This means stronger control for effective exercise of, among others, right to access, erasure, restriction or objection. DPbDD compliance becomes challenging especially in contemporary networked environments such as Internet of Things (IoT) that are marked by extensive data flow across various servers without sufficient individual control over her personal data.. As against that, widely proposed and recommended Privacy Enhancing Technologies (PETs) predominantly focus on confidentiality through tools such as encryption, zero-knowledge proofs or federated learning. Relatively lesser emphasis is laid on tools that could also improve autonomy of data subjects. This trend is depicted in various international reports and regulatory guidelines on PETs. In that context, this paper discusses the emerging work on data traceability in computer science literature to answer: how can data traceability contribute to DPbDD compliance by addressing both confidentiality and autonomy requirements of GDPR? Accordingly, we present a data traceability solution, while specifically focusing on consumer IoT, by outlining key properties that such mechanism must possess in order to be partially compliant with DPbDD. Therefore, this paper aims to enrich the legal discourse on PETs by bringing explicit attention to data traceability techniques that can ensure higher autonomy and complement confidentiality PETs. Connectedly, technical trade-offs between ex ante and ex post installation of data traceability techniques are also analyzed which reinvigorates the ex ante nature of DPbDD requirement. Recognizing the complexity of GDPR, we also briefly analyze the limits and implications of data traceability for other GDPR requirements.
The paper is co-written by Samar Nawaz and Elisavet Kozyri at the Institutt for informatikk (IFI) of UiT
Samar Abbas Navaz worked professionally in the field of law for nearly a decade, serving as a practitioner, in-house counsel, and academic researcher. My research interest particularly lies in the regulatory challenges of emerging technologies. At UiT, I'm working for the project called 'On the technological (im)possibility to enforce data protection laws'. It looks into the effectiveness of the current technological state of art to ensure lifelong enforcement of the EU General Data Protection Regulation (GDPR)'s requirements on right to erasure, purpose limitation, and automated decision-making. Prior to this, I worked as a senior researcher at Peace Research Institute Oslo (PRIO) where I also completed my doctorate on 'Safe integration of civil drones: Law, self-operation and infrastructure'. There, I was engaged in different projects on drones, border technologies, and AI; researching the sociotechnical aspect of their safety regulation.