Privacy Management in Smart Cities

Size: px

Start display at page:

Download "Privacy Management in Smart Cities"

Donald Morton
6 years ago
Views:

1 Privacy Management in Smart Cities Antonio Kung 26/04/2017 Data management and citizens privacy in smart cities open governance 1

Introduction Speaker Antonio Kung, Trialog (www.trialog.

Security and privacy fabric Rapporteur ISO SC27 Privacy in smart cities Privacy guidelines in the IoT Member PRIPARE support action

2 Introduction Speaker Antonio Kung, Trialog ( Engineering background - CTO Involved in standardisation Editor ISO Privacy engineering Contributor ISO Big data Security and privacy fabric Rapporteur ISO SC27 Privacy in smart cities Privacy guidelines in the IoT Member PRIPARE support action (pripareproject.eu) Handbook (March 7 th 2016 Press release) Methodological Tools to Implement Privacy and Foster Compliance with the GDPR 26/04/2017 Data management and citizens privacy in smart cities open governance 2

3 Privacy from a Policy Maker Viewpoint A demand side vision 26/04/2017 Data management and citizens privacy in smart cities open governance 3

4 Deals with Complex Ecosystems Smart Cities IoT Smart grid Health Security Safety Big data Transport Privacy Ecosystems Domains Concerns 26/04/2017 Data management and citizens privacy in smart cities open governance 4

5 Must take into account General Data Protection Regulation (GDPR) May 25th 2018 Data controllers Data processors Data Protection Officers All public authorities Companies processing more than 5000 data subjects Sanctions for breaches up to 20,000,000 EUR up to 4% of the annual worldwide turnover 26/04/2017 Data management and citizens privacy in smart cities open governance 5

6 Must understands these terms Privacy-by-design: PbD Institutionalisation of privacy management Integration of privacy concern in the engineering of systems Privacy-by-default Highest level of protection by default Privacy Impact assessment: PIA Process that evaluates impact on privacy Note that the GDPR uses the term data protection instead of privacy 26/04/2017 Data management and citizens privacy in smart cities open governance 6

7 Must Manage Privacy in Complex Ecosystem Municipality stakeholder Requests Give consent Citizen PIA Data Controller Contracts Agreements For data exchange Agree Data processor Comply Privacy Obligations Integrator Apply PIA and PbD Purpose known Supplier Apply Requirements Purpose unknown 26/04/2017 Data management and citizens privacy in smart cities open governance 7

Privacy impact assessment 1 Privacy impact

Supplier - Purpose unknown Sensor Device

Security module OS Middleware 26/04/2017

8 Supply Chain EIP-SCC Citizen Focus IoT Vision: Supply Chain Smart City Officer Privacy impact assessment 1 Privacy impact assessment 2 Operator Smart City Application 1 Operator Smart City Application 2 Integrator - Purpose known Supplier - Purpose unknown Sensor Device Smart device Cloud solution Electronics Security module OS Middleware 26/04/2017 Data management and citizens privacy in smart cities open governance 8

9 Big Data Vision : Sharing Chain Smart City Officer Data collecting Data sharing agreement Data transformation Data sharing agreement Data analytics Sharing Chain 26/04/2017 Data management and citizens privacy in smart cities open governance 9

10 Several Types of Concerns Stakeholder Legal Compliance Concern Management Concern System Lifecycle Concern Demand side Policy maker Compliance Check Transparency Supply side Operator Data Controller Operator Data processor Supplier Regulation GPDR Privacy Impact Assessment PIA Sharing Agreement Operators Requirements Privacy-by- Design PbD 26/04/2017 Data management and citizens privacy in smart cities open governance 10

11 Privacy Impact Assessment Risk sources Consequences Focus of privacy Personal data processing Focus of privacy Impact assessment (PIA) Impact on citizen s privacy Privacy breach Threats and vulnerability of system Focus of security Impact on organisation Focus of business impact assessment 7-8/03/2017 Sharing Cities GDPR Workshop Slide 11

12 Privacy-by-design PIA Process PIA Iteration PIA Iteration Privacy Principles Analysis Privacy Requirements Design Privacy controls Architecture PETs Privacy-by-design Lifecycle Process 7-8/03/2017 Sharing Cities GDPR Workshop 12

13 Example: Sharing Cities 26/04/2017 Data management and citizens privacy in smart cities open governance Slide 13

14 Sharing Cities work on GDPR Compliance H2020 lighthouse project ( 24 million grant Cities: London, Milan, Lisbon, Bordeaux, Burgas, Warsaw Program March 2017 Workshop on GDPR Use case London Use case Milan Use case Lisbon June 2017 Workshop on PIAs Further Applying a management plan for GDPR compliance 26/04/2017 Data management and citizens privacy in smart cities open governance 14

15 Next steps Common work on privacy management 26/04/2017 Data management and citizens privacy in smart cities open governance Slide 15

16 Guidelines for GDPR Compliance Privacy management plan Governance scheme Roles and duties Data controllers Data processors Suppliers Resources Management Repository of PIAs and data sharing agreements Interaction with citizens Transparency (dashboard) Complaints Breach management Continuous improvement Templates PIA template Data sharing agreement template Privacy notice template Supplier privacy support description template 26/04/2017 Data management and citizens privacy in smart cities open governance 16

17 Standardisation? General Privacy Standards Privacy framework Privacy impact assessment Privacy engineering (new) Code of practice Privacy Information management systems (new) Privacy Standards for IoT Guidelines for Things? Privacy Standards for Big Data Security and privacy fabric Privacy Standards for Smart Cities Guidelines for privacy management?

18 Thanks 26/04/2017 Data management and citizens privacy in smart cities open governance Slide 18

Standards and privacy engineering ISO, OASIS, PRIPARE and Other Important Developments

Standards and privacy engineering ISO, OASIS, PRIPARE and Other Important Developments Antonio Kung, CTO 25 rue du Général Foy, 75008 Paris www.trialog.com 9 May 2017 1 Introduction Speaker Engineering