3,402 Matching Annotations
  1. Jun 2020
    1. Chu, D. K., Akl, E. A., Duda, S., Solo, K., Yaacoub, S., Schünemann, H. J., Chu, D. K., Akl, E. A., El-harakeh, A., Bognanni, A., Lotfi, T., Loeb, M., Hajizadeh, A., Bak, A., Izcovich, A., Cuello-Garcia, C. A., Chen, C., Harris, D. J., Borowiack, E., … Schünemann, H. J. (2020). Physical distancing, face masks, and eye protection to prevent person-to-person transmission of SARS-CoV-2 and COVID-19: A systematic review and meta-analysis. The Lancet, 0(0). https://doi.org/10.1016/S0140-6736(20)31142-9

    1. Estimates say that 83% of us will be hit with a mental health crisis in our lives, we can all make the choices to invest wisely in this area to improve our ‘mental durability’ to deal with it properly.
    1. Hsiang, S., Allen, D., Annan-Phan, S., Bell, K., Bolliger, I., Chong, T., Druckenmiller, H., Huang, L. Y., Hultgren, A., Krasovich, E., Lau, P., Lee, J., Rolf, E., Tseng, J., & Wu, T. (2020). The effect of large-scale anti-contagion policies on the COVID-19 pandemic. Nature, 1–9. https://doi.org/10.1038/s41586-020-2404-8

    1. Oliver, N., Lepri, B., Sterly, H., Lambiotte, R., Deletaille, S., Nadai, M. D., Letouzé, E., Salah, A. A., Benjamins, R., Cattuto, C., Colizza, V., Cordes, N. de, Fraiberger, S. P., Koebe, T., Lehmann, S., Murillo, J., Pentland, A., Pham, P. N., Pivetta, F., … Vinck, P. (2020). Mobile phone data for informing public health actions across the COVID-19 pandemic life cycle. Science Advances, 6(23), eabc0764. https://doi.org/10.1126/sciadv.abc0764

    1. Kempfert, K., Martinez, K., Siraj, A., Conrad, J., Fairchild, G., Ziemann, A., Parikh, N., Osthus, D., Generous, N., Del Valle, S., & Manore, C. (2020). Time Series Methods and Ensemble Models to Nowcast Dengue at the State Level in Brazil. ArXiv:2006.02483 [q-Bio, Stat]. http://arxiv.org/abs/2006.02483

  2. May 2020
    1. Betsch, C., Wieler, L., Bosnjak, M., Ramharter, M., Stollorz, V., Omer, S., Korn, L., Sprengholz, P., Felgendreff, L., Eitze, S., & Schmid, P. (2020). Germany COVID-19 Snapshot MOnitoring (COSMO Germany): Monitoring knowledge, risk perceptions, preventive behaviours, and public trust in the current coronavirus outbreak in Germany. https://doi.org/10.23668/PSYCHARCHIVES.2776

    1. The data that organizations and individuals have committed to digital memory stands to ultimately control them.
    2. by practicing data minimalism and actively considering your data decisions
    3. learn how to be a data steward or data ally. Help organizations proactively think about what data they collect and how it is governed after its collected. Help organizations get their collective head around all the data they possess, how they curate it, how they back it up, and how over time they minimize it.
    1. With a single source IP address it's possible to quickly determine the type of devices on their network, and the social networks they frequent – Google, YouTube, Facebook, Soichat.com, TikTok, Line (a chat application), among many other domains.
    1. Not necessarily. Hosting companies tend to keep your backups in the same place as your primary files. You don’t carry around a copy of your birth certificate along with the actual one – you keep the real one safe at home for emergencies. So why not do the same for your backups? CodeGuard provides safe, offsite backup that is 100% independent from your hosting provider.
    1. Register Today For Data Science Certification. Learn the Best Data Science Course from our Top Tutors. Study and Get A Certified Data Science Course. Enroll For Data Science Certification and Get 24/7 support and all time study Material. Land in your Dream Job by registering to this Course.

    1. Now personal data exports include users session information and users location data from the community events widget. Plus, a table of contents!See progress as you process export and erasure requests through the privacy tools.
    1. They collect very little data so their "export" feature is very simplistic: just an in-browser JSON dump of localStorage and cookies.

      Browser Data

      We use data on your browser to offer features on this website. We do not store this data, but we can offer a view of your browser data at any time.

      View Browser Data

    1. users must also be informed of the breach (within the same time frame) unless the data breached was protected by encryption (data rendered unreadable for the intruder), or, in general, the breach is unlikely to result in a risk to individuals’ rights and freedoms.
    2. The GDPR permits data transfers of EU resident data outside of the European Economic Area (EEA) only when in compliance with set conditions.
    3. Because consent under the GDPR is such an important issue, it’s mandatory that you keep clear records and that you’re able to demonstrate that the user has given consent; should problems arise, the burden of proof lies with the data controller, so keeping accurate records is vital.
    4. This right only applies to personal data and as such does not apply to genuinely anonymous data (data that can’t be linked back to the individual).
    5. The records should include: who provided the consent;when and how consent was acquired from the individual user;the consent collection form they were presented with at the time of the collection;which conditions and legal documents were applicable at the time that the consent was acquired.
    6. Non-compliant Record Keeping Compliant Record Keeping
    1. If you’re switching from another cookie management solution to ours, you may want to migrate the consents you’ve already collected. This is useful for ensuring that users who have already given their consent under the previous solution are not presented with the cookie banner, and the related request for consent, again.
    1. If, for example, you want to migrate consents from a previous provider, you could call this method inside the onBeforePreload callback when consent is already given by another platform.
    1. Services generally fall into two categories: Services related to your own data collection activities (eg. contact forms)Services related to third-party data collection activities (eg. Google Analytics)
    1. “If you are a non-college graduate man you have a less than 50/50 shot of ever being married in your life” – Andrew YangIn the 1970s and ‘80s, there were about 17 million manufacturing jobs in the USToday, there are about 12 million of those jobsMore women are graduating from college than men58% of college graduates in the US are women
    2. Today, 40% of children are born to unmarried mothersBack in the 70s and 80s, it was only 15%
    1. In practice, the TCF provides a standardized process for getting users’ informed consent and allows the seamless signaling of users’ s consent preferences across the advertising supply chain.
    1. The goal of the W3C Semantic Web Education and Outreach group's Linking Open Data community project is to extend the Web with a data commons by publishing various open datasets as RDF on the Web and by setting RDF links between data items from different data sources.
    2. The above diagram shows which Linking Open Data datasets are connected, as of August 2014.
    1. Hartman, T. K., Stocks, T. V. A., McKay, R., Gibson Miller, J., Levita, L., Martinez, A. P., Mason, L., McBride, O., Murphy, J., Shevlin, M., bennett, kate m, & Bentall, R. (2020). The Authoritarian Dynamic During the COVID-19 Pandemic: Effects on Nationalism and Anti-Immigrant Sentiment [Preprint]. PsyArXiv. https://doi.org/10.31234/osf.io/4tcv5

    1. Sure, anti-spam measures such as a CAPTCHA would certainly fall under "legitimate interests". But would targeting cookies? The gotcha with reCAPTCHA is that this legitimate-interest, quite-necessary-in-today's-world feature is inextricably bundled with unwanted and unrelated Google targeting (cookiepedia.co.uk/cookies/NID) cookies (_ga, _gid for v2; NID for v3).
    2. Many 3rd parties has some magic parameter which blocks the cookie, but doesn't block the functionality of the element, and I'm looking for something like that. For example brightcove player has a data attribute. Video is working, cookies are not set.
    1. Google encouraging site admins to put reCaptcha all over their sites, and then sharing the resulting risk scores with those admins is great for security, Perona thinks, because he says it “gives site owners more control and visibility over what’s going on” with potential scammer and bot attacks, and the system will give admins more accurate scores than if reCaptcha is only using data from a single webpage to analyze user behavior. But there’s the trade-off. “It makes sense and makes it more user-friendly, but it also gives Google more data,”
    2. For instance, Google’s reCaptcha cookie follows the same logic of the Facebook “like” button when it’s embedded in other websites—it gives that site some social media functionality, but it also lets Facebook know that you’re there.
    3. But this new, risk-score based system comes with a serious trade-off: users’ privacy.
    1. Lots of definitions. Pretty good, but a lot of it is obvious.

    2. One of the GDPR's principles of data processing is storage limitation. You must not store personal data for longer than you need it in connection with a specified purpose.
    3. But it also requires that you keep personal data well-organized and accessible to those who require access to it.
    4. Don't collect personal data that you don't need. "Data minimization" is a crucially important principle under the GDPR, and can also make you less susceptible to data breaches,
    1. there’s no need to send consent request emails — provided that this basis of processing was stated in your privacy policy and that users had easy access to the notice prior to you processing their data. If this information was not available to users at the time, but one of these legal bases can currently legitimately apply to your situation, then your best bet would be to ensure that your current privacy notice meets requirements, so that you can continue to process your user data in a legally compliant way.
    2. Here’s why sending GDPR consent emails is tricky and should be handled very carefully.
    1. they sought to eliminate data controllers and processors acting without appropriate permission, leaving citizens with no control as their personal data was transferred to third parties and beyond
    1. the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
    2. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

      These conditions are individually sufficient and jointly necessary (https://hyp.is/e0RRFJCfEeqwuR_MillmPA/en.wikipedia.org/wiki/Necessity_and_sufficiency).

      Each of the conditions listed is a sufficient (but, by itself, not necessary) condition for legal transfer (T) of personal data to a third country or an international organisation. In other words, if any of those conditions is true, then legal transfer is also true.

      On the other hand, the list of conditions (C; let C be the disjunction of the conditions a-g: a or b or c ...) are jointly necessary for legal transfer (T) to be true. That is:

      • T cannot be true unless C (one of a or b or c ...) is true
      • if C is false (there is not one of a or b or c ... that is true), then T is false
      • T ⇒ C
      • C ⇐ T
    1. Consent receipt mechanisms can be especially helpful in automatically generating such records.
    2. With that guidance in mind, and from a practical standpoint, consider keeping records of the following: The name or other identifier of the data subject that consented; The dated document, a timestamp, or note of when an oral consent was made; The version of the consent request and privacy policy existing at the time of the consent; and, The document or data capture form by which the data subject submitted his or her data.
    3. Where a processing activity is necessary for the performance of a contract.

      Would a terms of service agreement be considered a contract in this case? So can you just make your terms of service basically include consent or implied consent?

    4. “Is consent really the most appropriate legal basis for this processing activity?” It should be taken into account that consent may not be the best choice in the following situations:
    1. “Until CR 1.0 there was no effective privacy standard or requirement for recording consent in a common format and providing people with a receipt they can reuse for data rights.  Individuals could not track their consents or monitor how their information was processed or know who to hold accountable in the event of a breach of their privacy,” said Colin Wallis, executive director, Kantara Initiative.  “CR 1.0 changes the game.  A consent receipt promises to put the power back into the hands of the individual and, together with its supporting API — the consent receipt generator — is an innovative mechanism for businesses to comply with upcoming GDPR requirements.  For the first time individuals and organizations will be able to maintain and manage permissions for personal data.”
    2. CR 1.0 is an essential specification for meeting the proof of consent requirements of GDPR to enable international transfer of personal information in a number of applications.
    3. Its purpose is to decrease the reliance on privacy policies and enhance the ability for people to share and control personal information.
    1. generic-sounding term may be interpreted as something more specific than intended: I want to be able to use "data interchange" in the most general sense. But if people interpret it to mean this specific standard/protocol/whatever, I may be misunderstood.

      The definition given here

      is the concept of businesses electronically communicating information that was traditionally communicated on paper, such as purchase orders and invoices.

      limits it to things that were previously communicated on paper. But what about things for which paper was never used, like the interchange of consent and consent receipts for GDPR/privacy law compliance, etc.?

      The term should be allowed to be used just as well for newer technologies/processes that had no previous roots in paper technologies.

    1. “A processor is responsible for processing personal data on behalf of a controller.”
    2. “A controller determines the purposes and means of processing personal data.” This is you.
    1. EU law prohibits the personal data of EU citizens from being transferred outside the EU to countries which do not ensure an adequate level of protection for that data.
    2. This framework serves the purpose of protecting Europeans’ personal data after the transfer to the US and correlates with GDPR requirements for Cross Boarder Data Transfers.
    1. It’s useful to remember that under GDPR regulations consent is not the ONLY reason that an organization can process user data; it is only one of the “Lawful Bases”, therefore companies can apply other lawful (within the scope of GDPR) bases for data processing activity. However, there will always be data processing activities where consent is the only or best option.
    2. Under EU law (specifically the GDPR) you must keep and maintain “full and extensive” up-to-date records of your business processing activities, both internal and external, where the processing is carried out on personal data.
    3. However, even if your processing activities somehow fall outside of these situations, your information duties to users make it necessary for you to keep basic records relating to which data you collect, its purpose, all parties involved in its processing and the data retention period — this is mandatory for everyone.
    1. If you’re a controller based outside of the EU, you’re transferring personal data outside of the EU each time you collect data of users based within the EU. Please make sure you do so according to one of the legal bases for transfer.

      Here they equate collection of personal data with transfer of personal data. But this is not very intuitive: I usually think of collection of data and transfer of data as rather different activities. It would be if we collected the data on a server in EU and then transferred all that data (via some internal process) to a server in US.

      But I guess when you collect the data over the Internet from a user in a different country, the data is technically being transferred directly to your server in the US. But who is doing the transfer? I would argue that it is not me who is transferring it; it is the user who transmitted/sent the data to my app. I'm collecting it from them, but not transferring it. Collecting seems like more of a passive activity, while transfer seems like a more active activity (maybe not if it's all automated).

      So if these terms are equivalent, then they should replace all instances of "transfer" with "collect". That would make it much clearer and harder to mistakenly assume this doesn't apply to oneself. Or if there is a nuanced difference between the two activities, then the differences should be explained, such as examples of when collection may occur without transfer occurring.

    2. whose personal data you collect and process as “controller” (that is the word that GDPR uses for whoever determines the purposes and means of the processing of personal data).
    1. Drew, D. A., Nguyen, L. H., Steves, C. J., Menni, C., Freydin, M., Varsavsky, T., Sudre, C. H., Cardoso, M. J., Ourselin, S., Wolf, J., Spector, T. D., Chan, A. T., & Consortium§, C. (2020). Rapid implementation of mobile technology for real-time epidemiology of COVID-19. Science. https://doi.org/10.1126/science.abc0473

    1. you can think “sold” here as “shared with third parties for any profit, monetary or otherwise”
    2. The right to data portability Under certain conditions, users have the right to obtain (in a machine-readable format) and use their personal data for their own purposes.
    3. under most legislations you’re required to inform extensively about the processing activities, their purposes and the rights of users.
    4. Full and extensive records of processing are expressly required in cases where your data processing activities are not occasional, where they could result in a risk to the rights and freedoms of others, where they involve the handling of “special categories of data” or where your organization has more than 250 employees — this effectively covers almost all data controllers and processors.
    5. Meet specific requirements if transferring data outside of the EAA. The GDPR permits data transfers of EU resident data outside of the European Economic Area (EEA) only when in compliance with set conditions.
    6. Users have the right to access to their personal data and information about how their personal data is being processed.
    1. If you have fewer than 250 employees, you only need to document processing activities that: are not occasional; or
    2. Most organisations are required to maintain a record of their processing activities, covering areas such as processing purposes, data sharing and retention; we call this documentation.
    1. the GDPR restricts transfers of personal data outside the EEA, or the protection of the GDPR, unless the rights of the individuals in respect of their personal data is protected in another way
    1. Similarly, the GDPR introduces the concept of ‘pseudonymous data’ – personal data that cannot be attributed to the data subject without some additional information.
    1. it buys, receives, sells, or shares the personal information of 50,000 or more consumers annually for the business’ commercial purposes. Since IP addresses fall under what is considered personal data — and “commercial purposes” simply means to advance commercial or economic interests — it is likely that any website with at least 50k unique visits per year from California falls within this scope.