RESUMEN
The EU's General Data Protection Regulation (GDPR) has recently come into effect and insofar as Internet of Things (IoT) applications touch EU citizens or their data, developers are obliged to exercise due diligence and ensure they undertake Data Protection by Design and Default (DPbD). GDPR mandates the use of Data Protection Impact Assessments (DPIAs) as a key heuristic enabling DPbD. However, research has shown that developers generally lack the competence needed to deal effectively with legal aspects of privacy management and that the difficulties of complying with regulation are likely to grow considerably. Privacy engineering seeks to shift the focus from interpreting texts and guidelines or consulting legal experts to embedding data protection within the development process itself. There are, however, few examples in practice. We present a privacy-oriented, flow-based integrated development environment (IDE) for building domestic IoT applications. The IDE enables due diligence in (a) helping developers reason about personal data during the actual in vivo construction of IoT applications; (b) advising developers as to whether or not the design choices they are making occasion the need for a DPIA; and (c) attaching and making available to others (including data processors, data controllers, data protection officers, users and supervisory authorities) specific privacy-related information that has arisen during an application's development.
RESUMEN
This paper outlines the IoT Databox model as a means of making the Internet of Things (IoT) accountable to individuals. Accountability is a key to building consumer trust and is mandated by the European Union's general data protection regulation (GDPR). We focus here on the 'external' data subject accountability requirement specified by GDPR and how meeting this requirement turns on surfacing the invisible actions and interactions of connected devices and the social arrangements in which they are embedded. The IoT Databox model is proposed as an in principle means of enabling accountability and providing individuals with the mechanisms needed to build trust into the IoT.
RESUMEN
In this paper we examine the notion of privacy as promoted in the digital economy and how it has been taken up as a design challenge in the fields of CSCW, HCI and Ubiquitous Computing. Against these prevalent views we present an ethnomethodological study of digital privacy practices in 20 homes in the UK and France, concentrating in particular upon people's use of passwords, their management of digital content, and the controls they exercise over the extent to which the online world at large can penetrate their everyday lives. In explicating digital privacy practices in the home we find an abiding methodological concern amongst members to manage the potential 'attack surface' of the digital on everyday life occasioned by interaction in and with the networked world. We also find, as a feature of this methodological preoccupation, that privacy dissolves into a heterogeneous array of relationship management practices. Accordingly we propose that 'privacy' has little utility as a focus for design, and suggest instead that a more productive way forward would be to concentrate on supporting people's evident interest in managing their relationships in and with the networked world.
RESUMEN
We present fieldwork findings from the deployment of an interactive sensing system that supports the work of energy advisors who give face-to-face advice to low-income households in the UK. We focus on how the system and the data it produced are articulated in the interactions between professional energy advisors and their clients, and how they collaboratively anticipate, rehearse, and perform data work. In addition to documenting how the system was appropriated in advisory work, we elaborate the 'overhead cost' of building collaborative action into connected devices and sensing systems, and the commensurate need to support discrete workflows and accountability systems to enable the methodical incorporation of the IoT into collaborative action. We contribute an elaboration of the social, collaborative methods of data work relevant to those who seek to design and study collaborative IoT systems.