Compliance with data protection regulations is a crucial obligation for organizations, as violations can result in substantial regulatory fines. In the European Union, the General Data Protection Regulation defines personal data and establishes specific requirements for its protection. To ensure compliance, organizations must identify all tasks in their business processes whose execution involves personal data and establish appropriate security measures whenever changes in business processes, regulations, or technologies occur. Manual identification can be labor-intensive and error-prone, especially in large organizations where business processes change frequently. Textual business process descriptions, such as work instructions, provide valuable insights into organizational processes and the types of data involved. They can be used as the basis for an approach to automatically identify GDPR-critical tasks, i.e., tasks in which personal data is transmitted, stored, or otherwise processed. However, existing data sets of business process descriptions are too small to effectively train current natural language processing models. Therefore, this paper uses large language models to create a new synthetic data set of business process descriptions. Subsequently, several BERT variants are fine-tuned to automatically identify GDPR-critical tasks. An evaluation of the data set shows that the generated business process descriptions are of sufficient quality and useful for model training. The following evaluation of the proposed approach demonstrates strong performance in identifying GDPR-critical tasks. Hence, the approach supports regulatory compliance decisions by identifying affected tasks, thereby facilitating the targeted implementation of compliance measures.
The sharing of consumer data within the Internet of Things (IoT) is currently generating substantial revenue for supply chain participants. Manufacturers collect consumer data through smart devices and share it with IoT platforms to improve technical service delivery. This practice not only enables manufacturers to gain deeper insights into consumers but also raises concerns about consumer privacy. This study employs a game-theoretic model to investigate how the IoT platform’s data-driven service pricing mechanisms and consumer privacy concerns influence data-sharing decisions. The findings are as follows: First, the data-driven strategy remains relatively stable under a usage fee pricing model, regardless of the decision-maker. In contrast, under a flat fee pricing model, data-sharing strategies are significantly influenced by the identity of the decision-maker. Furthermore, when consumer privacy is a major concern, decision-making outcomes consistently lead to lower results, regardless of the decision-maker’s identity. These findings offer important practical implications for organizations within the IoT supply chain, providing valuable insights to enhance decision-making processes related to platform operations and enterprise digital transformation.
Advances in Machine Learning (ML) have led organizations to increasingly implement ML decision aids to enhance employees’ decision-making performance. While such systems can improve organizational efficiency in many contexts, they may inadvertently impact the development of human decision-making skills. Drawing on cognitive theories, this study examines how the use of ML decision aids impact skill development and performance. Using a novel experimental design tailored to address organizational challenges and endogeneity concerns, the study identifies causal effects of reliance on ML predictions on skill development in decision making. Specifically, it is demonstrated that reliance on ML predictions in a prediction-making task can hinder the development of critical decision-making skills, resulting in significant performance drops when the system becomes unavailable. Furthermore, it is found that the extent of trust in the system's predictions strongly influences the severity of this skill deficit. These findings highlight the need for thoughtful integration of ML decision aids, emphasizing the importance of balancing reliance with skill retention to mitigate risks associated with temporary or permanent system disruptions.
