# Privacy by Design in CBRN Technologies Targeted to Vulnerable Groups: The Case of PROACTIVE

Mariano Martín Zamorano, Natasha Newton, Virginia Bertelli, Laura Petersen

► To cite this version:

Mariano Martín Zamorano, Natasha Newton, Virginia Bertelli, Laura Petersen. Privacy by Design in CBRN Technologies Targeted to Vulnerable Groups: The Case of PROACTIVE. 7th International Conference on Information Technology in Disaster Risk Reduction (ITDRR), Oct 2022, Krisitansand, Norway. pp.244-258, 10.1007/978-3-031-34207-3_16 . hal-04680548

HAL Id: hal-04680548

https://inria.hal.science/hal-04680548v1

Submitted on 28 Aug 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Privacy by design in CBRN technologies targeted to
vulnerable groups: the case of PROACTIVE

Mariano Martín Zamorano¹[0000-0003-3338-7400], Natasha Newton², Virginia Bertelli³[0000-0002-2680-2517], and Laura Petersen⁴[0000-0003-0226-0095]

1,3 Eticas Research and Consulting, Spain

² Rinicom, UK

⁴ UIC, France

martin@eticasconsutling.com

**Abstract.** This paper provides the results of the privacy impact assessment conducted for the PROACTIVE solutions and its subsequent privacy by design integration process. PROACTIVE is a solution for fostering coordination and communication between stakeholders before and during CBRNe events focusing on providing guidance to vulnerable populations. Based on extensive fieldwork activities with practitioners and vulnerable groups, the results of the analysis reveal the main risk focus, including the need to filter data by competent authorities (data controllers) and potential solutions for each of them, which allow establishing standard procedures for systems used in similar contexts.

**Keywords:** Privacy by design, CBRNe technologies, Privacy impact assessment, Vulnerable groups.

# 1 Introduction

This article examines the issue of integrating privacy by design (PbD) into technological solutions and practices related to CBRNe preparedness and response, focusing on the management of vulnerable groups' data. This issue represents a challenge at two levels. Firstly, concerning frequent tensions between those protocols aimed at prioritizing data protection in CBRNe scenarios on the one hand and the active need for personal identifiers by first responders on the other. Secondly, those aspects regarding the need for ensuring accessibility and consent to enforce privacy rights, which may find an obstacle in the differential capacities and conditions held by vulnerable populations in these contexts.

These issues are addressed in light of a technological toolkit (PROACTIVE) aimed at supporting practitioners in managing large and diverse groups of people before and during Chemical, Biological, Radiological, Nuclear and explosive (CBRNe) events. The main goal of such technology is to enhance preparedness against and response to a CBRNe incident through harmonizing procedures between various categories of practitioners and better addressing the needs of vulnerable citizen groups [17].
Developed as part of the H2020 PROACTIVE project<fnref n="1" />, the analyzed system has three main components [11]. Firstly, a collaborative web platform for communication and exchange of best practices among Law Enforcement Agencies (LEAs). This Platform for LEAs will facilitate daily operations and response to a CBRNe incident. In particular, its crisis communication system will:

* house operational documents, SOPs and communication strategies,

* collate information about incidents in the local area in terms of type, potential numbers, vulnerabilities,

* speak to the broader public at the press of a button through live notifications,

* recognize and support vulnerable citizens, in terms of wheelchair support, visual guidance, mental health needs etc.

* provide detailed pre-incident information targeted at the vulnerable citizens.

Secondly, PROACTIVE includes a Modular App for Practitioners to facilitate daily operations and response of LEAs and First Responders to a CBRNe incident. Finally, the system counts on another Mobile App adapted to various vulnerable citizen categories and sharing pre-incident public information material. This way, the App will enable all the citizens to communicate in real-time and according to their needs.

As with other CBRNe solutions, PROACTIVE technologies will manage special categories of personal information, such as health or criminal data, which require proportional safeguards in their treatment. To do so, as the literature has pointed out, both by-design and socio-technical dimensions of data protection need to be properly addressed to ensure robust data security [21, 17]. However, we do not count on empirical studies addressing privacy impact and privacy by design (PbD) mechanisms in similar CBRNe technologies. This void is even more significant concerning research involving interaction between the police and vulnerable stakeholders using complex data governance tools. Based on the PROACTIVE case, this article seeks to fill this gap by providing an empirical-based model for privacy impact assessment [22], leading to privacy-by-design recommendations in similar contexts.

This article's qualitative methodology is based on a combination of technical analysis of the studied system and data collection techniques addressing privacy integration through actors' perceptions and technical gaps as presented by stakeholders interacting in CBRNe events from the PROACTIVE approach. This privacy impact assessment focused on the study of technical specifications through two main fieldwork phases. Firstly, two Tabletop exercises with vulnerable groups and practitioners (10 participants each), where a first response scenario, in particular a train CBRNe accident, was presented to assess potential tensions between privacy rights, technological solutions and security protocols. Secondly, a demonstration validation of the App's beta version involving both first responders and vulnerable populations (20 participants in the project's first demo) was conducted in Dortmund in May 2022 [15, 23]. Specific surveys and focus groups were held in this case. Participants were asked to provide

<footnote n="1">¹ This project has received funding from the European Union's Horizon 2020 under Grant Agreement n° 832981.</footnote>
their opinion about data treatment, associated benefits, risks and mitigation measures based on their interaction with the App or App concept. Content analysis was applied to these activities' results to identify and classify main privacy by design risks and solutions related to tested technologies. This ongoing examination allows us to capture the socio-technical interaction leading to better integration of PbD requirements.

## 2 Vulnerable Populations and Privacy Policies in CBRNe Contexts

Vulnerable populations face unique challenges in CBRNe scenarios, including a lack of specific communication protocols for them (sign language, for instance) during decontamination processes [9, 4], which can impact their physical and informational privacy. Along these lines, privacy-related challenges and risks are frequently overlooked in data protection design and policy decisions. There is growing privacy literature outside privileged categories of young, white, and cisgender, seeking to understand knowledge associated with privacy practices and their implications for vulnerable communities [6, 14].

However, the normative based analysis of privacy-related inequalities in the management of vulnerable populations has not been applied to the CBRNe domain. Moreover, as pointed out by McDonald & Forte [14] this perspective often fails to notice how “structural inequalities and experiences conspire to make privacy threats and practices fundamentally different, not better or worse”. Capturing this qualitative component of privacy breaches and understating power relations that lead to exploiting inequality in data management requires focusing on the experiences of those who are subject to privacy threats because of their race, religion, disability or class [13].

Following Helen Nissenbaum [16], we go beyond individual privacy to understand and analyze privacy as a function of norms in distinctive circumstances. In this framework, acceptability, particularly social expectations, must be considered in practices related to privacy violations [23]. Practices such as data sharing or access are shaped by how actors collectively define and value their rights and responsibility concerning personal data. Nissenbaum provides the example of healthcare domains where patients found it correct and legitimate to be asked for their data about sexual behaviors while they may consider the same that same inquiry inappropriate coming from other actors. Therefore, contextual integrity places social expectations and perceptions at the centre of privacy assessment.

In line with this perspective, scholars have raised concerns about the capacity of normative frameworks to capture inequalities derived from vulnerable conditions when dealing with personal identifiers, often focusing on socioeconomic factors [20]. This is particularly relevant in the context of an overwhelming exposure to accessible and, by extension, vulnerable technologies. Along these lines, empirical evidence on vulnerable populations' expectations, interests and knowledge regarding data protection needs to be translated into data protection requirements in specific CBRNe contexts. This can also provide avenues for vulnerable individuals and groups to give their views and
opinions on matters that are directly relevant to their lives but on which they may not
have been given the opportunity to comment before.

3 Privacy by Design in CBRNe Environments

There is scarce literature on privacy by design in CBRNe technologies. Most
references concern privacy-related consequences of CBRNe prevention events, for
instance, related to surveillance policies [19]. This is the case even though many
CBRNe preparedness and response protocols, often led by private organizations, are
subjected to strict data protection requirements and principles when implementing data-
intensive solutions to related events. Such requirements need to be considered from a
preventative perspective, as stated in Art. 25 GDPR "Data protection by design and by
default". According to the regulation: "Taking into account the state of the art, the cost
of implementation and the nature, scope, context and purposes of processing as well as
the risks of varying likelihood and severity for rights and freedoms of natural persons
posed by the processing", data controllers must implement before and during the
processing of personal data "appropriate technical and organizational measures, such
as pseudonymization, which are designed to implement data-protection principles, such
as data minimization, in an effective manner and to integrate the necessary safeguards
into the processing in order to meet the requirements of this Regulation and protect the
rights of data subject." (Art. 25 GDPR).

The above preventative perspective within the regulation follows the core principles of the Privacy by Design (PbD) approach to technological design and development. This approach seeks to guarantee that data security mechanisms are considered and embedded in the design phase of any system, service, product or process and then throughout the data lifecycle [3]. By implementing protocols such as those mentioned in the GDPR, including data pseudonymization, developers and implementers should therefore consider privacy needs as part of the technical design while considering the potential impacts of the systems at hand on individuals' privacy [16]. The philosophy of PbD is structured around a group of seven 'foundational principles' [3]:

I. Proactive not Reactive/Preventative not Remedial or PbD anticipates and prevents privacy invasive events before they happen.

II. Privacy as the Default Setting or No action is required on the part of the individual to protect their privacy — it is built into the system, by default.

III. Privacy Embedded into Design or Privacy is integral to the system, without diminishing functionality.

IV. Full Functionality/Positive-Sum, not Zero-Sum or PbD avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both.

V. End-to-End Security/Full Lifecycle Protection or PbD ensures that all data is securely retained and then securely destroyed at the end of the process, in a timely fashion.
VI. Visibility and Transparency — Keep it Open Privacy by Design aims at ensuring that all relevant information about data processing grounds and goals is available allowing independent verification.

VII. Respect for User Privacy — Keep it User-Centric.

The need to develop effective tools to implement and translate PbD principles into technical specifications and engineering practices, such as Privacy Enforcement Technologies (PET) has been stressed [18]. PET provides functionalities such as data breach alerts or firewalls, to ensure adequate and proactive action is taken to guarantee personal data integrity. Control over personal data is also achieved by integrating subsystems to assure data minimization, correct anonymization and consent of those involved [1,8]. Other PET methods include software or protocols enabling data unlinkability (relevant data cannot be linked to any other group of relevant data outside its context), transparency (management of personal data is accessible for interested parties) and intervenability (a guaranteed intervention of subjects involved in processing their data to ensure that corrective measures or access rights can be exercised) [7].

As mentioned by Urruela Mora [21], in the exceptional circumstances of CBRNe events, “data are likely to be collected without the data subjects’ consent, under highly stressful conditions, in the absence of normal infrastructure, and in the midst of political and legal uncertainty”. In this framework, PbD aspects become even more relevant but have still been relegated to a secondary level of importance. Additionally, challenges in implementing common frameworks and international data protection standards in CBRNe scenarios have been underlined [10].

# 4 The PROACTIVE Solution: Specifications and Data Management

The PROACTIVE toolkit includes three solutions, its platform and two apps targeted to practitioners and citizens. This section will briefly describe each system's characteristics and data management in the current prototype.

## 4.1 The PROACTIVE Platform

The collaborative platform will include an Online Coordination Portal allowing bi-directional communication between LEAs and security-based policy makers via direct messaging and forums. Text, images, videos, audio files and PDF documents will be exchanged through the platform [11].

LEAs and Policymakers will be able to upload and download these data, and the platform will enable them to create an FAQ page with useful advice about the website itself or about particular situations in their area. Moreover, it will enable LEAs and policymakers to provide/ signpost users to other relevant sites/ contacts for helpful information, for example, accommodation, help lines, charities etc.
<figure><img src="image_3.png" /><figcaption>Fig. 1. PROACTIVE web prototype. Source: https://proactive-app.net/</figcaption></figure>

Additionally, the platform will have restricted access via a registration method and will include two types of users with their corresponding security levels, namely ‘Admin and User’. Both Admin and User(s) will be able to customize the tool according to the context of a specific scenario (location - map-based), the type of incident and the policies required for particular events [11].

The system will use a GIS-based backend for the geo-located data gathered, enabling GIS-oriented data storage, management and analysis. Users will select their preferred location when they log. The LEAs will be reliant on a map to record incidents, manage/allocate resources and potentially record images of the specific incidents on a map. Personal data collected and shared by LEAs and practitioners, as well as information collected by citizens, including vulnerable populations, before and after the event, will include valid email addresses, organization, name/ position and location of users.

The platform must be available via the Police Secure networks. Therefore, it will need to be certified and tested by Police IT & Digital teams to meet stability and security standards. In line with these specifications, LEAs will likely be data controllers of the system in most cases.

## 4.2 Mobile Application for LEA's and Policy Makers

The LEAs App will offer the same functionalities as the platform, including customization and geolocated data. The App, used by LEAs and policy makers, will allow bi-directional Communication between them via direct messaging and forums and include extended functionalities for vulnerable citizens. LEA's and policy makers will, therefore, be able to upload, download and also remove data, including personal information.

The Mobile Application will be administered by LEA's and policy makers. The App will have restricted access via a registration method and only one level of access: User.
The content and credibility of the information will be up to the LEA's and Policy makers. In line with these specifications, it is likely that LEAs will be data controllers of the system in most cases. First Responders, who will be provided with access to some information will possibly act as data processors on behalf of the police.

The App must provide an option to view and validate any content uploaded to the portal and the ability to report and see an incident at a specific location using a map. Furthermore, it will give the users and vulnerable groups useful advice about the website itself or about particular situations in their area via an FAQ page, and signpost users to other relevant sites/ contacts for useful information, for example, accommodation, helplines or charities. The LEA's will be reliant on a map to record incidents, manage/ allocate resources and potentially record images of the specific events on a map.

The modular App administers relevant -and sensitive- information about incidents and includes references about its characteristics and management. Voice, text, video, images and PDF documents will be shared by practitioners and other stakeholders to dispatch emergency-related information to First Responders, providing the capability to access and exchange personal data about populations affected by CBRNe events. In this way, the app will allow access to sensitive information about CBRNe incidents and communities in real time. Emergency-related information will be uploaded directly with citizens (push effect), and other LEA's/ Policy Makers pre-incident, real-time and post-incident using multiple media options.

## 4.3 Mobile App for Vulnerable Citizens

This App will allow vulnerable citizens to communicate with other citizens, LEAs and security policymakers by selecting, configuring and adapting their preferred tools according to their needs and preferences. Vulnerable citizens will be able to download and -with filter- upload data (pdf, videos, images, audio files). The App will be administered by the corresponding data controller (LEAs or authority in charge) and will have two access levels: Registered User (which enables citizens to report emergencies and view information) and Non-registered users, which enables citizens to view information but not report. Data to be processed include personal data shared by authorized users, including LEAs, public authorities and vulnerable groups using the application, such as CBRNe events' images, videos or voice.

The App provides video (for sign language support), real-time text, text-to-speech features and an intuitive user experience environment, with smart buttons and visual instructions to report emergencies and associate device data. It will be able to receive automated early warnings issued by authorities. Considering VoIP, emergency web portals, softphones and social media platforms, the system provides broad accessibility and the ability to report an incident at a specific location using a map.

It will include various settings for accessibility, including Font Size & Type, Colour of Screen to support colour blindness, no flashing images to reduce issues with epilepsy, audio options/ voice control for the visually impaired/ or those with dyslexia, and sign language videos for those with limited hearing [17]. It is expected that the App uses
novelty (e.g., cartoon characters, pictograms or symbols) where appropriate to reduce
the issue of language barriers.

The App will enable the user to select their preferred location when they log in.
Moreover, it will provide the citizens with useful advice about the website itself or
about particular situations in their area via an FAQ page. Included on this page will be
a section prompting the information to be provided during an incident, such as the route
to the event or medical symptoms. Lastly, it will signpost users to other relevant sites/
contacts for useful information, for example, accommodation, helplines or charities and
will reference existing apps (providing links where possible).

## 4.4 System Logical Topology, Security and Interoperability

The three PROACTIVE components will work interconnected by feeding and receiving data stored in the controller databases. Figure 1 shows the logical topology of an example single server deployment of the Proactive Application. The top half of the diagram shows the supported devices & web browsers (Safari, Firefox & Google Chrome), which allow the users to connect to the Server via a secure HTTPS connection. The bottom half of the diagram shows the connections & relationships between the installed components on the server:

<figure><img src="image_4.png" /><figcaption>Fig. 2. PROACTIVE Linux based server. Source: [11].</figcaption></figure>

The system will enforce the following security protocols by integrating SQL Data
Protected by Full Drive Encryption: aes-xts 256. It will also provide Client-Server
communication protected by Transport Layer Security (HTTPS). The System access is
controlled by application-level authorization. Unauthorized users (not logged in) and
members of the public may not view sensitive information or edit publicly accessible
information directly. In addition, API Key authorization will be available for external
integrations. Concerning system interoperability, the PROACTIVE platform exposes a
secure REST API that allows external systems to integrate.
## 5 PROACTIVE High-level Data Protection Requirements

The PROACTIVE technology has been generally framed by requirements of the General Data Protection Regulation (GDPR) [5]. Law Enforcement Agencies (LEAs) will use the PROACTIVE toolkit when processing personal data, but not always for the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal penalties. This distinction means that Directive (EU) 2016/680 of the European Parliament and the Council (known as the Police Directive) and National law enforcement regulations will apply to PROACTIVE data management only in specific circumstances. In this framework, attending to data protection principles and requirements embedded within the GDPR is even more relevant for the PROACTIVE solutions.

As already pointed out, PROACTIVE will process protected categories of data as defined in the GDPR (Art. 9.1), such as health data. The gathering and management of these data will be oriented to preparedness in case of CBRNe incidents and also include the management of further sensitive data (pictures, video, etc.) once these events occur. The toolkit must therefore ensure the rights of the most vulnerable groups in society in case of a CBRNe incident following the Respect for User Privacy principle.

In line with Art. 9 GDPR, processing sensitive information, which may also include race or disability data, requires the establishment of specific security safeguards. The integrity and confidentiality (Article 5.1,f) of personal data must be ensured both through by-design strategies and once the PROACTIVE technologies are implemented. Measures to avoid both unauthorized access and data breaches are multiple and range from correct anonymization of data-to-data erasure, respecting the data minimization principle. Security strategies to prevent personal data misuse or abuse are an essential aspect of data protection legislation and the GDPR (Article 32.1). This involves producing systematic security assessments which must be adapted to the PROACTIVE specific processes and performance.

The system must embed data minimization (Article 5.1,c). PROACTIVE must collect the minimum amount of personal data needed to achieve its purposes. These goals include increasing practitioner effectiveness in the management of a large group of people in CBRNe, enhancing preparedness against and response to these events and facilitating subsequent decontamination procedures by better articulating the different needs of stakeholders. Taking into account these aims, the set of legitimate and technically required purposes of the processing should be delimited in advance.

Other methods for securing data in the GDPR are pseudonymization and anonymization. Following Article 4(5) GDPR, pseudonymization should be applied when enabling the purposes of data collection and is in line with the protocols or technological systems at hand. Pseudonymized data is data that can no longer be attributed to a specific data subject without the use of additional information (iii). Following this principle, PROACTIVE tools pseudonymization personal data should ensure that additional information can be kept separately. It should also be subjected to technical and organizational measures to ensure that the personal data are not attributed
to an identified or identifiable natural person. Other data security measures suggested in the GDPR include encryption, access control and password protection.

Data breaches should be prevented proactively both in terms of data governance and technological design. The GDPR Article 33.1 mandates to notify data subjects about data breaches without undue delay and, where possible, "not later than 72 hours after having become aware of it". Since CBRNe attacks are often accompanied by personal data breaches and fake news dissemination, the strategy for coping with these breaches should have a holistic perspective. Notifying breaches in PROACTIVE should be integrated into a broader scope of action and address the relations to "external" stakeholders such as the media or organizations representing vulnerable persons. Although the GDPR does not specifically determine how notifications have to be produced, PROACTIVE must ensure effective communication strategies concerning data breaches. Moreover, Article 33.5 mandates properly registering personal data breaches, including all relevant information about the infringement, such as data subjects involved and remedial actions. Additional measures to be made by the data controller in case of breaches include notification to the supervisory authority as mandated in Article 34.1.

Moreover, following Article 5.1 (d), GDPR, efforts must be made to ensure that the information collected and provided by processors and controllers is accurate. Accuracy involves both classical methods for enhancing data quality, such as proper classification or erasure methodologies, but also protocols for guaranteeing the veracity of provided data. The App should also incorporate a mechanism for assessing and filtering fake news or untrustable collected information, including subsystems for avoiding algorithmic discrimination. These mechanisms also include forms of ensuring that data subjects can ask the controller to erase or rectify the data that it has regarding them (Arts. 16, 17 GDPR). Although non-trustable data that does not involve personal data is out of the scope of GDPR, it is still relevant for PROACTIVE efficiency and aims.

Finally, PROACTIVE should also consider Article 5.1(e) on storage limitation. The systems must not keep personal data collected before and after a CBRNe incident for any longer than is reasonable for achieving the purposes for which they were collected in the first place. These original purposes, which may include providing better guidance to vulnerable groups, will determine the legal and legitimate data retention period. Still, the rationale behind data storage must be accompanied by a proportionate and rationally justifiable data storage policy in all cases.

# 6 Assessing and Integrating Privacy by Design into PROACTIVE

This section describes the principal risks identified during this process based on inputs provided by practitioners and vulnerable populations during fieldwork. Practitioners and interviewed vulnerable individuals, manifested or showed different issues concerning data protection, focusing on knowledge needed to ensure privacy and access control. Based on these inputs and the technical assessment of the system, the
following table presents the leading solutions for integrating the above privacy-by-design principles and data protection requirements into the PROACTIVE technologies. It also systematizes critical solutions and recommendations for ensuring three pillars of PbD, data security, access controls and data protection.

<table><caption>**Table 1.** Identified risks, applicable PbD principles and associated solutions</caption><thead><tr><th>Main identified risks</th><th>Applicable data protection and PbD principles</th><th>Corresponding PbD solutions and enhancing technologies (both implemented and to be implemented)</th></tr></thead><tbody><tr><td>Potential of the apps for collecting large amounts of nonfunctional and sensitive personal data from end users, users and also data subjects related to events (i.e., pictures taken during an event).</td><td>Data minimization, Lawfulness, fairness and transparency (Art. 5 GDPR). Proactive not Reactive, Privacy Embedded into Design</td><td><strong>Reducing the amount of (sensitive) data collected by the system:</strong><ul><li>Users of the platform and mobile apps will be required to provide a valid email address only.</li><li>The Mobile app will allow for both registered and anonymous users.</li><li>In the case of the App for vulnerable populations, precise location information in the incident map will be replaced by “areas” to minimize privacy risks associated with the use of the app. Maps must be designed in such a way that no particular home or address can be identified (granularity of event data).</li></ul></td></tr><tr><td>Lack of access control leading to unauthorized access to data and programs; shutdown or misuse of the systems. It could worsen one key risk identified by end users in fieldwork activities: the spreading of misinformation.</td><td>Data integrity (Art. 5 GDPR). Proactive not, Reactive. Privacy as the Default Setting</td><td><strong>Ensuring that only authorized users access personal data:</strong><ul><li>Access control levels are provided according to 4 profiles: public user, LEA, Emergency Responder and Military. End users will be restricted and require permissions by the parent organization.</li><li>Two factor authentication is used. It includes hashed IDs, usernames and passwords (user secret known). CAPTCHAs are employed to protect users from spam and password decryption.</li><li>A system to check users' credentials, so this can be monitored, will be developed. It will include specific tools and protocols for mapping and registering logs to the system to be integrated into the platform. This would facilitate that they can be revoked if needed.</li><li>Encrypt both communications and data before algorithmic processing to ensure that only authorized users access these data.</li></ul></td></tr></tbody></table>
Data security in PROACTIVE involves the above measures to protect information from unauthorized access, but also from corruption, or theft throughout its entire lifecycle.

PROACTIVE needs to ensure transparency and informed consent, which should be adapted to vulnerable groups in terms of accessibility

Data integrity (Art. 5 GDPR). Proactive not Reactive. Privacy as the Default Setting

Accountability; Lawfulness, fairness and transparency (Art. 5 GDPR). Visibility and Transparency; Respect for User Privacy — Keep it User-Centric.

Sensitive personal data will be directly collected and shared through the public mobile app (i.e., pictures taken during an event). This could lead to several issues such as discrimination

Lawfulness, fairness and transparency. Data integrity, Accuracy, (Art. 5 GDPR). Proactive not Reactive. Privacy as the Default Setting

## Protecting PROACTIVE personal data from attacks:

* All data collected, stored, processed and retrieved by the system will be held and transferred through highly secure communication systems to prevent loss, damage or unauthorized access.

* NoSQL database technologies will be used for data storage and management. All personal data will be stored on encrypted volumes.

* Federation of the PROACTIVE App for vulnerable groups directly with other apps will be avoided to prevent privacy and security issues.

## Guaranteeing informed consent from app users:

* The Apps/Web platform integrates appropriate functionalities for informed consent, already included in its *privacy policy*<fnref n="2" />. These tools will determine the eligibility of the person who will use the systems (+ 18 years old, competent authority, etc.). It ensures clear and conspicuous notice by thoroughly explaining the proposed uses of the data. All purposes for data processing, the nature of the processing and whether personal data will be shared with partners (if it will be), are among the provided details. All data used by the App from the mobile phone, including geolocation, will be included.

* Given the nature of the App for vulnerable groups, such as children or people with specific disabilities, accessibility will be ensured and an assent protocol will be integrated directly into the app.

## End users/data controllers should filter/monitor sensitive data

* Integrate an algorithmic subsystem to classify images and text as objectionable, detect them and avoid their exchange. Following the GDPR to automated profiling of data subjects Article 22(1) and (4), algorithms for filtering disinformation and detecting fake news or illegal data could be considered for ensuring automated identification of threats and problematic data [2, 24].

* Include a system to catalog received information according to the source. In particular, tools for filtering data sources, and

<footnote n="2">² See at: https://proactive-app.net/privacy</footnote>
or false
positives.

Anticipating
data breaches to
minimize their
impact on
users.

Data integrity
(Art. 5 GDPR).
Proactive not
Reactive.
Privacy as the
Default Setting

notifications for the removal of dispensable
information should be integrated.

Managing data breach events

* Data breaches should be prevented proactively both in technological design. In this regard, the backup functionality should also allow "freezing" a snapshot of the system over a certain period once a data breach may be integrated into the system.

Source: own elaboration.

7 Discussion and Conclusions

Assessing core privacy by design and data protection principles through interaction with practitioners and potential users of the PROACTIVE technologies allowed us to identify key data protection risks concerning each step of the data life cycle. Requirements on users' data to be collected by the platform and the apps are aligned with the data minimization and purpose limitation principles since only email and names are collected. They also are proportional to the aim and features of the systems. Within the set of data to be provided by users, including email address, organization, name/position and location, all are justified under the purposes of the processing. Following the definition of “personal data” in the GDPR, which includes location data, specific minimization measures have been considered.

A second aspect addressed relates to the capacity of end users to access sensitive information. This risk required enforcing access control, particularly in relation to ongoing monitoring and registration of the activity. Moreover, the analysis of data exchanges revealed that users could upload images, videos or audio of events containing sensitive data about third parties. This entailed implementing by-design measures to ensure data privacy by making the data controller able to filter significant amounts of data and restricting the circulation of certain information, which could even increase the impact of CBRNe events. This data is not shared with the public unless it has been verified by the LEA responsible for the PROACTIVE Web Based platform and Mobile Applications.

Each action of managers and users should be registered, as well as rectified or modified
data during the data breach response process. Once the system is implemented, a crisis
simulation with the intervention of vulnerable groups within the implementation area
should be conducted. In particular, it is recommended to perform a tabletop exercise
where the incident response team addresses a data breach process, testing their
performance. In this way, problems can be identified without interrupting the App
workflow. The evaluation of the need for a Data Protection Impact Assessment (as
mandated in Article 35.1 GDPR) must be based on the characteristics and the amount
of personal data to be processed as well as on the integration of new technologies to
personal data processing.
Even though the above may correspond to standard PbD solutions, some singularities particularly affecting CBRNe-inclusive technology have been spotted in the privacy impact assessment process. This includes existing issues with misinformation before and during CBRNe events [23], releasing of sensitive data, and issues with accessibility which automated or manual management of personal data by competent authorities must address. It is important to note that future iterations following the planned project workshops and field exercises may alter how data is captured and used. The ethical and legal implications will always be referenced, and an updated privacy policy will be provided if necessary.

## 8. References

1. Borking J & Raab C.: "Laws, PETs and Other Technologies for Privacy Protection", Refereed article, *The Journal of Information, Law and Technology (JILT)*, I (2001).

2. Bunker D, Mirbabaie M, Stieglitz S.: "Convergence Behaviour of Bystanders: An Analysis of 2016 Munich Shooting Twitter Crisis Communication". In: *Proceedings of the Australasian Conference on Information Systems* (2017).

3. Cavoukian, A.: *Privacy by Design. The 7 Foundational Principles Implementation and Mapping of Fair Information Practices* (2009). Available online: https://www.ipc.on.ca/wp-content/uploads/resources/pbd-implement-7found-principles.pdf

4. Chen, Jing; Diana Wilkinson, Richard B. Richardson, Barbara Waruszynski: "Issues, considerations and recommendations on emergency preparedness for vulnerable population groups, Radiation Protection Dosimetry", 134, 3-4, 132-135 (2009).

5. Galdon Clavell, G., Valbuena Leon, M. A., Zamorano M., Marsh, I.: *Legal and Ethical State-of-the-Art on CBRNe preparedness and response. Deliverable D8.1 of the PROACTIVE project* (2021).

6. Guberek, T., A. McDonald, S. Simioni, A.H. Mhaidli, K. Toyama, and F. Schaub.: "Keeping a low profile? Technology, risk and privacy among undocumented immigrants". In *Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems*, 114:1-114:15. New York, NY: CHI (2018).

7. Hansen, M.: "Top 10 mistakes in system design from a privacy perspective and privacy protection goals, Privacy and Identity for Life", 375: 14-31. *IFIP International Federation for Information Processing*, Springer (2012).

8. Heurix, Johannes; Zimmermann, Peter; Neubauer, Thomas; Fenz, Stefan: "A taxonomy for privacy enhancing technologies". *Computers & Security*. 53: 1-17 (2015).

9. Hignett, S., Hancox, G. and Edmunds Otter, M.: "Chemical, biological, radiological, nuclear and explosive (CBRNe) events: Systematic literature review of evacuation, triage and decontamination for vulnerable people", *International Journal of Emergency Services*, 8, 2, 175-190 (2019).

10. Jillson, I.A.: "Ethical Frameworks for CBRNE Crises: Toward Shared Concepts and Their Practical Application". In: O'Mathúna, D., de Miguel Beriain, I. (eds) *Ethics and Law for Chemical, Biological, Radiological, Nuclear & Explosive Crises. The International Library of Ethics, Law and Technology*, 20. Springer, Cham (2019).

11. Kolev, George; Garik Markarian, Nataly Polushkina: *Deliverable 4.1. Report on the High-level Architecture design including an interface control document. PROACTIVE* (2021). Available at https://proactive-h2020.eu/wp-content/uploads/2021/04/PROACTIVE_20210312_D4.1_V6_RINI_Report-on-the-high-level-architecture-design_revised.pdf

12. Lambert, P.: *The Data Protection Officer: Profession, Rules, and Role*. CRC Press (2016).
13. Marwick, A., C. Fontaine, and Danah Boyd: "Nobody sees it, nobody gets mad": Social media, privacy, and personal responsibility among low-SES youth. *Social Media + Society* 3, 2 (2017).

14. McDonald, N., Forte, A.: "Privacy and Vulnerable Populations". In: Knijnenburg, B.P., Page, X., Wisniewski, P., Lipford, H.R., Proferes, N., Romano, J. (eds) *Modern Socio-Technical Perspectives on Privacy*. Springer, Cham (2022).

15. Nicholson, W., Hall, C., Weston, D., Burlin, A., Marsh, I., Zamorano, M., Amlot, R., Carter, H.: *Report on the Workshop with Vulnerable Citizens. Deliverable D3.3 of the PROACTIVE project* (2021). Available from: https://www.researchgate.net/publication/360106969_CBRNe_toolkit_for_policy_makers_integrating_vulnerable_groups_in_preparedness_and_response [accessed Jul 28 2022].

16. Nissenbaum, H.: *Privacy in Context: Technology, Policy, and the Integrity of Social Life*. Stanford Law Books (2010).

17. Petersen, L., Havarneanu, G., Markarian, G., & McCroneline, N.: CBRNe and vulnerable citizens: Co-creating an app for that. In *2019 International Conference on Information and Communication Technologies for Disaster Management (ICT-DM)* (pp. 1-4). IEEE (2019).

18. Rubinstein, Ira & Good, Nathan: "Privacy by Design: A Counterfactual Analysis of Google and Facebook Privacy Incident". *Berkeley Technology Law Journal* 1333, *NYU School of Law, Public Law Research* Paper No. 12-43 (2012).

19. Toohey, K. & Taylor, T.: "Surveillance and securitization: A forgotten Sydney Olympic legacy". *Int Rev Sociol Sport* 47(3): 324–337 (2012).

20. Urban, J.M. & Hoofnagle, C.J.: *The privacy pragmatic as privacy vulnerable*. Technical report #ID 2514381. Social Science Research Network (2014).

21. Urruela Mora, A.: "The Current Legal Framework on Data Protection in CBRNE Crises: A General Exposition". In *Ethics and Law for Chemical, Biological, Radiological, Nuclear & Explosive Crises*, 147-161. Springer, Cham (2019).

22. Wright, D., & De Hert, P. (Eds.): *Privacy impact assessment*. Dordrecht: Springer (2012).

23. Zamorano, M., Suarez Gonzalo, S., Clavell Galdon, G.: *Legal and acceptability recommendations for PROACTIVE toolkit*. Deliverable D8.2 of the PROACTIVE project (2021). Available from: https://www.researchgate.net/publication/360106969_CBRNe_toolkit_for_policy_makers_integrating_vulnerable_groups_in_preparedness_and_response

24. Zannettou, S., Sirivianos, M., Blackburn, J. & Kourtellis, N.: "The Web of False Information: Rumors, Fake News, Hoaxes, Clickbait, and Various Other Shenanigans", *Data and Information Quality*, 11(3) (2019).