Normative Challenges of Identification in the Internet of Things: Privacy, Profiling, Discrimination, and the GDPR

Abstract

In the Internet of Things (IoT), identification and access control technologies provide essential infrastructure to link data between a user's devices with unique identities, and provide seamless and linked up services. At the same time, profiling methods based on linked records can reveal unexpected details about users' identity and private life, which can conflict with privacy rights and lead to economic, social, and other forms of discriminatory treatment. A balance must be struck between identification and access control required for the IoT to function and user rights to privacy and identity. Striking this balance is not an easy task because of weaknesses in cybersecurity and anonymisation techniques. The EU General Data Protection Regulation (GDPR), set to come into force in May 2018, may provide essential guidance to achieve a fair balance between the interests of IoT providers and users. Through a review of academic and policy literature, this paper maps the inherit tension between privacy and identifiability in the IoT. It focuses on four challenges: (1) profiling, inference, and discrimination; (2) control and context-sensitive sharing of identity; (3) consent and uncertainty; and (4) honesty, trust, and transparency. The paper will then examine the extent to which several standards defined in the GDPR will provide meaningful protection for privacy and control over identity for users of IoT. The paper concludes that in order to minimise the privacy impact of the conflicts between data protection principles and identification in the IoT, GDPR standards urgently require further specification and implementation into the design and deployment of IoT technologies.

IoT-based safety monitoring from the perspective of construction site workers

“…The GDPR also aims at harmonizing fragmented data protection practices across EU countries. As the use of IoT technologies is growing, GDPR standards require further investigation and specifications regarding the design and implementation of IoT technologies in order to minimize conflicts between GDPR and deployment of IoT-enabled solutions (Wachter, 2018).…”

Reconciliation of Privacy with Preventive Cybersecurity: The Bright Internet Approach

“…Over the past two decades, many countries have used FIPs to develop regulation and as a foundation for national privacy policies. Among such privacy policies, the European Union's GDPR has the most comprehensive jurisdiction (Politou et al 2018;Wachter 2018).…”

Nudging citizens through technology in smart cities

“…Privacy concerns also arise from the technological challenges connected to the separation between urban and personal data. These concerns arise here from the increasingly detailed methods of profiling and the deficient existing anonymization tools which may facilitate the re-identification of individuals from aggregate and anonymized data (van Zoonen 2016;Wachter 2018). In this context, the protection of privacy of individuals in smart cities refers not only to the dimension of protecting access to data but also to a second dimension: the knowledge which is inferred from the collected data (van Otterlo 2014).…”

“…The interoperability of devices allows public bodies to have a good perception of how the city lives. Nevertheless, despite claims that cameras and microphones are mostly used for crowd management and that information will be anonymized, the risk of profiling lurks around the corner (Wachter 2018). While a data-driven nudge may not be as intrusive as other forms of policy intervention, the risk of discrimination in nudging is real as profiling techniques may result in personalized nudges embedded in stereotypes.…”