IoT Data Profiles: The Routines of Your Life Reveals Who You Are

Abstract

Preserving privacy is getting more and more important. The new EU general data protection regulation (GDPR) which will apply from May 2018 will introduce developments to some areas of EU data protection law and increase the privacy and personal integrity by strengthen and unify data protection for all individuals in EU. GDPR will most likely have an impact on many organizations and put pressure on many organizations that handle data.In this work, we investigate to what extent data profiles consisting of data from connected things can be used to identify a user. We use time and event profiles that can be created based on when, where and how a user communicates and uses digital devices. Our results show that such data profiles can be used to identify individuals and that collecting and creating data profiles of users can be seen as a serious threat towards privacy and personal integrity.