D8.8 Data Management Plan – Final Version

The Deliverable 8.8, “Data Management Plan” contains information about the data the project has generated, whether and how it will be exploited or made accessible for verification and re-use, and how it will be curated and preserved. The purpose of the Data Management Plan is to provide an analysis of the main elements of the data management policy that will be used by the consortium with regard to all the datasets that are generated by the project. This deliverable also outlines how the research data collected, or generated, will be handled after the smashHit project, describes which methodology for data collection and generation will be followed, and whether and how data will be shared.

The post D8.8 Data Management Plan – Final Version appeared first on Smash Hit.

D8.4 Dissemination and Communication Report (M36)

Deliverable D8.4 provides the dissemination and communication report for the 36 months of the smashHit Horizon 2020 EU project. smashHit recognises that awareness needs to be raised and achieves this by providing meaningful information in informative and engaging ways. Collaboration and communication are vital for achieving a good dissemination outcome. An appropriate dissemination strategy has been presented in detail in D8.1 “Dissemination and Communication Plan” (M3) [1], and this deliverable is basing
on it, and is, de-facto its updated version, and is describing the implementation of this plan up to now.

The post D8.4 Dissemination and Communication Report (M36) appeared first on Smash Hit.

D7.5 Demonstrator of Services Using Integrated Traffic, Smart City and CPP Data

Forum Virium Helsinki has been in charge of the preparation of demonstrators in the Business Case 2 and responsible for the deliverable D7.5. Demonstrator of Services Using Integrated Traffic Smart City and CP data. The work has included intensive cooperation with other main partners of the Business Case 2 Arctic Machine Oy (previously Infotripla) and VW.

The post D7.5 Demonstrator of Services Using Integrated Traffic, Smart City and CPP Data appeared first on Smash Hit.

D5.4 Optimised smashHit Framework

With the growing ability of Consumer Products (CP, such as cars, smart devices, etc.) to generate,gather and share data with third parties among different data-sharing platforms, there will be a general need for flexible and easily manageable procedures to handle data subject’s consent and legal rules, to achieve effective and traceable contracting. The complexities of the General Data Protection Regulation (GDPR), for example, possess some challenges and require complex mechanisms to obtain, record and manage consent. Also, data subjects are afraid about improper use of their data. The combination of understanding and relating to the value proposition, consumer trust, and complex consent processes, results in a low opt-in rate for connected product data exchange (e.g. data from cars) and prevents the creation of innovative services (e.g. connected vehicle insurance programs, or smart city solutions).

The post D5.4 Optimised smashHit Framework appeared first on Smash Hit.

D6.5 Demonstrator of Services Using Integrated CPP and Insurance Data

With the growing ability of Consumer Products (CP, such as cars, smart devices, etc.) to generate,gather and share data with third parties among different data-sharing platforms, there will be a general need for flexible and easily manageable procedures to handle data subject’s consent and legal rules, to achieve effective and traceable contracting. The complexities of the General Data Protection Regulation (GDPR), for example, possess some challenges and require complex mechanisms to obtain, record and manage consent. Also, data subjects are afraid about improper use of their data. The combination of understanding and relating to the value proposition, consumer trust, and complex consent processes, results in a low opt-in rate for connected product data exchange (e.g. data from cars) and prevents the creation of innovative services (e.g. connected vehicle insurance programs, or smart city solutions).

The post D6.5 Demonstrator of Services Using Integrated CPP and Insurance Data appeared first on Smash Hit.

The post Different Steps Of GPS Trajectories Watermarking appeared first on Smash Hit.

We have successfully held our final smashHit event on the 21-23th of November at the EBDVF2022 – European Big Data Value Forum 2022 in Prague! We had the possibility to present smashHit to a wide interested audience at our booth, where we shared our dissemination material and the event participants could interact and discuss in-person with the members of the smashHit consortium. Apart from our presence at the booth during the 3 event days, we had a session, titled “An Innovative Approach to Compliant Consent”, which consisted of a general smashHit presentation and an interesting subsequent panel discussion, involving Business Case and development members from the consortium, as well as Kimmo Rossi from the European Commission.

In the first part of the session, a presentation of the overall smashHit journey was given by consortium members Nick Walker (LN), Pekka Koponen (FVH), Mohammad Al-Rifai (VW) and Ana Correia (ATB), addressing the following key aspects:

• The Market Challenge – what are we trying to solve?
• The Impact of Solving the Challenges – what does solving the challenge mean?
• The building blocks of the solution – how have we solved the challenge?
• The future plan – what do we plan next?

After the presentation, we had an intensive panel discussion, moderated by Christian Wolff (ATB), involving consortium members Nick Walker (LN), Pekka Koponen (FVH), Mohammad Al-Rifai (VW), Iván Carillo (ATOS), as well as Kimmo Rossi from the European Commission. During the discussion we had the possibility to dive deeper into the topics raised in the presentation and by the audience, such as current consent barriers for data sharing, and ongoing and potential standardisation activities for smashHit components. Kimmo Rossi also gave interesting insights on ongoing activities in the consent and data spaces field from the European Commission’s point of view.

More information can be found on the official programme page, including the presentations at: https://european-big-data-value-forum.eu/2022-edition/programme/. Additionally, we have streamed the full session live on our smashHit’s Youtube channel, and the video can now be found on demand at the following link: https://youtu.be/2Jn5nHfbQ3I

The post The smashHit session at the EBDVF2022 was a success! appeared first on Smash Hit.

In our presentation we will be discussing the smashHit platform, presented by Ana Teresa Correia (ATB), Nick Walker (LN), Pekka Koponen (FVH) and Dr. Mohammed Al-Rifai (VW), addressing the important questions such as:

• The Market Challenge – what are we trying to solve?
• The Impact of Solving the Challenges – what does solving the challenge mean?
• The building blocks of the solution – how have we solved the challenge?
• The future plan – what do we plan next?

After the presentation, we will have the panel session in a larger round of people, comprised of Nick Walker (LN), Pekka Koponen (FVH), Dr. Mohammed Al-Rifai (VW), Kimmo Rossi (European Commission), Carmen (ATOS), Friederike (LUH), and it will be moderated by Christian Wolff (ATB). In this session panelists will discuss and address the questions and points raised by the EBDVF attendees.

You can find more information on the official programme page https://european-big-data-value-forum.eu/2022-edition/programme/ under the track name Data Spaces and the name of the session An Innovative Approach to Compliant Consent. We are scheduled for Tuesday, 22.11. 17:00-18:00, which we will be streaming live in our smashHit’s Youtube channel https://www.youtube.com/channel/UCnKnDSPB6fmn6kzKo716baA/featured.

On a last note, in case you haven’t checked it out yet, you can also have a look at recently published white papers on our smashHit website https://smashhit.eu/whitepapers/ .

The post smashHit’s Closing Event At EBDVF appeared first on Smash Hit.

Hello Jätkäsaarelainen!

With the new City Feedback App, you give feedback to the city and share information with other city residents. Download the app and develop a more functional city! The City Feedback App is an information sharing channel intended for everyone moving around the city. Through it, you can give and browse feedback that has been left to and from the city. Everyone who has downloaded the application can see the messages already left and can send their own feedback and development suggestions while logged in.

The post Hello Jätkäsaarelainen! appeared first on Smash Hit.

Approaches to requirements identification and specification

Privacy and data protection requirements emanate from several sources. These include regulatory, industrial and user/stakeholders’ needs. Apart from the GDPR, several other instruments of specific application impose privacy and data protection-related requirements. In addition, industrial standards are relevant for extracting requirements relating to privacy and data protection. System developers are thus expected to analyse the specific environment that their system will operate and identify specific regulations that apply to such environment to extract these requirements. In the smashHit project, for example, part of the tools developed in the project aims to address data subjects’ consent management within the automobile ecosystem, involving stakeholders such as data subjects, auto manufacturers, insurance, and others. Given the involvement of personal data, the project’s legal requirements stem from the GDPR and other relevant sources within this ecosystem.

Identifying privacy and data protection requirements require a systematic and multi-disciplinary approach. Generally, this involves several consultations with the relevant stakeholders to extract the needs of each stakeholder. In cases where there are defined project proposals, such documents provide valuable information and should be consulted during the requirements identification. For example, EU projects Grant Agreements contain various requirements, including privacy and data protection requirements. When the initial requirements are collected, there is also a need to analyse them thoroughly and collaboratively. Depending on the outcome, further consultations could be organised to agree on differences and obtain relevant feedback.

Translating data protection requirements into executable actions: the value of TOMs

Having defined the privacy and data protection requirements from multiple sources, the next step is to ensure that these requirements are executed in the system’s architectural design. Adopting a P/DPbD strategy is vital at this stage of the process. A key instrument in system development according to the principles of P/DPbD is the implementation of “appropriate technical and organisational measures which are designed to implement data-protection principles […] in an effective manner and to integrate the necessary safeguards into the processing in order to […] protect the rights of data subjects” (Art. 25 (1) GDPR).

To translate these privacy and data protection requirements into executable actions, smashHit utilised the Data Protection Management Process according to the Standard Data Protection Model (SDM)[2]. The SDM is a systematic approach to implement GDPR requirements in practice and has been acknowledged by the supervisory authorities. It uses “protection goals” to systematise the data protection requirements. This approach allows the project to identify specific technical and organisational measures (TOMs) or privacy-enhancing technologies (PET) to be implemented to mitigate the identified risks associated with the proposed data processing, or to keep the risks on an acceptable level. Concretely, the SDM first records the legal requirements of the GDPR and then assigns them to the following protection goals:

• Data Minimisation (Art. 5 para. 1 lit. c GDPR);
• Availability;
• Integrity (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Confidentiality (Art. 5 para. 1 lit. f GDPR, Art. 32 para. 1 lit. b GDPR);
• Transparency (Art. 5 para. 1 lit. a GDPR);
• Unlinkability (Art. 5 para. 1 lit. b GDPR) and
• Intervenability [3].

Each protection goal has its scope and purpose. In addition, there is the protection goal of “Resilience” which aims at sufficient preparation of systems and processes for events that cause disruptions to regular processes. In addition, it is essential to note the impact of the system’s interaction with other external systems and point out the privacy implications and requirements for the external system. This is necessary for maintaining end-to-end protection. Furthermore, the technical and organisational measures to ensure data security must be well planned considering the system’s operational environment.

Finally, it is necessary to trace privacy and data protection requirements during the testing and implementation of the system. Establishing a feedback framework will assist in tracking how these requirements are executed. When the system is finally developed and running, a privacy or data protection audit becomes necessary to check the scope of implementation in operation. In the smashHit project, this is addressed by utilizing the Data Protection Management Cycle (DPM cycle) [4] which covers the whole process of data protection management including the evaluation of measures taken and the implementation of necessary improvements.

Conclusion

Projects like smashHit that involve the processing of personal data must endeavour to extract privacy and data protection requirements systematically and holistically. Data protection by design is a principle, set out in the GDPR, that promotes privacy and data protection compliance from the start. It is an alternative to bolting privacy considerations on as an after-thought or ignoring them altogether [5]. Adopting a P/DPbD approach like the SDM allows to identify all personal data sets and apply data protection principles through the selection of appropriate TOMs alongside the technical development of the system.

References

[1]  A. Cavoukian, “Operationalizing Privacy by Design: A Guide to Implementing Strong Privacy Practices”, Information and Privacy Commissioner, Ontario, 2012. See also, Art. 25 of the GDPR.

[2] The Standard Data Protection Model, “A method for data protection advising and controlling on the basis of uniform protection goals”, Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Länder, April 2020, Available at https://www.datenschutzzentrum.de/uploads/sdm/SDM-Methodology_V2.0b.pdf. 

[3] The Standard Data Protection Model (SDM), p. 25 et seqq. Note: Availability and intervenability are not explicitly named as principles relating to processing of personal data in the GDPR but can be derived from it.

[4] The Standard Data Protection Model (SDM), p. 52 et seq.

[5] ENISA, “Data Protection Engineering”, 2022, Available at https://www.enisa.europa.eu/publications/data-protection-engineering.

The post Transposing Data Protection Requirements into Technical and Organisational Measures: The smashHit Approach appeared first on Smash Hit.