© Allen & Overy April 2015 Katia Manhaeve - Catherine Di Lorenzo The Internet of Things

© Allen & Overy 2015 Definition 2 “The Internet of Things (IoT) is the network of physical objects that contain embedded technology to communicate and sense or interact with their internal states or the external environment” (Gartner)

© Allen & Overy 2015 Connected Homes 3 Source:

© Allen & Overy 2015 Manufacturing, Energy, Agriculture, … 4 Source: Source: Source:

© Allen & Overy 2015 Connected Health 5  Remote monitoring  Wearable technology

© Allen & Overy 2015 Smart transportation 6

© Allen & Overy 2015 Enormous opportunities, and some challenges too… 7 StandardsCyber security Regulatory issues Contractual / liability issues

© Allen & Overy 2015 Data protection challenges in the IoT 8

© Allen & Overy 2015 Three main IoT developments 9  Wearable Computing  Quantified Self  Home automation → combinations are possible

© Allen & Overy 2015 Possible data controller 10 Data controller: “person or entity determining the means and purposes of the data processing” Device manufacturers Third party application developers Social platform Other third parties

© Allen & Overy 2015 Possible legitimacy grounds of the processing 11 Required for the performance of the contract with the data subject Legitimate interest of the data controller BUT only where the interest and fundamental rights of the data subject do not prevail Consent Source:

© Allen & Overy 2015 Consent 12 No specific form required Free: no risk of deception, intimidation, other significant negative consequences Informed: on facts and implications Specific: notably relating to the purpose of the data processing Renewal of consent should be considered

© Allen & Overy 2015 Rights of data subjects 13 Right of access also to raw data → via web portal? Right to portability Right to withdraw consent

© Allen & Overy 2015 Formal compliance steps 14 Formalities (notification or authorisation) 1 Information of the data subject 2

© Allen & Overy 2015  Specific requirements apply in case of monitoring  Geolocation data collection = monitoring  Notably app developers / operating system and device manufacturers might need an authorisation Formalities – Processing of geolocation data 15 Monitoring : “any activity which, carried out using technical instruments, consists of observing, collecting or recording in a non-occasional manner the personal data of one or more persons, concerning behaviour, movements, communications or the use of electronic instruments”

© Allen & Overy 2015 Risks 16 Reuse of data for other purposes Security vs. Efficiency Impact on individual’s behaviour Anonymous use of data no longer possible?

© Allen & Overy 2015 Some recommendations for stakeholders 17  Apply principles of Privacy by Design and Privacy by Default  Data minimisation: delete raw data as soon as no longer required  Ensure control of the data subjects over the processing of their data  Transparency

© Allen & Overy Thank you! These are presentation slides only. The information within these slides does not constitute definitive advice and should not be used as the basis for giving definitive advice without checking the primary sources. Allen & Overy means Allen & Overy LLP and/or its affiliated undertakings. The term partner is used to refer to a member of Allen & Overy LLP or an employee or consultant with equivalent standing and qualifications or an individual with equivalent status in one of Allen & Overy LLP’s affiliated undertakings. Dr. Catherine Di Lorenzo Senior Associate Avocat à la Cour - Rechtsanwältin Tel Katia Manhaeve Partner Avocat à la Cour Tel