new-tech-pia
Installation
SKILL.md
Assessing New Technology Privacy Impact
Overview
Article 35(1) of the GDPR explicitly references new technologies as a factor increasing the likelihood of high risk to data subjects' rights and freedoms. The EDPB in WP248rev.01 identifies innovative use of technology as one of nine criteria triggering a DPIA. This skill provides a structured PIA methodology for emerging technologies where the privacy implications are not yet fully understood, including Internet of Things (IoT), blockchain and distributed ledger technologies, augmented and virtual reality (AR/VR), quantum computing, digital twins, brain-computer interfaces, and ambient computing.
Technology-Specific Privacy Risk Profiles
Internet of Things (IoT)
| Risk Area | Description | Privacy Impact |
|---|---|---|
| Pervasive data collection | IoT devices continuously collect environmental and behavioural data, often without visible indicators | Data subjects may be unaware of the scope of data collection; transparency obligations under Art. 13-14 are difficult to fulfil on devices without screens |
| Data minimisation challenges | Sensors often collect more data than needed for the immediate purpose to enable future analytics | Violation of Art. 5(1)(c) data minimisation; purpose creep through accumulated data |
| Device-to-device communication | IoT ecosystems share data between devices without user awareness | Unexpected recipients; difficulty identifying all processors and sub-processors |
| Insecure by default | Many IoT devices ship with default credentials, unencrypted communications, and no update mechanism | Art. 25 data protection by design and Art. 32 security of processing obligations not met |
| Location and behavioural tracking | Connected devices reveal location patterns, daily routines, and behavioural habits | Systematic monitoring (WP248 C3); profiling risk (WP248 C1) |
| Cross-device correlation | Data from multiple IoT devices can be combined to create comprehensive behavioural profiles | Matching or combining datasets (WP248 C6); disproportionate surveillance |