General Data Protection Regulations and the IoT Aberdeen Edinburgh Glasgow General Data Protection Regulations and the IoT Jen Kantharia 26 October 2016

Introduction – Data Protection in the UK Current position in the UK is governed by the Data Protection Act 1998 (the “DPA”) The DPA provides rules for how/who/what personal information can be processed by organisations New regime will be governed by the General Data Protection Regulations (“GDPR”) and will come into force on 28 May 2018

Data Protection Importance for IoT Protecting the privacy of users 2016 Global Privacy Enforcement Network survey Understand the consumer perspective

5 Key Changes under the GDPR Privacy by design and privacy by default Consent New obligations on data processors Notification of data and security breach Fines for data breaches

Tips for IoT Businesses Review the data being processed Delete unnecessary information Review and consider internal policies, user privacy policies, data protection officer Consider data and privacy at start of product design Provide clear information to users on how data used

Jen Kantharia Solicitor +44 (0)141 273 6828 +44 (0)7468 863 253 Jennifer.Kantharia@burnesspaull.com