Normative challenges of identification in the Internet of Things: Privacy, profiling, discrimination, and the GDPR
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Article 20's right to data portability, permitting the transfer of personal data, can affect algorithmic accuracy and confidentiality, potentially influencing the larger dataset.
“Similarly, Article 20's right to data portability, permitting the transfer of personal data, can affect algorithmic accuracy and confidentiality, potentially influencing the larger dataset.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Article 21's right to object enables individuals to halt data processing, ensuring data minimization and protecting against data misuse.
“Article 21's right to object enables individuals to halt data processing, ensuring data minimization and protecting against data misuse.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Article 22 of GDPR prohibits automated decisions if they produce significant effects.
“Article 22, crucial in the context of AI, prohibits automated decisions if they produce significant effects.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Article 22-4 prohibits using sensitive data for automated decisions, with an exception.
“Article 22-4 prohibits using sensitive data for automated decisions, with an exception.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Non-sensitive data can act as proxies for sensitive data, leading to possible unlawful discrimination.
“Similarly, non-sensitive data can act as proxies for sensitive data, leading to possible unlawful discrimination [161].”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Article 22-2 provides exceptions, allowing automated decisions if they are contractually necessary, legally authorized with safeguards, or based on explicit consent.
“Article 22-2 provides exceptions, allowing automated decisions if they are contractually necessary, legally authorized with safeguards, or based on explicit consent.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Sexual orientation can be inferred from seemingly unrelated data like activity or likes.
“For instance, sexual orientation can be inferred from seemingly unrelated data like activity or likes.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
AI can infer sensitive data from non-sensitive data, potentially leading to unauthorized processing.
“Yet, AI can infer sensitive data from non-sensitive data, potentially leading to unauthorized processing.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [161]
Cites
Context Aware Computing for The Internet of Things: A Survey
Perera, C., Zaslavsky, A., Christen, P., & Georgakopoulos, D. (2014) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.042313.00197 · Cited by 2,861 · see citing works
A survey on trust management for Internet of Things
Yan, Z., Zhang, P., & Vasilakos, A. V. (2014) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2014.01.014 · Cited by 1,155 · see citing works
Dynamic consent: a patient interface for twenty-first century research networks
Kaye, J., Whitley, E. A., Lund, D., Morrison, M., Teare, H., & Melham, K. (2015) · European Journal of Human Genetics · doi:10.1038/ejhg.2014.71 · Cited by 780 · see citing works
Huckvale, K., Prieto, J. T., Tilney, M., Benghozi, P.-J., & Car, J. (2015) · BMC Medicine · doi:10.1186/s12916-015-0444-y · Cited by 376 · see citing works
Student privacy in learning analytics: An information ethics perspective
Rubel, A., & Jones, K. M. L. (2014) · The Information Society · doi:10.1080/01972243.2016.1130502 · Cited by 203 · see citing works
Ethical Issues of Social Media Usage in Healthcare
Bamidis, P., Bond, C., Gabarron, E., Househ, M., Lau, A. Y. S., Mayer, M. A., Merolli, M., Hansen, M., & Denecke, K. (2015) · Yearbook of Medical Informatics · doi:10.15265/iy-2015-001 · Cited by 199 · see citing works
Internet of things: Privacy issues revisited
Weber, R. (2015) · Computer Law and Security Review · doi:10.1016/j.clsr.2015.07.002 · Cited by 187 · see citing works
From individual to group privacy in big data analytics
Mittelstadt, B. (2017) · Philosophy & Technology · doi:10.1007/s13347-017-0253-7 · Cited by 184 · see citing works
Ethics of the health-related internet of things: a narrative review
Mittelstadt, B. (2017) · Ethics and Information Technology · doi:10.1007/s10676-017-9426-4 · Cited by 154 · see citing works
Mantelero, A. (2016) · Computer law & security review · doi:10.1016/j.clsr.2016.01.014 · Cited by 149 · see citing works
Welsh, S., Hassiotis, A., O'mahoney, G., & Deahl, M. (2003) · Aging & Mental Health · doi:10.1080/1360786031000150658 · Cited by 109 · see citing works
Big Data, Big Problems: Emerging Issues in the Ethics of Data Science and Journalism
Fairfield, J., & Shtein, H. (2014) · Journal of Mass Media Ethics · doi:10.1080/08900523.2014.863126 · Cited by 89 · see citing works
Privacy, Discovery, and Authentication for the Internet of Things
Wu, D. J., Taly, A., Shankar, A., & Boneh, D. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-45741-3_16 · Cited by 70 · see citing works
Who Needs Stories if You Can Get the Data? ISPs in the Era of Big Number Crunching
Hildebrandt, M. (2011) · Philosophy & Technology · doi:10.1007/s13347-011-0041-8 · Cited by 40 · see citing works
The Privacy Coach: Supporting customer privacy in the Internet of ThingsPreprint
Broenink, G., Hoepman, J.-H., Hof, C. C. G. V. T., van Kranenburg, R., Smits, D., & Wisman, T. H. A. (2010) · arXiv (Cornell University) · doi:10.48550/arxiv.1001.4459 · Cited by 27 · see citing works
Demystifying privacy in sensory data: A QoI based approach
Chakraborty, S., Choi, H. S., & Srivastava, M. B. (2011) · IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomw.2011.5766914 · Cited by 24 · see citing works
Privacy Challenges in Context-sensitive Access Control for Pervasive Computing Environment
Ahamed, S. I., Talukder, N., & Haque, M. M. (2007) · International Conference on Mobile and Ubiquitous Systems: Networking and Services · doi:10.1109/mobiq.2007.4451065 · Cited by 15 · see citing works
Managing Disclosure of Personal Health Information in Smart Home Healthcare
Rashid, U., Schmidtke, H., & Woo, W. (2007) · Interacción · doi:10.1007/978-3-540-73281-5_20 · Cited by 15 · see citing works
Flagged first, then by citations
11 of the 29 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Ismagilova, E., Hughes, L., Rana, N. P., & Dwivedi, Y. K. (2020) · Information Systems Frontiers · doi:10.1007/s10796-020-10044-1 · Cited by 487 · see citing works
“Wachter (2018) argues that GDPR standards need further specification and implementation into the design of IoT technologies.”
BackgroundA Right to Reasonable Inferences: Re-Thinking Data Protection Law in the Age of Big Data and AI
Wachter, S., & Mittelstadt, B. (2018) · doi:10.31228/osf.io/mu2kf · Cited by 463 · see citing works
Self-citationAhmad, K., Maabreh, M., Ghaly, M., Khan, K., Qadir, J., & Al-Fuqaha, A. (2022) · Computer Science Review · doi:10.1016/j.cosrev.2021.100452 · Cited by 291 · see citing works
A critical review of algorithms in HRM: Definition, theory, and practice
Cheng, M. M., & Hackett, R. D. (2021) · Human Resource Management Review · doi:10.1016/j.hrmr.2019.100698 · Cited by 283 · see citing works
Discrimination, artificial intelligence, and algorithmic decision-making
Borgesius, F. Z. (2025) · arXiv · doi:10.48550/arxiv.2510.13465 · Cited by 152 · see citing works
“See for instance: Goodman 2016; Mantelero 2018; Hacker 2018; Hoboken and Kostic (forthcoming); Wachter 2018; Wachter and Mittelstadt 2018.”
Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond
Nasir, S., Khan, R. A., & Bai, S. (2024) · IEEE Access · doi:10.1109/access.2024.3369912 · Cited by 152 · see citing works
“Similarly, non-sensitive data can act as proxies for sensitive data, leading to possible unlawful discrimination [161].”
BackgroundNudging citizens through technology in smart cities
Ranchordás, S. (2019) · International Review of Law Computers & Technology · doi:10.1080/13600869.2019.1590928 · Cited by 140 · see citing works
“Nevertheless, despite claims that cameras and microphones are mostly used for crowd management and that information will be anonymized, the risk of pro fi ling lurks around the corner (Wachter 2018).”
BackgroundMethodInfluentialEthical issues in learning analytics: a review of the field
Tzimas, D., & Demetriadis, S. (2021) · Educational Technology Research and Development · doi:10.1007/s11423-021-09977-4 · Cited by 119 · see citing works
“The GDPR standards relate to informed consent, privacy-by-design, algorithmic transparency, and automated decision-making (Wachter, 2018), so the GDPR provides privacy and control protection for LA users.”
BackgroundYuan, B., & Li, J. (2019) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph16061070 · Cited by 125 · see citing works
“Patients cannot control their data, and do not have sufficient levels of awareness to give free and informed consent [3].”
BackgroundKirk, H. R., Vidgen, B., Röttger, P., & Hale, S. A. (2024) · Nature Machine Intelligence · doi:10.1038/s42256-024-00820-y · Cited by 122 · see citing works
“This is similar to any technology that relies on personal information to deliver tailored benefits 99 , such as with the Internet of Things 100 or targeted advertising 101,102 .”
Social equity in the data era: A systematic literature review of data‐driven public service research
Ruijer, E. H. J. M., Porumbescu, G. A., Porter, R., & Piotrowski, S. J. (2022) · Public Administration Review · doi:10.1111/puar.13585 · Cited by 124 · see citing works
Access Control for IoT: A Survey of Existing Research, Dynamic Policies and Future Directions
Ragothaman, K. N. M., Wang, Y., Rimal, B. P., & Lawrence, M. (2023) · Sensors · doi:10.3390/s23041805 · Cited by 107 · see citing works
“Given the heterogeneity and the need to protect the data that IoT devices collect, IDoT needs to be addressed before access control [105].”
BackgroundDeterminants of customers' intentions to use hedonic networks: The case of Instagram
Bahri-Ammari, N., Hadhri, W., & Mezrani, M. (2018) · Journal of Retailing and Consumer Services · doi:10.1016/j.jretconser.2018.09.001 · Cited by 90 · see citing works
Pal, D., Zhang, X., & Siyal, S. (2021) · Technology in Society · doi:10.1016/j.techsoc.2021.101683 · Cited by 84 · see citing works
Internet of behaviours (IoB) and its role in customer services
Javaid, M., Haleem, A., Singh, R. P., Rab, S., & Suman, R. (2021) · Sensors International · doi:10.1016/j.sintl.2021.100122 · Cited by 80 · see citing works
Data Protection in the Age of Big Data
Wachter, S. (2019) · Nature Electronics · doi:10.1038/s41928-018-0193-y · Cited by 78 · see citing works
Self-citationA mapping of IoT user-centric privacy preserving approaches to the GDPR
Kounoudes, A. D., & Kapitsaki, G. M. (2020) · Internet of Things · doi:10.1016/j.iot.2020.100179 · Cited by 78 · see citing works
GDPR Compliance Verification in Internet of Things
Barati, M., Rana, O., Petri, I., & Theodorakopoulos, G. (2020) · IEEE Access · doi:10.1109/access.2020.3005509 · Cited by 72 · see citing works
“INTRODUCTION The rapid growth in the usage of Internet of Things (IoT) devices has led to the emergence of various IoT-based applications in domains such as energy consumption and utility monitoring, smart buildings, transportation, healthcare and assisted living environments [1].”
BackgroundDifferential Privacy for IoT-Enabled Critical Infrastructure: A Comprehensive Survey
Husnoo, M. A., Anwar, A., Chakrabortty, R. K., Doss, R., & Ryan, M. J. (2021) · IEEE Access · doi:10.1109/access.2021.3124309 · Cited by 69 · see citing works
“Furthermore, several researchers have also proposed data anonymization techniques for data privacy preservation in IoT-enabled CIs [16].”
BackgroundCyberbullying among Adolescents: Psychometric Properties of the CYB-AGS Cyber-Aggressor Scale
Buelga, S., Postigo, J., Martínez–Ferrer, B., Cava, M. J., & Ortega-Barón, J. (2020) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph17093090 · Cited by 65 · see citing works
“The connection speed will be up to 100 times faster than the current one [1], and this change will make it possible to optimize an extensive environment of everyday objects connected to the Internet; Internet of Things (IoT) [2,3].”
BackgroundA New Method With Swapping of Peers and Fogs to Protect User Privacy in IoT Applications
Yamin, M., & Sen, A. A. A. (2020) · IEEE Access · doi:10.1109/access.2020.3038825 · Cited by 59 · see citing works
“More details, including the principles of the GDPR, are available in [42]–[44].”
BackgroundLibaque-Sáenz, C. F., Wong, S. F., Chang, Y., & Bravo, E. (2020) · Information & Management · doi:10.1016/j.im.2020.103284 · Cited by 61 · see citing works
Reconciliation of Privacy with Preventive Cybersecurity: The Bright Internet Approach
Lee, J. K., Chang, Y., Kwon, H.-Y., & Kim, B. (2020) · Information Systems Frontiers · doi:10.1007/s10796-020-09984-5 · Cited by 45 · see citing works
“Among such privacy policies, the European Union’s GDPR has the most comprehensive jurisdiction (Politou et al. 2018; Wachter 2018).”
BackgroundRegulating AI and Robotics: Ethical and Legal Challenges
Ebers, M. (2020) · Algorithms and Law · doi:10.1017/9781108347846.003 · Cited by 44 · see citing works
The General Data Protection Regulation: Requirements, Architectures, and Constraints
Hjerppe, K., Ruohonen, J., & Leppänen, V. (2019) · IEEE International Requirements Engineering Conference (RE) · doi:10.1109/re.2019.00036 · Cited by 56 · see citing works
“While together A6(1a) and A7 imply a clear requirement for the case company, it should be underlined that the company’s compliance is not relying on A6(1f) and its much debated [31] concept of so-called legitimate interests.”
BackgroundUser-centric privacy preserving models for a new era of the Internet of Things
Rivadeneira, J. E., Silva, J. S., Colomo‐Palacios, R., Rodrigues, A., & Boavida, F. (2023) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2023.103695 · Cited by 41 · see citing works
Privacy Protection for Blockchain-Based Healthcare IoT Systems: A Survey
Qi, M., Wang, Z., Han, Q.-L., Zhang, J., Chen, S., & Xiang, Y. (2024) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2022.106058 · Cited by 44 · see citing works
To trust or not to trust smart consumer products: a literature review of trust-building factors
Michler, O., Decker, R., & Stummer, C. (2019) · Management Review Quarterly · doi:10.1007/s11301-019-00171-8 · Cited by 42 · see citing works
“The request for more transparency was also among the drivers for the new EU General Data Protection Regulation (GDPR), which came into force in 2018 (Wachter 2018).”
BackgroundAssche, E. V., Ramos‐Quiroga, J. A., Pariante, C. M., Sforzini, L., Young, A. H., Flossbach, Y., Gold, S. M., Hoogendijk, W. J. G., Baune, B. T., & Maron, E. (2022) · European Neuropsychopharmacology · doi:10.1016/j.euroneuro.2022.05.007 · Cited by 39 · see citing works
Vehicle Telematics for Safer, Cleaner and More Sustainable Urban Transport: A Review
Ghaffarpasand, O., Burke, M. J., Osei, L. K., Ursell, H., Chapman, S., & Pope, F. D. (2022) · Sustainability · doi:10.3390/su142416386 · Cited by 38 · see citing works
The myth of individual control: Mapping the limitations of privacy self-managementPreprint
Kröger, J. L., Lutz, O. H.-M., & Ullrich, S. (2021) · SSRN Electronic Journal · doi:10.2139/ssrn.3881776 · Cited by 36 · see citing works
Zaguir, N. A., de Magalhães, G. H., & Spínola, M. D. M. (2024) · IEEE Access · doi:10.1109/access.2024.3406724 · Cited by 37 · see citing works
“Wachter [96] highlight that identification and access con-trol technologies are essential infrastructure for linking data between a user’s devices with unique identities and providing integrated, linked services.”
BackgroundRenya Nath, N., & Nath, H. V. (2022) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2022.107997 · Cited by 35 · see citing works
Quinn, P. F., & Malgieri, G. (2020) · SSRN Electronic Journal · doi:10.2139/ssrn.3713134 · Cited by 35 · see citing works
General Data Protection Regulation (GDPR) in Healthcare: Hot Topics and Research Fronts
Fatehi, F., Hassandoust, F., Ko, R. K. L., & Akhlaghpour, S. (2020) · Studies in health technology and informatics · doi:10.3233/shti200336 · Cited by 35 · see citing works
“In spite of the fact that GDPR is a recently developed legal instrument, there have been many research studies on GDPR since its adoption in 2016, such as [4; 5].”
BackgroundAuthenticated and Privacy-Preserving Consent Management in the Internet of Things
Laurent, M., Leneutre, J., Chabridon, S., et al. (2019) · Procedia Computer Science · doi:10.1016/j.procs.2019.04.037 · Cited by 32 · see citing works
“Following the analysis conducted in [15], this use case is representative of personalization services exploiting a user’s profile to provide a relevant service tailored to the needs of this user.”
MethodOnline Customer Trust in the Context of the General Data Protection Regulation (GDPR)
Zhang, J., Hassandoust, F., & Williams, J. E. (2020) · Pacific Asia journal of the Association for Information Systems · doi:10.17705/1pais.12104 · Cited by 33 · see citing works
“It is expected to provide opportunities for organizations to improve online customer trust through risk-related personal data governance (European Commission, 2019c; Wachter, 2018).”
BackgroundLightweight Data-Security Ontology for IoT
Gonzalez-Gil, P., Martinez, J. A., & Skármeta, A. (2020) · Sensors · doi:10.3390/s20030801 · Cited by 31 · see citing works
“Finally, public and political concern has coalesced in the form of public regulations, such as the General Data Protection Regulation (GDPR), which impose a new set of difficulties and restrictions on the way in which personal data is handled, that directly affects the IoT [12].”
BackgroundCollaborative Working Architecture for IoT-Based Applications
Mora, H., Pont, M. T. S., Gil, D., & Johnsson, M. (2018) · Sensors · doi:10.3390/s18061676 · Cited by 30 · see citing works
“User privacy challenges arise even when generating information or inferences about the user behaviour [47].”
BackgroundMethodLegal challenges of digitalization and automation in the context of Industry 4.0
Habrat, D. (2020) · Procedia Manufacturing · doi:10.1016/j.promfg.2020.10.132 · Cited by 30 · see citing works
User Privacy Concerns in Commercial Smart Buildings1
Harper, S., Mehrnezhad, M., & Mace, J. C. (2022) · Journal of Computer Security · doi:10.3233/jcs-210035 · Cited by 29 · see citing works
Shalan, M., Hasan, M. R., Bai, Y. Z., & Li, J. (2025) · Smart Cities · doi:10.3390/smartcities8010035 · Cited by 29 · see citing works
Privacy of IoT-Enabled Smart Home Systems
Dasgupta, A., Gill, A. Q., & Hussain, F. K. (2019) · IntechOpen eBooks · doi:10.5772/intechopen.84338 · Cited by 29 · see citing works
Electronic identity services as sociotechnical and political-economic constructs
van Dijck, J., & Jacobs, B. (2019) · New Media & Society · doi:10.1177/1461444819872537 · Cited by 28 · see citing works
“…in 2018, the EU countries set a strong international norm as to which minimum data protection standards digital platforms need to comply with if they want to operate in the European digital realm; this standard has led to deliberation about sometimes conflicting norms and values (Wachter, 2018).”
BackgroundScherer, A. G., & Neesham, C. (2023) · Organization Theory · doi:10.1177/26317877231204083 · Cited by 30 · see citing works
“Scholars are warning against privacy threats, and also against the potential for extending social control and political manipulation to non-sub-scribers (Lanier, 2018; Wachter, 2018; Zuboff, 2019).”
BackgroundEthics in educational technology research: Informing participants on data sharing risks
Beardsley, M., Santos, P., Hernández‐Leo, D., & Michos, K. (2019) · British Journal of Educational Technology · doi:10.1111/bjet.12781 · Cited by 29 · see citing works
Davola, A., Querci, I., & Romani, S. (2023) · Journal of Consumer Policy · doi:10.1007/s10603-022-09530-7 · Cited by 25 · see citing works
“…and processing methods implemented in profiling algorithms has been thoroughly inspected (Dobber et al., 2019; Eskens, 2016; Malgieri, 2021; Wachter, 2018); also, competition law was identified as a potential tool to tackle the structural distortions caused by personalized practices…”
MethodA Conceptual Framework for Data Governance in IoT-enabled Digital IS Ecosystems
Dasgupta, A., Gill, A. Q., & Hussain, F. K. (2019) · International Conference on Data Science, Technology and Applications (DATA) · doi:10.5220/0007924302090216 · Cited by 27 · see citing works
“This can be attributed to the changes in regulations (Wachter, 2018) as well as advancement in technologies such as Big Data, Blockchain, Cloud, IoT and Mobile (Copie et al., 2013).”
BackgroundGDPR-Based User Stories in the Access Control Perspective
Bartolini, C., Daoudagh, S., Lenzini, G., et al. (2019) · Communications in computer and information science · doi:10.1007/978-3-030-29238-6_1 · Cited by 25 · see citing works
Schneider, B., Reilly, J., & Radu, I. W. (2020) · Journal for STEM Education Research · doi:10.1007/s41979-020-00027-x · Cited by 24 · see citing works
Seymour, W., Binns, R., Slovák, P., Kleek, M. G. V., & Shadbolt, N. (2020) · Designing Interactive Systems Conference · doi:10.1145/3357236.3395501 · Cited by 26 · see citing works
“smart homes in general threaten principles of accountability [3], or discrimination [66]).”
BackgroundDigital ethics: Global trends and divergent paths
Guenduez, A. A., Walker, N., & Demircioğlu, M. A. (2025) · Government Information Quarterly · doi:10.1016/j.giq.2025.102050 · Cited by 32 · see citing works
Norval, C., Janssen, H., Cobbe, J., et al. (2018) · doi:10.1145/3267305.3274153 · Cited by 22 · see citing works
“Data subject identification is an ongoing discussion (see, for example, multi-user IoT devices [17] and web tracking through shadow profiles [5]), and there is much potential for future work in the space.”
BackgroundBest practices for studies using digital data donation
Carrière, T. C., Boeschoten, L., Struminskaya, B., et al. (2024) · Quality & Quantity · doi:10.1007/s11135-024-01983-x · Cited by 22 · see citing works
“…entity processing personal data, such as digital platforms) are obliged to provide a copy of all personal data (i.e., data relating to an identified or identifiable person) they collected on their users upon request by the person to whom the data per-tains (Veale and Ausloos 2021; Wachter 2018).”
Ethical Challenges in the Use of Digital Technologies: AI and Big Data
Wylde, V., Prakash, E., Hewage, C. T. E. R., & Platts, J. (2023) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-031-09691-4_3 · Cited by 24 · see citing works
The trust gap: Social perceptions of privacy data for energy services in the United Kingdom
Grünewald, P., & Reisch, T. (2020) · Energy Research & Social Science · doi:10.1016/j.erss.2020.101534 · Cited by 22 · see citing works
Ethical framework for IoT deployment in SMEs: individual perspective
Vermanen, M., Rantanen, M. M., & Harkke, V. (2021) · Internet Research · doi:10.1108/intr-08-2019-0361 · Cited by 20 · see citing works
“Some of the most important risk factors to consider are that IoT solutions often enable collecting and combining data that is professionally irrelevant, yet allow the observer to practice profiling (Wachter, 2018) and draw personal conclusions about the observed individuals.”
BackgroundVojković, G., Milenković, M., & Katulić, T. (2020) · Business Systems Research Journal · doi:10.2478/bsrj-2020-0033 · Cited by 19 · see citing works
““Users’ right to data protection and right to privacy must be balanced in the design and governance of identification technologies in the IoT” (Wachter, 2018b).”
BackgroundDPIA in Context: Applying DPIA to Assess Privacy Risks of Cyber Physical Systems
Henriksen-Bulmer, J., Faily, S., & Jeary, S. (2020) · Future Internet · doi:10.3390/fi12050093 · Cited by 20 · see citing works
“For example, in regards to discrimination, one of the areas identified as one of the four challenges by Wachter [4], staff felt that potential discrimination was unlikely as this was an area staff and volunteers received a lot of guidance and training on.”
BackgroundInfluentialDoes the learning ability of smart products lead to user resistance?
Chouk, I., & Mani, Z. (2022) · Journal of Engineering and Technology Management · doi:10.1016/j.jengtecman.2022.101706 · Cited by 16 · see citing works
Maturity Model for IoT Adoption in Hospitals
Hasić, F., Beirens, B., & Serral, E. (2022) · Computing and informatics · doi:10.31577/cai_2022_1_213 · Cited by 15 · see citing works
Automatic Detection of Sensitive Data Using Transformer- Based Classifiers
Petrolini, M., Cagnoni, S., & Mordonini, M. (2022) · Future Internet · doi:10.3390/fi14080228 · Cited by 15 · see citing works
Karampela, M., Ouhbi, S., & Isomursu, M. (2019) · Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC) · doi:10.1109/embc.2019.8856550 · Cited by 15 · see citing works
“be considered obvious for everyday users [49].”
Enhancing User Privacy in IoT: Integration of GDPR and Blockchain
Barati, M., & RANA, O. F. (2019) · Communications in computer and information science · doi:10.1007/978-981-15-2777-7_26 · Cited by 18 · see citing works
Smartphones within Psychological Science
Ellis, D. A. (2020) · Cambridge University Press eBooks · doi:10.1017/9781108671408 · Cited by 14 · see citing works
Participatory Data Design: Managing Data Sovereignty in IoT Solutions
Bowen, J., & Hinze, A. (2022) · Interacting with Computers · doi:10.1093/iwc/iwac031 · Cited by 14 · see citing works
“Ensuring users have control over how their data is used, and by whom is also gaining traction, particularly in light of legislative controls such as the EU General Data protection Regulation (GDPR) (European Union 2016).”
BackgroundPlatform governance in the era of AI and the digital economy
Zheng, X.-L., Zhou, G., & Zeng, D. (2023) · Frontiers of Engineering Management · doi:10.1007/s42524-022-0241-1 · Cited by 13 · see citing works
“For example, Germany’s NetzDG (Gorwa, 2021) and the EU’s General Data Protection Regulation (GDPR) (Wachter, 2018) require social media platforms with more than two million users to address inaccurate or inappropriate statements on their platforms within a certain time limit and report on their…”
BackgroundInfluentialProtected or Porous: A Comparative Analysis of Threat Detection Capability of IoT Safeguards
Mandalari, A. M., Haddadi, H., Dubois, D. J., et al. (2023) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp46215.2023.10179282 · Cited by 14 · see citing works
“According to best practices and some privacy regulations [49], network traffic should be sent encrypted.”
BackgroundUnobtrusive Continuous Stress Detection in Knowledge Work—Statistical Analysis on User Acceptance
Kallio, J., Vildjiounaite, E., Kantorovitch, J., Kinnula, A., & López, M. B. (2021) · Sustainability · doi:10.3390/su13042003 · Cited by 14 · see citing works
“Since the invocation of sensors and cloud-based data analytics is growing, it is crucial to investigate the GDPR directive regarding the design and implementation of data-driven solutions in order to minimize conflicts between GDPR and the deployment of sensors and tracking softwarebased well-being monitoring [54].”
BackgroundAdaptive User Profiling in E-Commerce and Administration of Public Services
Gatziolis, K., Tselikas, N. D., & Moscholios, I. D. (2022) · Future Internet · doi:10.3390/fi14050144 · Cited by 14 · see citing works
Quantifying Bytes: Understanding Practical Value of Data Assets in Federated Learning
Yao, M., Qi, S., Tian, Z., Li, Q., Han, Y., Li, H., & Qi, Y. (2024) · Tsinghua Science & Technology · doi:10.26599/tst.2024.9010034 · Cited by 13 · see citing works
Mühlhoff, R. (2020) · Deutsche Zeitschrift für Philosophie · doi:10.1515/dzph-2020-0059 · Cited by 13 · see citing works
Oppl, S., & Stary, C. (2022) · Sustainability · doi:10.3390/su14020900 · Cited by 13 · see citing works
“Wachter [18] identified four user privacy challenges in GDPR: (1) profiling, inference, and discrimination; (2) control and context-sensitive sharing of identity; (3) consent and uncertainty; and (4) honesty, trust, and transparency.”
BackgroundNudging Citizens through Technology in Smart CitiesPreprint
Ranchordás, S. (2019) · SSRN Electronic Journal · doi:10.2139/ssrn.3333111 · Cited by 13 · see citing works
Abu-Salma, R., Choy, J., Frik, A., & Bernd, J. (2024) · ACM Transactions on Computer-Human Interaction · doi:10.1145/3702321 · Cited by 13 · see citing works
Colomb, Y., White, P., Islam, R., et al. (2022) · Springer eBooks · doi:10.1007/978-3-031-09640-2_7 · Cited by 12 · see citing works
Krpan, D., & Urbaník, M. (2021) · Behavioural Public Policy · doi:10.1017/bpp.2021.40 · Cited by 13 · see citing works
Contextualized BERT Sentence Embeddings for Author Profiling: The Cost of Performances
Polignano, M., de Gemmis, M., & Semeraro, G. M. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58811-3_10 · Cited by 15 · see citing works
“As a result of the increasingly stringent laws regarding the privacy of users GDPR [35], it is always less possible to access and use the data provided directly by users such as date of birth, gender, working position.”
BackgroundTowards data privacy in a fog of things
Pinto, G. P., & Prazeres, C. V. S. (2024) · Internet Technology Letters · doi:10.1002/itl2.512 · Cited by 11 · see citing works
“9 Then, we present an implementation of a simulated usage scenario using the Social Linked Data (Solid) specification for data storage.”
Swarnkar, M., & Kumar, R. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3373887 · Cited by 11 · see citing works
“Various methods for IoT device identification [9], [10], [11], [12] are proposed in the literature.”
MethodAutomated Authentication of Large-Scale IoT Devices with Hybrid Feature Selection
Chen, Q., Song, Y., Hu, A., et al. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-78621-2_55 · Cited by 11 · see citing works
Internet of Things and Artificial Intelligence in National Security: Applications and Issues
Montasari, R. (2023) · Advances in information security · doi:10.1007/978-3-031-21920-7_3 · Cited by 12 · see citing works
A readiness assessment tool for GDPR compliance certification
Chatzipoulidis, A., Tsiakis, T., & Kargidis, T. (2019) · Computer Fraud & Security · doi:10.1016/s1361-3723(19)30086-7 · Cited by 11 · see citing works
Toward GDPR Compliance in IoT Systems
Allegue, S., Rhahla, M., & Abdellatif, T. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-45989-5_11 · Cited by 11 · see citing works
ABUDUREYIMU, Y., & Ogurlu, Y. (2021) · İstanbul Ticaret Üniversitesi Sosyal Bilimler Dergisi · doi:10.46928/iticusbe.863505 · Cited by 11 · see citing works
Vgena, K., Kitsiou, A., Kalloniatis, C., & Gritzalis, S. (2022) · Future Internet · doi:10.3390/fi14090249 · Cited by 12 · see citing works
A decade of gender bias in machine translation
Savoldi, B., Bastings, J., Bentivogli, L., & Vanmassenhove, E. (2025) · Patterns · doi:10.1016/j.patter.2025.101257 · Cited by 14 · see citing works
“196”
Pietrantonio, F., Florczak, M., Kühn, S., Karberg, K., Leung, T. I., Said-Criado, I., Sikorski, S., Ruggeri, M., Signorini, A., Rosiello, F., et al. (2024) · Frontiers in Public Health · doi:10.3389/fpubh.2024.1370555 · Cited by 11 · see citing works
Surveying federated learning approaches through a multi-criteria categorization
Caruccio, L., Cimino, G., Deufemia, V., Iuliano, G., & Stanzione, R. (2023) · Multimedia Tools and Applications · doi:10.1007/s11042-023-16050-0 · Cited by 11 · see citing works
Examining How GDPR Challenges Emerging Technologies
El-Gazzar, R. F., & Stendal, K. (2020) · Journal of Information Policy · doi:10.5325/jinfopoli.10.2020.0237 · Cited by 10 · see citing works
Bringing privacy control back to citizens
Stach, C., Gritti, C., & Mitschang, B. (2020) · ACM Symposium on Applied Computing · doi:10.1145/3341105.3375754 · Cited by 8 · see citing works
“In particular Privacy by Design (Article 25) necessitates user-friendly tools to oversee and control how IoT platforms process their data and share it with IoT applications [24].”
BackgroundTelemedicine in internal medicine: A statement by the European Federation of Internal Medicine.
Pietrantonio, F., Sebastian, K., Kärberg, K., et al. (2023) · European Journal of Internal Medicine · doi:10.1016/j.ejim.2023.02.021 · Cited by 8 · see citing works
Combrink, H., Marivate, V. N., & Masikisiki, B. (2023) · Education Sciences · doi:10.3390/educsci13050438 · Cited by 7 · see citing works
Applications of Machine Learning in Cyber Forensics
Rajendiran, K., Kannan, K., & Yu, Y. (2020) · Advances in digital crime, forensics, and cyber terrorism book series · doi:10.4018/978-1-7998-4900-1.ch002 · Cited by 8 · see citing works
Kang Woo, C. H. O., Jeong, B.-G., & Shin, S. U. (2021) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.2021ngp0006 · Cited by 8 · see citing works
“In other words, the strength of the security required to protect these data is the same as that required to protect personal information [3]–[5].”
BackgroundSecurity Management Suitable for Lifecycle of Personal Information in Multi-User IoT Environment
Lee, Y., & Lee, G. Y. (2021) · Sensors · doi:10.3390/s21227592 · Cited by 8 · see citing works
Data, resilience, and identity in the digital age
Davies, P., Fritzsche, A., Parry, G., & Wood, Z. (2023) · Strategic Change · doi:10.1002/jsc.2560 · Cited by 8 · see citing works
Kosek‐Szott, K., Szott, S., Ciężobka, W., et al. (2025) · Computer Communications · doi:10.1016/j.comcom.2025.108400 · Cited by 7 · see citing works
Extending an LGPD Compliance Inspection Checklist to Assess IoT Solutions: An Initial Proposal
Pereira, I., Mendes, J., Viana, D., et al. (2022) · doi:10.5753/cbsoft_estendido.2022.226679 · Cited by 7 · see citing works
“Central and State Governments in many countries have enacted laws and regulations to promote personal data protection [Wachter 2018].”
BackgroundThe Ethics of Surveillance in Times of Emergency
Macnish, K., & Henschke, A. (2023) · doi:10.1093/oso/9780192864918.001.0001 · Cited by 7 · see citing works
- Authors
- Wachter, S.
- Affiliations
- University of Oxford (GB)
- Corresponding author
- Wachter, Sandra
- ORCID
- Wachter, Sandra
- Venue
- Computer Law & Security Review
- Publisher
- Elsevier BV
- Published
- 2018-06
- Volume
- 34
- Issue
- 3
- Pages
- 436-449
- ISSN
- 2212-473X (ISSN-L)
- OpenAlex
- W3125356411
- Cited by
- 307
- References
- 29
- Citations by year
- 2026: 6 · 2025: 42 · 2024: 25 · 2023: 36 · 2022: 36 · 2021: 74 · 2020: 54 · 2019: 28 · 2018: 6
- FWCI
- 247.80
- Type
- journal article
- Language
- en
- Open access
- green
- doi.org
- Locations
- Computer law & security review (publishedVersion)
- SSRN Electronic Journal (publishedVersion)
- Funders
- Engineering and Physical Sciences Research Council
- Topics
- Social Sciences › Law › Digitalization, Law, and Regulation
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Keywords
- Internet of Things, user identification, access control, privacy, profiling, discrimination, General Data Protection Regulation, data protection law, identity control, consent, inference, data anonymization, cybersecurity, transparency, trust, IoT device design
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
