IoT and Data Protection

The Internet of Things entails the collection, processing and generation of various types of data. Among these, many fall under the definition of personal data, triggering the applicability of a comprehensive legal framework regulating personal data processing, devised to protect individuals against the risks it poses to their rights and freedoms. This chapter provides an overview of how European Union data protection law applies in the IoT context. It discusses the importance of the existence of the fundamental rights to privacy and to the protection of personal data and then delves into the two main instruments of secondary legislation regulating personal data processing: the General Data Protection Regulation and the Directive on Privacy and Electronic Communications. Keeping in mind the IoT context, it presents key obligations of developers, data controllers and processors and the rights granted to users with regards to their personal data. While the legal framework has the characteristics of an omnibus law that applies regardless of the sector and context of processing, the heterogeneity of IoT applications, architectures and contexts entails that different risks, protection and compliance concerns may be raised in different contexts. Thus, the chapter also discusses wearable devices, connected toys, smart cities and connected cars as examples of key IoT application domains presenting privacy and data protection challenges.