Exploring Design Characteristics of Data Trustees in Healthcare - Taxonomy and Archetypes

2023 | European Conference On Information Systems | Citations: 0

Authors: Lauf, Florian; Scheider, Simon; Friese, Jana; Kilz, Sarah; Radic, Marija; Burmann, Anja

Abstract: The use of health data provides valuable insights for both research and industr ... Expand

Abstract: The use of health data provides valuable insights for both research and industry comprising the potential to improve services and facilitate the development of innovative solutions in healthcare. However, due to data protection requirements and technical challenges, access to health data is still severely inhibited. To enhance access to and utilization of health data, science and politics increasingly consider data trustee models as a conceivable solution. Yet, such concepts are still in their infancies and hardly known. At the same time, they exhibit strong differences in their design. Thus, to foster awareness about and the development of data trustee models, this study investigates their design characteristics and integrates them into a holistic taxonomy under the lens of European data law. Additionally, design patterns are explored and archetypes derived. The findings reveal that data trustee models in healthcare follow some overarching design patterns and can be assigned to four dominant archetypes. Collapse

Topics: data governance database system business model legal context healthcare data

Methods: focus group literature study archival research design pattern group interview

Toward a taxonomy of corporate data protection malpractices and their causal mechanisms: A regulatory view

2023 | Journal of Information Technology | Citations: 0

Authors: Zhao, Haiping; Jiang, Na; Cai, Zhao; Lim, Eric T. K.; Tan, Chee-Wee

Abstract: Corporate data protection malpractices are not uncommon, especially in contempor ... Expand

Abstract: Corporate data protection malpractices are not uncommon, especially in contemporary technological environments. Embracing a regulatory view, this study attempts to advance a taxonomy of prevailing corporate data protection practices and their causal mechanisms by analyzing cases where organizations were fined for violating data protection legislation. Selecting the General Data Protection Regulation (GDPR) enacted by the European Union (EU) as our benchmark, this study employs an iterative taxonomy development technique as guidance and conducts a thematic analysis on 875 cases of GDPR enforcement. In so doing, we derive a conceptual model comprising 6 focal categories and 28 subcategories of prevailing corporate data protection malpractices existing within organizations as well as 4 main categories and 22 subcategories of causal mechanisms underlying these identified malpractices. Empirical findings from this study not only reinforce corporate data protection malpractices established in prior research but also yield novel malpractices that have been neglected in previous work. From a pragmatic standpoint, this study yields invaluable insights into the prevention and resolution of corporate data protection malpractices for practitioners. Collapse

Topics: data protection legal context General Data Protection Regulation privacy database system

Methods: archival research qualitative coding qualitative content analysis self reported survey design methodology

The role of design patterns in the development and legal assessment of lawful technologies

2022 | Electronic Markets | Citations: 2

Authors: Dickhaut, Ernestine; Li, Mahei Manhai; Janson, Andreas; Leimeister, Jan Marco

Abstract: Novel technologies such as smart personal assistants integrate digital services ... Expand

Abstract: Novel technologies such as smart personal assistants integrate digital services into everyday life. These services use personal data to offer personalized services. While they are subject to special data protection regulations at the time of development, there are few guidelines describing the transition from legal requirements to implementation. To reduce risks, services depend on external legal assessments. With developers and legal experts often missing either legal or technical knowledge, the challenge lies in bridging this gap. We observe that design patterns support both developers and legal experts, and we present an approach in which design patterns are leveraged to provide twofold value for both developers and legal experts when dealing with novel technologies. We conducted a revelatory case study for smart personal assistants and scaffolded the case interpretation through cognitive fit theory. On the basis of the findings, we develop a theoretical model to explain and predict the twofold value of design patterns to develop and assess lawful technologies. Collapse

Topics: systems development problem solving legal context General Data Protection Regulation legal information system

Methods: design pattern case study simulation theory development qualitative interview

Theories: cognitive fit theory

Process and Tool Support for Integration of Privacy Aspects in Agile Software Engineering

2020 | Americas Conference on Information Systems | Citations: 3

Authors: Huth, Dominik; Both, Andreas; Ahmad, Jeffrey; Sauer, Gerhard; Yilmaz, Fatih; Matthes, Florian

Abstract: The General Data Protection Regulation (GDPR) poses a multitude of challenges t ... Expand

Abstract: The General Data Protection Regulation (GDPR) poses a multitude of challenges to companies on the legal, business and technical level. Almost two years after the regulation entered into force, a series of significant fines were issued because of insecure data processing. We claim that incorporating adequate measures for data protection is a challenge for software developers and that a lightweight approach to support this goal can be beneficial. This short paper proposes an approach for integrating privacy aspects in agile development methods and outlines a prototype as tool support for this approach. Collapse

Topics: privacy system development method system support data protection agile software development

Methods: design artifact design methodology

“Appropriate Technical and Organizational Measures”: Identifying Privacy Engineering Approaches to Meet GDPR Requirements

2019 | Americas Conference on Information Systems | Citations: 0

Authors: Huth, Dominik; Matthes, Florian

Abstract: The General Data Protection Regulation requires, inter alia, the establishment ... Expand

Abstract: The General Data Protection Regulation requires, inter alia, the establishment of technical and organizational measures to ensure privacy properties. Software developers face the challenge of identifying these properties and suitable privacy enhancing techniques (PET). We conduct a literature study and identify eight privacy engineering approaches, which we analyze for their coverage of the GDPR privacy properties and for their support in software development phases. We conclude that recent privacy engineering approaches have the conceptual background to cover the GDPR, but advocate research on the integration of privacy concerns in software development processes. Collapse

Topics: privacy General Data Protection Regulation legal context systems development data encryption

Methods: literature study design artifact qualitative content analysis conceptual modelling laboratory experiment