Daniel J. Solove’s ‘Taxonomy of Privacy Invasions’191
|
Information Collection
|
Information Processing
|
Information Dissemination
|
Invasion
|
Surveillance
Interrogation
|
Aggregation
Identification
Insecurity
Secondary Use
Exclusion
|
Breach of Confidentiality
Disclosure
Exposure
Increased Accessibility
Blackmail
Appropriation
Distortion
|
Intrusion
Decisional Interference
|
Explanation of Elements192
|
The first group of activities that affect privacy involves information collection.
Surveillance is the watching, listening to, or recording of an individual's activities.
Interrogation consists of various forms of questioning or probing for information.
|
A second group of activities involves the way information is stored, manipulated, and used.
Aggregation involves the combination of various pieces of data about a person.
Identification is linking information to particular individuals.
Insecurity involves carelessness in protecting stored information from leaks and improper access.
Secondary use is the use of information collected for one purpose for a different purpose without the data subject’s consent.
Exclusion concerns the failure to allow the data subject to know about the data that others have about them and participate in its handling and use.
|
The third group of activities involves the dissemination of information.
Breach of confidentiality is breaking a promise to keep a person’s information confidential.
Disclosure involves the revelation of truthful information about a person that impacts the way others judge their character.
Exposure involves revealing another’s nudity, grief, or bodily functions.
Increased accessibility is amplifying the accessibility of information.
Blackmail is the threat to disclose personal information.
Appropriation involves the use of the data subject’s identity to serve the aims and interests of another.
Distortion consists of the dissemination of false or misleading information about individuals.
|
The fourth and final group of activities involves invasions into people’s private affairs.
Invasion, unlike the other groupings, need not involve personal information (although in numerous instances, it does). Intrusion concerns invasive acts that disturb one’s tranquillity or solitude.
Decisional interference involves the government’s incursion into the data subject’s decisions regarding their private affairs.
|
How does this apply to the Internet of Things?193
|
Interrogation is not relevant.
Surveillance is a big privacy violation risk in the IoT. We will interact with hundreds of sensors daily, each picking up ‘crumbs’ of information as we go about our lives. Traditional surveillance concerns like CCTV are now more intimate with IoT in our homes and in our bodies.
|
Many of these areas are regulated by information privacy law. Most fall within the scope of ‘Big Data’ and not ‘IoT’ per se.
Aggregation of smart things is essential for a fluent IoT ecosystem, and information processing is essential to ‘sync’ every ‘thing’ up around your life. Identification and Insecurity are discussed in separate sections of this report.
|
The areas most relevant to IoT are disclosure, increased accessibility and appropriation. Intimate data is collected seamlessly and if misused, can prove embarrassing, destructive or even fatal.
IoT data is captured and processed by algorithms and humans to form accurate inferences. However, it can also be used to make inaccurate, misleading inferences that can impact consumers.
|
IoT is very vulnerable to privacy invasion. Advanced IoT ecosystems are designed to collect information subtlety (sometimes covertly) and ‘in the background’ - making it easy for consumers to have their data collected without informed consent.
Decisional Inference is one of IoT’s biggest opportunities and risks. Accurate data will spur a golden age of convenience and automation, but misuse will spur a golden age of surveillance, privacy intrusion and intrusive or misleading behavioural inferences.
|