Thoughts on regulatory and ethical issues relating to the use of technology in education and research
While colleagues are looking at whether data can be used to pick up early signs of mental health and wellbeing problems, I’m exploring possible legal frameworks for doing that safely. As the diagram shows, trying to deliver an early warning service to all students falls into a gap between three reasonably familiar areas of data […]
In data protection circles, the phrase “Safe Harbour” doesn’t have a great reputation. Wikipedia describes those as setting hard boundaries around an area where “a vaguer, overall standard” applies. Famously, in 2015, the European Court of Justice struck down the data protection Safe Harbor arrangement negotiated between the European Commission and the US Government. So […]
The Government’s new White Paper on Online Harms is strikingly wide in both the range of harms identified, and the range of entities asked to play a part in reducing them. The White Paper envisages that harmful content could be spread through any online facility that allows individual users to share content, to find content […]
To my ex-programmer ears, phrases like “web 2.0” and “industry 4.0” always sound a bit odd. Sectors don’t have release dates, unlike Windows 10, iOS 12 or Android Oreo. Oddly, one field that does have major version releases is the law: it would be quite reasonable to view 25th May 2018 as the launch of […]
Incident response teams often share information when investigating incidents. Some patterns may only become apparent when data from different networks are compared; other teams may have skills – such as analysing malware – to understand data in ways we cannot. Since much of this information includes IP or email addresses – information classed as Personal […]
Under current plans the UK will become – for data protection purposes – a “third country” when it leaves the EU. Although the UK Government has stated that the rules for transferring personal data from the UK to the EU will remain the same, any transfers from the EU to the UK will need to […]
The Government’s powers make orders relating to information about communications have now moved from the Regulation of Investigatory Powers Act 2000 to the Investigatory Powers Act 2016. The associated Code of Practice provides useful information on the process for issuing three types of notice in particular: Communications Data Requests, Technical Capabilities Orders and Data Retention […]
Some good news from the draft ePrivacy Regulation. More than a year after I pointed out that the Regulation could inadvertently prohibit websites and other Internet-connected services from using logfiles to secure their services, the Council of Ministers’ latest (20th September 2018) draft explicitly recognises the problem. Recital 8 now includes the positive statement that: […]
An interesting observation made by a Dutch colleague earlier this week. The arrows in my standard model of learning analytics (here rearranged and recoloured to match the “swimlane” visualisation of the learning process) all mark “gatekeeper” points where information flow is filtered and reduced. Between Collection and Analysis there’s a necessity/relevance filter so that not […]
In developing our Data Protection Impact Assessment for the Janet Security Operations Centre we noted that our Penetration Testing service could involve high risks, but didn’t really fit the DPIA framework. Penetration tests are much smaller scale than the SOC; they are commissioned by individual Jisc customers, usually on only parts of their operations; and […]