach. Generally, this involves several consultations with the relevant stakeholders to extract the needs of each stakeholder. In cases where there are defined project proposals, such documents provide valuable information and should be consulted during the requirements identification. For example, EU projects Grant Agreements contain various requirements, including privacy and data protection requirements. When the initial requirements are collected, there is also a need to analyse them thoroughly and collaboratively. Depending on the outcome, further consultations could be organised to agree on differences and obtain relevant feedback.

Translating data protection requirements into executable actions: the value of TOMs

Having defined the privacy and data protection requirements from multiple sources, the next step is to ensure that these requirements are executed in the system’s architectural design. Adopting a P/DPbD strategy is vital at this stage of the process. A key instrument in system development according to the principles of P/DPbD is the implementation of “appropriate technical and organisational measures which are designed to implement data-protection principles […] in an effective manner and to integrate the necessary safeguards into the processing in order to […] protect the rights of data subjects” (Art. 25 (1) GDPR).

To translate these privacy and data protection requirements into executable actions, smashHit utilised the Data Protection Management Process according to the Standard Data Protection Model (SDM)[2]. The SDM is a systematic approach to implement GDPR requirements in practice and has been acknowledged by the supervisory authorities. It uses “protection goals” to systematise the data protection requirements. This approach allows the project to identify specific technical and organisational measures (TOMs) or privacy-enhancing technologies (PET) to be implemented to mitigate the identified risks associated with the proposed data processing, or to keep the risks on an acceptable level. Concretely, the SDM first records the legal requirements of the GDPR and then assigns them to the following protection goals:

• Data Minimisation (Art. 5 para. 1 lit. c GDPR);
• Availability;
• Integrity (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Confidentiality (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Transparency (Art. 5 para. 1 lit. a GDPR);
• Unlinkability (Art. 5 para. 1 lit. b GDPR) and
• Intervenability [3].

Each protection goal has its scope and purpose. In addition, there is the protection goal of “Resilience” which aims at sufficient preparation of systems and processes for events that cause disruptions to regular processes. In addition, it is essential to note the impact of the system’s interaction with other external systems and point out the privacy implications and requirements for the external system. This is necessary for maintaining end-to-end protection. Furthermore, the technical and organisational measures to ensure data security must be well planned considering the system’s operational environment.

Finally, it is necessary to trace privacy and data protection requirements during the testing and implementation of the system. Establishing a feedback framework will assist in tracking how these requirements are executed. When the system is finally developed and running, a privacy or data protection audit becomes necessary to check the scope of implementation in operation. In the smashHit project, this is addressed by utilizing the Data Protection Management Cycle (DPM cycle) [4] which covers the whole process of data protection management including the evaluation of measures taken and the implementation of necessary improvements.

Conclusion

Projects like smashHit that involve the processing of personal data must endeavour to extract privacy and data protection requirements systematically and holistically. Data protection by design is a principle, set out in the GDPR, that promotes privacy and data protection compliance from the start. It is an alternative to bolting privacy considerations on as an after-thought or ignoring them altogether [5]. Adopting a P/DPbD approach like the SDM allows to identify all personal data sets and apply data protection principles through the selection of appropriate TOMs alongside the technical development of the system.

References

[1]  A. Cavoukian, “Operationalizing Privacy by Design: A Guide to Implementing Strong Privacy Practices”, Information and Privacy Commissioner, Ontario, 2012. See also, Art. 25 of the GDPR.

[2] The Standard Data Protection Model, “A method for data protection advising and controlling on the basis of uniform protection goals”, Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Länder, April 2020, Available at https://www.datenschutzzentrum.de/uploads/sdm/SDM-Methodology_V2.0b.pdf. 

[3] The Standard Data Protection Model (SDM), p. 25 et seqq. Note: Availability and intervenability are not explicitly named as principles relating to processing of personal data in the GDPR but can be derived from it.

[4] The Standard Data Protection Model (SDM), p. 52 et seq.

[5] ENISA, “Data Protection Engineering”, 2022, Available at https://www.enisa.europa.eu/publications/data-protection-engineering.

The post Transposing Data Protection Requirements into Technical and Organisational Measures: The smashHit Approach appeared first on Smash Hit.

How does smashHit support traceability?

We have developed a traceability component (Figure 1), which provides an end-to-end data use traceability infrastructure. The component allows data owners and providers to trace their data and to retrieve data logs of the processing pipeline of specific datasets. To support this, we use metadata to indicate a data transfer and to log each data transaction. In addition, with the help of digital signatures for authentication purposes, the traceability component ensures the integrity of both data and the processing related to it.  Our traceability component consists of a traceability manager and a traceability module. The traceability manager gathers the logs of all individual companies and offers a single-entry point. The traceability module, which needs to be deployed to every data provider/processor, supplies an interface for logging data transfers and verifications. smashHit’s data use traceability infrastructure tackles various privacy concerns of data owners and supports GDPR compliance.

You can find more about smashHit’s work on consent, data use traceability and on raising consent awareness on our scientific publications page.

Wondering how smashHit handles different contexts for data sharing? Have a look at our latest LinkedIn post!

—

References:

[1] https://www.conference-board.org/publications/consumers-attitudes-about-data-practices-ES

The post Enabling Data Use Traceability with smashHit appeared first on Smash Hit.

Forum Virium Helsinki is one of the founding members of MyData Global and has a long history of promoting the use of open data. In their work, they help the city of Helsinki to produce, utilise and share the best open data in the world and develop the most innovative digital services by following the MyData principles

Forum Virium Helsinki (FVH) is a non-profit enterprise owned by the City of Helsinki and founded in 2006. As part of the City of Helsinki Group, FVH is an innovation unit playing a key role in developing and implementing the Smart City and Open City strategies of the City of Helsinki. Helsinki has been recognised as one of the top six smart cities in Europe in the 2014 European Parliament study “Mapping the European Smart Cities”. Helsinki is among the ten fastest-growing metropolitan areas in Europe. FVH implements the Helsinki smart city strategy in the new urban development projects, coordinating the development of the Kalasatama Smart City District and other initiatives.

Check out the podcast here:

Spotify

The post Podcast 4: Forum Virium & Smart Cities Use Case appeared first on Smash Hit.

The post Podcast 3: Connected Car Data With Nick Walker Of LexisNexis Risk Solutions appeared first on Smash Hit.

SmashHit is an EU funded project set up to devise ways to increase the confidence of consumers (Data Owners) to allow (through consent) companies to use their personal data for the provision of personalized services.

We recognize that consumers are often unwilling to provide consent for the use of their personal data. Our task is to build an infrastructure that will better manage who has access to whose data, and to ensure that personal data is only being used for the express purpose that consent was given. Furthermore, we intend to provide a single source of record for the consent you as a consumer has given, to whom, for what purpose, and for how long.

As a definition; Personal data is any information that relates to an identified or identifiable living individual. Pieces of information, which collected together can lead to the identification of a particular person, are also considered to be personal data.

We would greatly appreciate your feedback to the following survey questions to help us to better understand the consumer attitudes towards sharing personal data with companies. Thank you for taking the time to give us your valuable inputs!

Disclaimer: This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 871477

Please go to our survey here

The post Survey for Data Consumers appeared first on Smash Hit.

Personal data is any information that relates to an identified or identifiable living individual. Pieces of information, which collected together can lead to the identification of a particular person, are also considered to be personal data.

We would greatly appreciate your feedback to the following survey questions to help us to better understand the market. Thank you for taking the time to give us your valuable inputs!

Disclaimer: This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 871477

Please go to the survey here

The post Survey for Data Providers appeared first on Smash Hit.