Privacy compliance for e-commerce in web services architecture

由于资讯科技和电子设备各方面的进步，我们已透过不同渠道，例如监察装置或电子商贸渠道，收集并继续收集有关客户/市民的大量资料。许多涉及安全漏洞和不适当使用私人数据的新闻吸引了大量关注，并给政府带来了监管私人数据使用的压力。各国政府的回应是制定隐私法，规范在不同领域收集和使用私人数据，例如美国的HIPPA针对健康数据，加拿大的PIPEDA针对在线收集的数据。如今，大多数公司都会告知用户在哪些隐私策略下收集数据，还创建了一些工具，为用户/客户提供自动代理，获取网站的隐私策略，并将其与用户的隐私偏好进行比较。然而，迫切需要提供适当的工具来执行隐私政策，即确保确实使用了符合收集隐私政策的私人数据。这是一个非常具有挑战性的问题，因为由于组织内各种企业系统的集成，以及由于B2B集成、跨境电子商务、电子商务、移动商务等的增加，电子商务/电子商务是复杂的。此外，处理隐私问题并未被设计到软件应用程序中，而是在应用程序安装后被“固定”。这一研究项目的重点是开发新的科学方法和工具来执行隐私政策，特别是创建机制，以(I)监测私人数据在各种集成子系统之间的移动和子系统对数据的存储；(Ii)确定子系统和应用程序如何使用私人数据；以及(Iii)确保私人数据的使用和存储满足收集这些数据时所依据的隐私政策。

Due to improvements in various fields of Information Technology (IT) and electronic devices, much data has been and is continually being collected on customers/citizens through various channels, such as monitoring devices or eCommerce channels. Many news items, dealing with security breaches and inappropriate use of private data, have attracted a lot of attention and created pressure on governments to regulate the use of private data. Governments have responded with enacting privacy laws that regulate the collection and use of private data in various domains, such as HIPPA in the US for health data and PIPEDA in Canada for data collected online. Most companies today inform users under which privacy policies data is collected and tools have also been created to provide users/customers with automated agents that fetch the web site's privacy policy and compare it the user's privacy preferences. However there is urgent need to provide appropriate tools for enforcement of privacy policies, that is, to ensure that private data is indeed used that satisfy the privacy policy under which it was collected. This is a very challenging problem because eCommerce/eBusiness is complex due to integration of various enterprise systems within organizations, and due to increased B2B integration, cross border e-commerce, e-business, mobile commerce, etc. Moreover, dealing with privacy issues has not been designed into software applications, but rather "bolted on" after applications are installed. The focus of this research project is develop new scientific methods and tools to enforce privacy policies, specifically to create mechanisms to (i) monitor the movement of private data between the various integrated subsystems and storage of data by the subsystems; (ii) determine how the private data is used by subsystems and applications; and (iii) ensure that the data use and storage of private data satisfies the privacy policies under which they were collected.