DPIA in Context: Applying DPIA to Assess Privacy Risks of Cyber Physical Systems

Jane Henriksen-Bulmer, Shamal Faily and Sheridan Jeary
Additional contact information
Jane Henriksen-Bulmer: Department of Computing & Informatics, Bournemouth University, Fern Barrow, Poole BH12 5BB, UK
Shamal Faily: Department of Computing & Informatics, Bournemouth University, Fern Barrow, Poole BH12 5BB, UK
Sheridan Jeary: Department of Computing & Informatics, Bournemouth University, Fern Barrow, Poole BH12 5BB, UK

Future Internet, 2020, vol. 12, issue 5, 1-23

Abstract: Cyber Physical Systems (CPS) seamlessly integrate physical objects with technology, thereby blurring the boundaries between the physical and virtual environments. While this brings many opportunities for progress, it also adds a new layer of complexity to the risk assessment process when attempting to ascertain what privacy risks this might impose on an organisation. In addition, privacy regulations, such as the General Data Protection Regulation (GDPR), mandate assessment of privacy risks, including making Data Protection Impact Assessments (DPIAs) compulsory. We present the DPIA Data Wheel, a holistic privacy risk assessment framework based on Contextual Integrity (CI), that practitioners can use to inform decision making around the privacy risks of CPS. This framework facilitates comprehensive contextual inquiry into privacy risk, that accounts for both the elicitation of privacy risks, and the identification of appropriate mitigation strategies. Further, by using this DPIA framework we also provide organisations with a means of assessing privacy from both the perspective of the organisation and the individual, thereby facilitating GDPR compliance. We empirically evaluate this framework in three different real-world settings. In doing so, we demonstrate how CI can be incorporated into the privacy risk decision-making process in a usable, practical manner that will aid decision makers in making informed privacy decisions.

Keywords: contextual integrity; privacy; risk; Data Protection Impact Assessment; DPIA; General Data Protection Regulation; GDPR (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2020
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (2)

Downloads: (external link)
https://www.mdpi.com/1999-5903/12/5/93/pdf (application/pdf)
https://www.mdpi.com/1999-5903/12/5/93/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:12:y:2020:i:5:p:93-:d:362400

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().