Privacy Engineering for Domestic IoT: Enabling Due Diligence

Abstract

The EU’s General Data Protection Regulation (GDPR) has recently come into effect and insofar as Internet of Things (IoT) applications touch EU citizens or their data, developers are obliged to exercise due diligence and ensure they undertake Data Protection by Design and Default (DPbD). GDPR mandates the use of Data Protection Impact Assessments (DPIAs) as a key heuristic enabling DPbD. However, research has shown that developers generally lack the competence needed to deal effectively with legal aspects of privacy management and that the difficulties of complying with regulation are likely to grow considerably. Privacy engineering seeks to shift the focus from interpreting texts and guidelines or consulting legal experts to embedding data protection within the development process itself. There are, however, few examples in practice. We present a privacy-oriented, flow-based integrated development environment (IDE) for building domestic IoT applications. The IDE enables due diligence in (a) helping developers reason about personal data during the actual in vivo construction of IoT applications; (b) advising developers as to whether or not the design choices they are making occasion the need for a DPIA; and (c) attaching and making available to others (including data processors, data controllers, data protection officers, users and supervisory authorities) specific privacy-related information that has arisen during an application’s development.

Privacy Laws and Privacy by Design Schemes for the Internet of Things

“…DPbD supports system security, along with a range of data protection measures, for example, data minimisation, pseudonymisation, and transparency. While the legal requirement for DPbD should be enough of an incentive for developers to accept its core principles, its widespread adoption has not yet been proven with regard to engineering processes [30]. This could be because its principles are rather disconnected from the real-life practice of systems engineering.…”

“…This could be because its principles are rather disconnected from the real-life practice of systems engineering. In addition, it can be difficult to translate between the some of the vague terminology contained in the regulations [30]. The meaning of the concepts of Privacy by Design and by Default developed by Cavoukian and GDPR is similar, but they differ in regard to structure.…”

“…The controller of the mobile application has to maintain privacy policies as they are an essential aspect that involves data subjects, users, and aspects of processing; furthermore, it is crucial to follow the laws that stipulate those policies. Privacy patterns 10,11,15,20,21,30,36,37,39,45 and 59 all focus on solving privacy issues in regard to privacy policies. Since privacy policies usually tend to be complex and long, these privacy patterns are concerned about balancing these policies with regard to accessibility, alongside being comprehensive from a legal perspective.…”

“…Furthermore, they do not just rely on the users, which is an important part of the processing, but also implement the laws that mandate these policies. Privacy patterns 10,11,15,20,21,30,36,37,39,45 and 59 all concentrate on solving the privacy issues addressed in privacy policies. This is because privacy policies typically tend to be complicated and very long.…”

“…Privacy by Design (PbD) [27] is a fairly new system that works to embed privacy practice more deeply and effectively into the development process [30,59]. REGULATION (EU) 2016/679 General Data Protection Regulation (GDPR) [1] confirms the importance of this and is applicable to all systems that manage personal data processing -a common feature of IoT applications.…”