Privacy Engineering for Domestic IoT: Enabling Due Diligence

Area of Science:

• Computer Science
• Software Engineering
• Information Security

Background:

• The General Data Protection Regulation (GDPR) mandates Data Protection by Design and Default (DPbD) for Internet of Things (IoT) applications involving EU citizens' data.
• Developers often lack the expertise to navigate complex privacy regulations and implement effective privacy management, increasing compliance challenges.
• Existing approaches rely heavily on legal interpretation and consultation, rather than integrating privacy directly into the software development lifecycle.

Purpose of the Study:

• To introduce a novel privacy-oriented, flow-based integrated development environment (IDE) for domestic IoT application development.
• To facilitate developers' due diligence in managing personal data and privacy considerations throughout the IoT application development process.
• To assist developers in identifying the necessity for Data Protection Impact Assessments (DPIAs) and documenting privacy-related information.

Main Methods:

• Development of a specialized IDE designed for privacy-aware IoT application construction.
• Integration of features to help developers reason about personal data during in vivo development.
• Implementation of advisory mechanisms for DPIA triggers and tools for attaching privacy documentation.

Main Results:

• The IDE enables developers to actively consider personal data during IoT application design and development.
• It provides guidance on when Data Protection Impact Assessments (DPIAs) are required based on design choices.
• The system facilitates the creation and accessibility of privacy-related information for various stakeholders.

Conclusions:

• The developed IDE effectively supports privacy engineering principles by embedding data protection into the IoT development workflow.
• It addresses the practical challenges faced by developers in complying with GDPR's DPbD and DPIA requirements.
• This approach shifts privacy management from external interpretation to an integral part of the software development process.