IoT Interfaces, Location and Privacy · Study deck

IoT Privacy: User Rights and Privacy by Design

A user agreed to a clear purpose and the product collects only what it needs.

UX Uma is your guide for this deck.

privacyuserconsent
UX Uma, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: the battery explained: "Sammy, imagine if someone followed YOU around writing down everything you did -- where you went at recess, who you talked to, what you ate for lunch.
  • Explain: The worked export includes cloud clips, sleep analytics, and device logs, so the request cannot be answered from one database table or screen alone.
  • Explain: Scenario: A smart baby monitor startup must implement GDPR-compliant consent for their video/audio streaming product sold in the EU.
  • Explain: You now know how proactive design, privacy defaults, embedded controls, transparency, and user-centric choices translate into IoT architecture.
iotclass.org

Major section

User Rights in IoT Systems

IoT systems must implement mechanisms to fulfill these rights.

  • A user starts with Download My Data, but the system must verify identity before gathering the requested scope.
  • The worked export includes cloud clips, sleep analytics, and device logs, so the request cannot be answered from one database table or screen alone.

Key terms

Portability
Portability is achieved when the record can move and retain its meaning, not merely when a download button produces bytes.
User rights request workflow showing intake, identity verification, scope, review, fulfill, respond, evidence, and follow-up trigger.
User rights request workflow showing intake, identity verification, scope, review, fulfill, respond, evidence, and follow-up trigger.
iotclass.org

Major section

Checkpoint: Rights Handling

You now know why access, erasure, portability, restriction, and objection need workflows across device, gateway, cloud, backup, and processor systems.

  • You now know why deletion must cover production records, backup rotation, third-party processors, device caches, and user-visible timelines.
  • Rights workflows prove whether privacy controls survive beyond the dashboard.
  • The next design question is how to embed those controls before launch instead of bolting them on after complaints.
iotclass.org

Major section

Checkpoint: Privacy by Design

You now know how proactive design, privacy defaults, embedded controls, transparency, and user-centric choices translate into IoT architecture.

  • You now know why a Privacy Impact Assessment must challenge sensors, data flows, necessity, risks, mitigations, and documentation before release.
  • Privacy by Design sets the architecture.
  • The next section stress-tests that architecture against the ambient, inferential, and multi-party realities of connected spaces.

Why it matters

You now know why aggregate goals should use technical controls that prevent unnecessary individual tracking capability.

iotclass.org

Major section

GDPR Consent for Baby Monitors

Freely Given: Each optional feature has independent checkbox (not bundled).

  • Scenario: A smart baby monitor startup must implement GDPR-compliant consent for their video/audio streaming product sold in the EU.
  • Setup screen shows: "To use BabyCam Pro, you agree to our Privacy Policy and Terms of Service. [Continue]".
  • Sleep insights will stop.

Key terms

Account closure
Account closure is separate.".
iotclass.org

Major section

GDPR Consent for Baby Monitors (continued)

Confirmation dialog explains: "We will delete personal data in specified circumstances, subject to exceptions.

  • Not Freely Given: Consent bundled with service—can't use monitor without agreeing to everything.
  • Not Specific: Single "agree to all" for 4 different data uses.
  • Informed: Plain language explains what, who, how long.
  • Account closure is separate.".
iotclass.org

Major section

Deep dive: Lawful Basis for IoT Data

GDPR requires one of six lawful bases for processing personal data.

  • Using Legitimate Interest for Surveillance: ✗ "We have legitimate interest to record all your conversations for product improvement".
  • Using Contract Performance for Marketing: ✗ "You bought our thermostat, so we can email you ads".
  • Problem: Marketing is NOT necessary to fulfill the contract.
iotclass.org

Major section

For Kids: Meet the Sensor Squad!

"No way!" said Sammy. "That would be creepy!".

  • The Sensor Squad had built an amazing classroom helper that tracked how much each student participated.
  • "Hey!" said student Maya. "I didn't say you could watch me all day!
  • If Maya says no, she should still get the same education.
iotclass.org

Major section

For Kids: Meet the Sensor Squad! (continued)

Temperature Terry was confused. "But I'm helping the teacher know who needs more encouragement!".

  • the battery explained: "Sammy, imagine if someone followed YOU around writing down everything you did -- where you went at recess, who you talked to, what you ate for lunch.
  • the LED added the most important rule: "And 'No' must be a real option!
  • Consent means you have a REAL choice, not 'agree or else!'".
iotclass.org

Deck summary

Key takeaways

IoT systems must implement mechanisms to fulfill these rights.

  • You now know why access, erasure, portability, restriction, and objection need workflows across device, gateway, cloud, backup, and processor systems.
  • You now know how proactive design, privacy defaults, embedded controls, transparency, and user-centric choices translate into IoT architecture.
  • Freely Given: Each optional feature has independent checkbox (not bundled).
  • Confirmation dialog explains: "We will delete personal data in specified circumstances, subject to exceptions.
iotclass.org

Retrieval practice

Recall check 1 of 5

UX Uma says: answer from memory, then check your reasoning.

Q1A user exercises their GDPR right to erasure ('right to be forgotten') with a smart home company. The company deletes their account data from the production database. Three months later, the user discovers their data still exists in the company's backup systems and was shared with a cloud analytics provider. What should the company have done?

AThe company complied correctly - backup retention for disaster recovery is a legitimate exception to the right to erasure
BDelete from all systems including backups within a reasonable timeframe, and notify all third-party processors to delete the user's data
CDelete from production database, retain backups for maximum legal retention period, but inform the user of the backup retention timeline
DOnly delete from production - third-party processors are responsible for their own GDPR compliance
Show answer

Answer: B GDPR Article 17(2) requires controllers to 'take reasonable steps' to inform other controllers processing the data of the erasure request.

iotclass.org

Retrieval practice

Recall check 2 of 5

UX Uma says: answer from memory, then check your reasoning.

Q2A user wants to switch from SmartWatch Brand A to Brand B. Under GDPR's data portability right, Brand A provides step counts, heart rate measurements, and sleep data in a structured, commonly used, machine-readable format with their units and timestamps. It omits its proprietary derived 'wellness score'. Is that omission compliant?

ANo - all data derived from the user's activity must be included, including algorithmic outputs
BNo - Brand A must also provide the algorithm so Brand B can calculate the same score
CYes, but only if Brand A uses an open data format that Brand B can import
DYes - data portability covers raw data provided by the user, not derived insights or algorithmic outputs
Show answer

Answer: D provided by the data subject.

iotclass.org

Retrieval practice

Recall check 3 of 5

UX Uma says: answer from memory, then check your reasoning.

Q3During a Privacy Impact Assessment for a smart city traffic monitoring system, the team identifies that license plate recognition could enable tracking individual vehicles across the city. The project manager argues: 'We're only using it for aggregate traffic flow analysis, not individual tracking.' How should the privacy team respond?

AAccept the explanation - if the stated purpose is aggregate analysis, individual tracking capability is not a concern
BRequire technical controls that discard plate identifiers and release only necessary aggregate traffic counts
CReject license plate recognition entirely - any capability for individual identification is unacceptable
DDocument the risk and proceed - traffic optimization benefits outweigh privacy concerns
Show answer

Answer: B If the task needs aggregate traffic flow, process plate observations into counts and discard individual identifiers before storage or release.

iotclass.org

Retrieval practice

Recall check 4 of 5

UX Uma says: answer from memory, then check your reasoning.

Q4A research team publishes a dataset of 'anonymized' smart meter readings from 5,000 homes. They removed all customer IDs and addresses, keeping only timestamps and energy consumption values. A privacy researcher claims this data can be re-identified. Which attack is most likely to succeed?

ADictionary attack - trying common names and addresses against the dataset
BSQL injection - exploiting database vulnerabilities to extract hidden customer information
CCorrelation attack - matching unique consumption patterns to outside facts
DMan-in-the-middle attack - intercepting the data transfer to capture customer IDs before anonymization
Show answer

Answer: C Electricity consumption patterns can be highly identifying when combined with outside information.

iotclass.org

Retrieval practice

Recall check 5 of 5

UX Uma says: answer from memory, then check your reasoning.

Q5What tells users which data is collected, why and with whom before they decide?

ANotice
BPurpose
CChoice
DEnforcement
Show answer

Answer: A It tells the user what is collected, why, and with whom before the decision.

Q6Complete the consent form validation for an IoT privacy dashboard:

Aconst optionalBoxes = [...form.querySelectorAll('[data-purpose="optional"]')];
Bconst optionalBoxes = form.querySelector('[data-purpose="optional"]');
Cconst optionalBoxes = form.optionalOnly();
Dconst optionalBoxes = document.cookies;
Show answer

Answer: A GDPR consent requires an affirmative action, so optional consent boxes must start unchecked and be selected by the user.

iotclass.org

Print reference

Answers 1 of 2

Answer key.

  1. B · GDPR Article 17(2) requires controllers to 'take reasonable steps' to inform other controllers processing the data of the erasure request.
  2. D · provided by the data subject.
  3. B · If the task needs aggregate traffic flow, process plate observations into counts and discard individual identifiers before storage or release.
  4. C · Electricity consumption patterns can be highly identifying when combined with outside information.
  5. A · It tells the user what is collected, why, and with whom before the decision.
iotclass.org

Print reference

Answers 2 of 2

Answer key.

  1. A · GDPR consent requires an affirmative action, so optional consent boxes must start unchecked and be selected by the user.
iotclass.org