Developing GDPR Compliant Apps for the Edge

Abstract

We present an overview of the Databox application development environment or SDK as a means of enabling trusted IoT app development at the network edge. The Databox platform is a dedicated domestic platform that stores IoT, mobile and cloud data and executes local data processing by third party apps to provide end-user control over data flow. Key challenges for building apps in edge environments concern (i) the complexity of IoT devices and user requirements, and (ii) supporting privacy preserving features that meet new data protection regulations. We examine how the Databox SDK can ease the burden of regulatory compliance and be used to sensitize developers to privacy related issues in the very course of building apps.

`I Consent to These Terms’: A Legal and Technical Approach for Obtaining Valid Consent in Solid

“…As previously explained in Section 2.2, access to resources in Solid depends on authentication and authorization protocols. Access can be granted by data subjects when they start using a new application, through an authorization dialogue, such as the example provided in Figure 2 20 , or can be pre-set in the Pod in advance, such as the example provided in Figure 3 21 . Both options can take various forms, depending on the technical access control mechanism that is implemented in the server where the Pod is hosted, as the servers are not obliged to implement both authorization protocols (WAC and ACP) promoted by Solid, as was previously discussed in Section 2.2, and on the interfaces used to interact and manage the data and the access grants on the Pod.…”

“…In what concerns the requirement that processing is lawful (Article 6 [1]), the usage of other lawful grounds for processing beyond consent [15,19] or dealing with access to special categories of personal data [20] remain up for discussion.…”

Privacy in the Internet of Things: Where do We Stand? A Systematic Literature Review

“…Lodge et al [145] provide an application environment or SDK to enable developing a GDPR [46] compliant trusted IoT application. First, they identify key challenges of building IoT applications as follows: the complexity of IoT devices with user requirements, and the collection and processing of user data according to the privacy regulations.…”

Personal information management systems: a user-centric privacy utopia?

“…• Users having granular control over the data captured about them, and how that data is shared and used (Article 29 Data Protection Working Party 2014; Crabtree et al, 2018;Urquhart et al, 2019); • Better protecting personal data (including 'sensitive' personal data) from access by third parties, by way of the technical functionality provided (Crabtree et al, 2018;Lodge et al, 2018); • Better informed user consent, by giving more information about data processing. This may be through various means, including the device's monitoring functionality; the app's data usage specifications; platform features, such as app stores ranking and describing app data usage, requiring transparency best practices, etc.…”