The valuable insights that can be inferred from analytics of data generated and collected from a variety of devices and applications are transforming businesses and are therefore one of the key motivations for organisations to adopt such technologies. Nevertheless, the data being analysed and processed are highly sensitive and put the individuals’ rights to privacy at risk. With the imminent arrival of the European General Data Protection Regulation (GDPR), companies are coerced to adopt privacy enhancing technologies that, on the one hand, protect data to ensure their clients’ privacy and on the other hand, allow their processing while keeping them meaningful, useful, and protected at the same time. The PAPAYA project aims at addressing the privacy concerns when data analytics tasks are performed by untrusted third-party data processors. Since these tasks may be performed obliviously on protected data (i.e. encrypted data), the PAPAYA will design and develop dedicated privacy preserving data analytics primitives that will enable data owners to extract valuable information from this protected data, while being cost-effective and accurate. The PAPAYA project will consider compliance with the GDPR as a key enabler to provide solutions that minimize the privacy risks while increasing trust in third-party data processors by means of auditing and visualization modules (a dashboard). The PAPAYA primitives as well as the dashboard will be combined in an integrated platform that will be designed, implemented and validated through a set of use cases reflecting relevant real world applications (namely, healthcare analytics and web & mobile data analytics).

Accelerated digitalisation in health sector brings opportunities for cost-effective and efficient delivery of personalised care, through medical devices (including software) connected to IT networks and increasingly combined with novel technologies (AI, cloud computing, blockchain or 5G networks) and simultaneously Europe is witnessing an increase in the complexity and sophistication of attacks threatening such critical infrastructure. CYLCOMED addresses the overall ambitious goal of strengthening the cybersecurity of connected, in vitro diagnostic and software as medical devices (CMDs, IVDs, SaMD), maintaining their performance and safety for patients and preserving or enhancing the confidentiality, integrity and availability of private data they exchange or allow to be remotely accessed and focusing on humans operating the technology as the weakest link in the chain for security and privacy, with training and awareness measures tailored to healthcare staff needs. It does so by enabling adoption by all ecosystem stakeholders of technologically sovereign and trustworthy cybersecurity methodologies and toolboxes for connected medical devices and the environments in which they are managed and operate (platforms), complemented with fit-for-purpose guidance covering identifed risks and gaps. It will further deliver: (i) risk assessment framework with risk benefit analyses schemes and (ii) toolbox addressing cybersecurity risks and gaps in connected medical devices;(iii) assessment and extension of baseline standards, best practices and guidelines covering challenges for CMDs including SW, making them fit for purpose when used in conjunction with novel technologies; (iv) demonstrations and case studies in relevant on premise hospital scenarios (COVID-19 patients monitoring) and remote telemonitoring scenarios improving the life of paediatric patients. CYLCOMED has 9 partners from 7 EU Member States and 1 associate partner from Switzerland and a duration of 36 months.