Search

Article 35 of the General Data Protection Regulation (GDPR) states that data controllers are required to carry out data protection impact assessment (DPIA) if a processing operation, particularly involving the use of new technologies, is ‘likely to result in a high risk to the rights and freedoms of natural persons’. The focus in this paper is on the role and responsibilities of data controllers in a smart city platform in assessing ‘high risk’ and the importance of impact assessment in relation to data processing with the latest technologies for the protection of personal data.

Internet of Things (IoT) connects sensing devices to the Internet for the purpose of exchanging information. Location information is one of the most crucial pieces of information required to achieve intelligent and context-aware IoT systems. Recently, positioning and localization functions have been realized in a large amount of IoT systems. However, security and privacy threats related to positioning in IoT have not been sufficiently addressed so far. In this paper, we survey solutions for improving the robustness, security, and privacy of location-based services in IoT systems. First, we provide an in-depth evaluation of the threats and solutions related to both global navigation satellite system (GNSS) and non-GNSS-based solutions. Second, we describe certain cryptographic solutions for security and privacy of positioning and location-based services in IoT. Finally, we discuss the state-of-the-art of policy regulations regarding security of positioning solutions and legal instruments to location data privacy in detail. This survey paper addresses a broad range of security and privacy aspects in IoT-based positioning and localization from both technical and legal points of view and aims to give insight and recommendations for future IoT systems providing more robust, secure, and privacy-preserving location-based services. publishedVersion

We are living in an inter-connected, global digital society where the services of different operating systems are universal in nature, but many Internet activities are still being tackled by national laws and regulations. A long-existing question is which law is applicable in cases of Internet activities because the online world does not have any physical boundaries. How the European Union (EU) approaches this duality has become a concern for data protection laws. By analysing some recent Court of Justice of the European Union case laws, this article seeks to discover how the EU data protection law tackles disputes involving transnational issues online, which includes its extra-territorial application and cross-border data transfers. The article also indicates that there is an enormous gap between legislation and practice.