Suchergebnisse

Consenting on the Web, in the context of online privacy and data protection, is universally accepted as a difficult problem, mainly because of its cross-disciplinarity. For example, any approach to online Consenting needs to meet usability, legal, regulatory, technical, and business requirements. To date, effort has been predominantly focused on meeting compliance with regulations and automation, and less on the true re-empowerment of users with respect to their personal data. One approach that has not seen sufficient research is the use of 'Consent Receipts', which offer a new paradigm of recording interactions concerning consent and using them as proofs in future actions, similar to familiar use of a common shopping receipt. In addition to being a record, receipts encourage accountability in how technology handles consent and is beneficial for all involved stakeholders. For organisations, it assists with legal requirements for demonstration of valid consent, while for users it provides transparency and accountability by being a proof to be used against malpractices related to consent. Receipts also have uses in addition to those related to consent, such as for authorising the holder in exercising related rights. This paper analyses the requirements, uses, and benefits offered by Consent Receipts with an extensive and broad literature review. Since receipts are a novel concept, we identify properties and requirements, and then new mechanisms necessary for the Web to support receipts. We then demonstrate feasibility of receipts through proof-of-concepts in three common real-world use-cases: (a) acceptance of a privacy policy and its subsequent changes; (b) choices expressed via consent dialogues or cookie banners; and (c) verbal interactions with Amazon Alexa. ; This work was supported by the European Union's Horizon 2020 Research and Innovation Program Next Generation Internet (NGI) Trust for Project 3.40 Privacy-as-Expected: Consent Gateway under Grant 825618. The work of Harshvardhan J. Pandit was supported ...

This article outlines issues in the current ecosystem of data sharing based on consent and the role of identity and identification. It argues how the consent mechanism is hostile to individuals in the form of: (a) inscrutable third parties who remain largely unknown; (b) denying ability to identify and manage consent; and (c) lack of technological solution. The article discusses the role and feasibility of Consent Receipts, and presents its role in the Privacy as Expected: Consent Gateway (PaE:CG) project for the future of accountable identity and identification mechanisms for consent. ; Funding Acknolwedgements: This work has been funded under the European Union's Horizon 2020 research and innovation programme NGI TRUST Grant#825618 for Project#3.40 Privacy-as-Expected: Consent Gateway. Harshvardhan J. Pandit is also funded by Irish Research Council Government of Ireland Postdoctoral Fellowship Grant#GOIPD/2020/790; and ADAPT SFI Centre for Digital Media Technology funded by Science Foundation Ireland through SFI Research Centres Programme and co-funded under European Regional Development Fund (ERDF) through Grant#13/RC/2106_P2.

We discuss the problem of accountability when multiple parties cooperate towards an end result such as multiple companies in a supply chain or departments of a government service under different authorities. In cases where a full trusted central point does not exist, it is difficult to obtain a trusted audit trail of a workflow when each individual participant is unaccountable to all others. We propose AudiWFlow, an auditing architecture which makes participants accountable for its contributions in a distributed workflow. Our scheme provides confidentiality in most cases, collusion detection and availability of evidence after the workflow terminates. AudiWFlow is based on verifiable secret sharing and real-time peer-to-peer verification of records; it further supports multiple levels of assurance to meet a desired trade-off between the availability of evidence and the overhead resulting from the auditing approach. We propose and evaluate two implementation approaches for AudiWFlow. The first one is fully distributed except for a central auxiliary point that, nevertheless, needs only a low level of trust. The second one is based on smart-contracts running on a public blockchain which is able to remove the need of any central point but requires the integration with a blockchain.

This document represents the final (combined) deliverable for the outcomes of the Privacy as Expected: Consent Gateway (PaE:CG) project. It outlines the project's main deliverables, which consist of: (1) a strategy and vision to offer internet users Consent Receipts and (2) software demonstrating the developed concepts. ; NGI_Trust project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 825618.