Please enable JavaScript.

Coggle requires JavaScript to display documents.

A consequences of uses of computing - Coggle Diagram

- - - - Age restricted
        
        pornography
        
        Violoence
      - promoting religious or ethnic hatred
    - - Case study = Repercussions
  - - - Different laws in different countries
  - - - over-use of data
        
        dependence
        
        decisions made due to data analysis
      - Invasive technologies
        
        data collected without our consent
        
        satellite images
        
        Google Streetview
      - Over-reliance on computers
        
        some places could cause physical danger or death
      - Over reliance on technological companies
        
        2/3rds all internet searches through Google.
        
        115 billion searches a month
  - - - Who are the stakeholders?
        
        Company
        
        Can be monetised
        
        Users
        
        Noone can read messages
        
        Can be public or criminal
        
        Security Services
        
        Want access
        
        Criminal issues
      - What is the technology involved?
        
        Mobile Devices
        
        Application that includes end-to-end encryption
      - For each of the stakeholders what are the benefits and the drawbacks?
        
        Security back door
        
        Would allow other to be able to gain access
      - encryption computationally secure
    - - Who are the stakeholders?
        
        Users
        
        Company
        
        Third-party organisations
        
        Property owners
      - What is the technology involved?
        
        Mass storage facilities
        
        Information distribution technology
        
        Cameras and location processing
      - For each of the stakeholders what are the benefits and the drawbacks?
    - - Who are the stakeholders?
      - What is the technology involved?
      - For each of the stakeholders what are the benefits and the drawbacks?
        
        For each of the stakeholders what are the benefits and the drawbacks?
        
        80% of car crashes are due to human error
        
        Computes are never distracted
        
        Cars could communicate with each other and auto-route
        
        Obvious aid to those unable to drive
        
        Drop off and self-park
        
        Security
        
        Jobs dependency
        
        Legal consequence of an accident caused by a self-driving car
        
        Human distrust
    - - Who are the stakeholders?
        
        Users
      - What is the technology involved?
        
        Mass Data
      - For each of the stakeholders what are the benefits and the drawbacks?
        
        personal anomity
        
        recommended shopping products
- - - - Consumers can ask for their data to be erased, all under 18s can ask to be deleted from social media
    - - Expanded to include IP addresses, cookies, DNA
      - def = any data is any data on an individual where the person is alive and can be individually identified
      - Can be in any format
      - physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
      - sensitive personal data
        
        This is information that reveals the following: racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership.
      - Audio recordings of voices are considered biometric data relating to physical, physiological or behavioural characteristics of individuals that can be used to uniquely identify them. Other examples of biometric data are, for instance, fingerprints, facial images and iris scans.
    - - Identification through anonymous information
      - Changing a user’s data after it has been requested
      - Enforcement actions
        
        Supervisory authorities can furthermore issue administrative fines for infringement, with the maximum amount of up to 20 million euros, or 4% of the undertaking’s world annual turnover of the previous financial year, whichever is higher, depending on the circumstances of the case.
        
        failure to implement the data protection by design and by default is subject to a maximum fine of only 10 million Euros or 2% of the total worldwide annual turnover of an undertaking
        
        On the other hand, violating the basic principles of data processing, including the conditions for obtaining a valid consent as well as non-compliance with a supervisory authority’s order may result in the highest fine of 20 million Euros or 4% of the total worldwide annual turnover.
        
        the GDPR sets out several arrangements to streamline legal compliance by providing guidance in processing practices.It places data controllers and processors which process personal data of EU citizens directly under its jurisdiction, even if they are not established in the EU.
        
        It places data controllers and processors which process personal data of EU citizens directly under its jurisdiction, even if they are not established in the EU.
        
        The establishment of national supervisory authorities (and the Lead Supervisory Authority in case of cross-border data transfers) and of the European Data Protection Board (Chapter 6);
        
        Arrangements to streamline legal compliance, including codes of conduct (Article 40), data protection certifications (Article 42), binding corporate rules (Article 47) and standard (contractual) data protection clauses (Article 46);
        
        Rights of data subjects, including the right to lodge a complaint and the right to an effective judicial remedy (Chapter VIII);
        
        A multi-layered mechanism to protect the transfer of personal data of EU citizens outside the EU (Chapter V);
        
        Liabilities and sanctions for violation of laws (Chapter VIII);
        
        The role of Member States in compliance and implementation.
      - any person or organisation storing personal information must register with the information commissioner
      - binding and directly applicable in its entirety in all Members States of the European Union on 25 May 2018.
      - This article determines that everyone has the right to protection of personal data
        
        Under the GDPR, data subjects have the right to obtain from data controllers a confirmation regarding the fact whether or not personal data in relation to them are being processed and to access these data.
      - 7 principles of Privacy by Design are of importance:
        
        The Privacy by Design approach must adopt a proactive rather than reactive stance and aim at preventing privacy risks and not at addressing them after they occur;
        
        Privacy is to be used as a default setting
        
        Privacy must be embedded into design
        
        responsibility of the app developer to ensure any data processed during the use of the app is done securely
        
        Any data used to develop the app must be kept to the absolute minimum required. E.g. if their job title is not relevant to an app used to recommend show shoes they could buy you cannot use the data.
        
        Data protection by design means that the controller should take appropriate measures to protect personal data from the very beginning, meaning the design stage or the moment that the means of data processing are decided upon. The controller should design and implement appropriate technical and organisational measures to implement data protection principles, taking into account:
        
        The state of the art (the most recent stage of the design);
        
        The cost of implementation;
        
        Nature, scope, context and purposes of processing;
        
        The risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing.
        
        Under Article 32, controllers have the obligation to take technical and organisational measures to achieve a level of security appropriate to potential risk.
        
        Pseudonymisation and encryption;
        
        Ensuring the ongoing confidentiality, integrity, availability and resilience of processing system and services;
        
        The ability to restore the availability and access to personal data in a timely manner in case of physical or technical incident;
        
        A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures to ensure the security of the processing.
        
        Privacy by Design ensures full functionality and seeks to achieve both privacy and security
        
        Security must be made an integral part of the systems throughout their whole lifecycle;
        
        It seeks to achieve visibility and transparency;
        
        Systems are to be kept user-centric and users interests and needs must be taken into account.
      - There are also situations that are not covered by the GDPR
        
        this is the case when the processing is carried out in the course of activities to which European Union law does not apply, for example, those related to national security
        
        the GDPR is not applicable to the processing of personal data by EU Member States when it concerns the activities performed within the framework of the common foreign and security policy concerning, for instance, political cooperation, prevention of conflicts and humanitarian aid
        
        GDPR does not regulate the processing of personal data that natural persons carry out as part of purely personal or household activities, for example, correspondence and social networking
        
        The Regulation does not apply to the processing by competent authorities, such as the police, in the context of criminal justice, which is governed by the new Police and Criminal Justice Data Protection Directive.
      - Data subjects have the right to object under Article 21 GDPR
      - right to right to data portability
      - New Rights
        
        the right not to be subjected to automated individual decision-making
        
        the right to be represented by organisations and others
        
        the right to compensation
      - Obtaining the data directly from a data subject
        
        following information to data subjects at the moment of the obtaining the data:
        
        The contact details of the data protection officer (if applicable);
        
        The purposes and legal basis for data processing;
        
        The recipients of the personal data;
        
        The fact that the controller intends to transfer personal data outside the EU (if applicable).
        
        The controller’s identity and contact details;
        
        to ensure fair and transparent processing, the controller needs to provide the following information:
        
        The reason why the data subject needs to provide personal data (this could be a statutory or contractual requirement or a requirement to enter into a contract), if the data subject is obliged to do so and what the consequences are for not not providing the data;
        
        Data storage period;
        
        The rights of data subjects (right to access, rectification, erasure, restriction of processing, objection to processing, data portability, the right to withdraw consent; the right to lodge a complaint with a supervisory authority);
        
        The existence of automated decision making (including profiling);
        
        Any other purposes (if the controller intends to further process the personal data for a purpose other than that for which the data was originally collected).
      - When obtaining personal data not directly from data subjects, the controller also has to provide sufficient information to data subjects. The information provided is similar to the information required for data directly obtaining data from data subjects (above). The major difference is that the source of obtaining such personal data needs to be identified to data subjects, for example, if personal data are obtained from publicly accessible sources.
      - Dealing with data breach
        
        an intentional or unintentional release of secure or private information.
        
        cybercrime
        
        hacked websites and databases‘human errors’
        
        loss of data by employees who leave behind USB sticks in trains or restaurants for example
        
        When a data breach occurs, a controller has the obligation under Article 33 to notify the competent supervisory authority within 72 hours after becoming aware of the data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
        
        If the supervisory authority is not notified within 72 hours, the controller needs to provide reasons for the delay.
        
        Info to send
        
        Nature of the data breach, categories and number of data subjects and personal records concerned;
        
        Name and contact details of the data protection officer or other contact point;
        
        The likely consequences and measures taken or proposed to be taken.
        
        the controller has the obligation to communicate without undue delay the personal data breach to the data subject under Article 34 if the breach is likely to result in a high risk to the rights and freedoms of natural persons.
        
        The communication to the data subject needs to be described in clear, plain and understandable language and should include the same information given to the supervisory authority as listed above.
        
        The controller is exempted from this obligation if:
        
        Appropriate measures have been implemented and applied (for example encryption;
        
        Subsequent measures have been taken to prevent high risk to rights and freedoms of data subjects;
        
        The effort is disproportionate (if that is the case, a public communication or similar measure to inform data subjects will be sufficient).
        
        I had to report these to our privacy team when resolving risk events - which included minor data breaches.
      - Data Protection Impact Assessment (DPIA)
        
        A Data Protection Impact Assessments (DPIA) is a tool to determine in advance the privacy risks involved in data processing.
        
        A systematic description of the processing operations, purposes and the legitimate interest;
        
        An evaluation of the necessity and proportionality of the processing operations in relation to the purposes;
        
        An evaluation of the risks to the rights and freedoms of data subjects;
        
        Possible measures to address risks and to demonstrate compliance.
        
        A controller is exempted from carrying out a DPIA if:
        
        processing is necessary for compliance with a legal obligation to which the controller is subject;
        
        processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
        
        I had to do these as part of the impact assessment for any new projects I was analysing
        
        when to do it
        
        Automated decisions, including profiling;
        
        Special categories of data (Article 9) and data relating criminal convictions and offences (Article 10);
        
        Systematic monitoring of public spaces on a large scale.
        
        A controller has a legal obligation to consult with the supervisory authority before processing if a DPIA indicates that the processing would result in a high risk in the absence of measures taken to mitigate the risk. Based on this consultation, the supervisory authority provides the controller with written advice.
        
        provide the following information:
        
        The respective responsibilities of the controller, joint-controller, and processor;
        
        The purposes and means of data processing;
        
        Measures and safeguards taken to protect data subjects’ rights and freedoms;
        
        The contact details of data protection office (if applicable);
        
        The DPIA;
        
        Any other information requested by the supervisory authority.
      - Based on Article 39 a DPO has the following major tasks:
        
        To inform and advise on GDPR and related obligations;
        
        To monitor compliance with the GDPR and related obligations (including awareness raising and training);
        
        To provide advice as regards data protection impact assessment and to monitor its performance;
        
        To cooperate with the supervisory authority;
        
        To act as the contact point for the supervisor authority.
      - Article 28 GDPR determines that obligations of processors in particular include:
        
        To comply with the GDPR data processing principles and to protect the rights and freedoms of data subjects;
        
        To demonstrate compliance with the GDPR;
        
        To maintain records of processing activities and make them available upon request by supervisory authorities;
        
        To appoint data protection officers or representatives;
        
        To cooperate with supervisory authorities in the performance of their tasks;
        
        To ensure a level of security by taking appropriate technical and organisational measures;
        
        Specific obligations as regards transfer of data outside the EU.
        
        Article 28 (3) lists detailed requirements to ensure legal compliance by the processor such as:
        
        Act on documented instructions from the controller;
        
        Ensure confidentiality, assist with legal compliance of the controller, respond to requests from data subjects;
        
        Make available all information necessary to demonstrate compliance of the controller;
        
        Take measures to assist the controller with ensuring security of processing;
        
        Treat personal data after processing at the choice of the controller.
      - Cross-border data transfers
        
        As a general rule, transfers of personal data to countries outside the European Economic Area may take place if these countries are deemed to ensure an adequate level of data protection.
        
        , some exceptions to the general rule found in Article 46(1) GDPR. Personal data can be transferred to a third country even in the absence of an adequacy decision:
        
        if the controller or processor exporting the data has himself provided for appropriate safeguards; and
        (
        
        ii) on the condition that enforceable data subject rights and effective legal remedies are available in the given country.
    - - fairly and lawfully processed
      - processed for limited purposes
      - adequate, relelvant and not excessive
      - accurate
      - not kept longer than necessary
      - processed in accordance with the data subject's righs
      - secure
      - not transferred to countries without adequate data protection
    - - monitoring compliance with the GDPR
    - - provide their consent to this processing for one or more specific purposes.
      - It is possible to use a written declaration for giving consent
      - It is to be presented in an intelligible and easily accessible form and the language used should be clear and easy to understand.
      - Data subjects may withdraw their consent at any time, but the processing taking place before the withdrawal is still considered lawful
      - Also, when data subjects have no free choice or cannot refuse or withdraw their consent without any negative consequences, it is not freely given.
      - When information society services are provided directly to a child that needs to give consent, the processing of personal data of a child can be lawful if the child is at least 16 years old.
      - If a child is younger than 16 years, the processing can be considered lawful only when consent is given and authorised by the parent or legal guardian of the child.
    - - data controller
        
        operator of the Google search engine
      - data processor
        
        runs the Google Cloud Platform
      - https://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=lst&docid=152065&occ=first&dir=&cid=358745
        
        Test case. Could have search results removed from Google. But not the public agency.
        
        Right to be forgotten is also dependent on whether or not it is in the publics interest
        
        Mario Costeja González who is a Spanish national lodged a complaint in 2010 before the Spanish Data Protection Agency against a number of legal entities: the newspaper La Vanguardia Ediciones, Google Spain and Google Inc. The problem that this man discovered was the following. If Internet users entered the name of Mr. Costeja González in the Google search engine, two links to the newspaper La Vanguardia Ediciones would appear where his name would be present. This fact as such is unproblematic. However, his name would then be connected to the real-estate auction with regard to the attachment proceedings initiated for the recovery of social security debts.
        
        he Court acknowledged the fact that the processing of personal data, such as those of Mr. Costeja González, is liable to significantly affect the fundamental rights to privacy and data protection when it is possible to search for an individual using his or her name. This is the case because Internet users would be allowed to see the search results containing structured information about an individual and this information concerns many important aspects of the private life of that individual.
      - if a company, the controller, uses Google’s cloud service, Google, the processor, may not disclose, disseminate, or otherwise make the data available to another company without clear permission of the controller.
    - - To maintain records of all processing activities (Article 30 GDPR);
      - • To cooperate and consult with supervisory authorities (Article 31 GDPR);
      - • To ensure a level of security (Article 32 GDPR);
      - • To notify the supervisory authorities in the event of a data breach (Article 33 GDPR);
      - • To conduct a data protection impact assessment (Article 35 GDPR);
      - • To appoint a data protection officer (Article 37 GDPR);
      - • Specific obligations as regards transfer of data outside the EU (Chapter V GDPR);
      - • To assist data subjects with exercising their rights to privacy and data protection (Chapter III GDPR).
  - - - E.g. Hackers - access
        
        White hat hackers
        
        Expose weaknesses in system security
        
        Black hat hackers
        
        Purpose of committing fraud
        
        e.g. falsifying bank details
        
        e.g. falsifying exam grades
      - use of software
        
        Not everyone is happy to pay for software
        
        breaking through password protection and firewalls
        
        decrypting files
        
        stealing IDs
    - - Def = Where computer systems or data are used by people who are not the intended users
  - - - copyright = legal ownership that applies to software, music, films and other content
      - techniques used to protect copyright
        
        Digital Rights Management
        
        limits access and controls software use
        
        Licensing
        
        Normally used for software
        
        paper based or digital proof put chased software legally
    - - general flow for how data works
    - - inventive and new
    - - Can have another software with same algorithm and same functionality - will have different source code
    - - Original works
        
        instruction manual
        
        computer programs
        
        other types of databases
      - web content
      - original musical works
      - sound recordings
      - films and videos
  - - - police
      - security service
      - prison
      - MOD
    - - Demand an ISP to secretly provide access to a customer’s communication
        
        Internet Service Provider
        
        Secret
      - Enables mass surveillance of communication in transit
      - Demand ISPs to enable surveillance
        
        Hardware or software in place to monitor a node
      - Demand that keys are handed over
        
        cryptographic key
      - Monitor internet activities
      - Not reveal any of the above in court
    - - Part 1
        
        interception of communications, including data
      - part 3
        
        electr
        
        electronic data protected by encryption
- - - - Any item connected to the internet that connects independently of human interaction
        
        smart speakers
        
        smart items e.g. hoovers
      - Issues
        
        Security of the data
        
        Patches not able to be spent so permanently at risk
        
        easy to compromise.
      - Connecting industrial machinery to IoT networks increases the potential risk of hackers discovering and attacking these devices.
        
        Industrial espionage
        
        destructive attack on critical infrastructure
      - Cyberwarfare
        
        Could mean camera networks could be hacked into
        
        Infrastructure that could be hacked
        
        dams
        
        bridges
        
        elements of electricity grid
      - Big Data
        
        Data collected
        
        sensors from machine parts
        
        environment sensors
        
        Words we shout at our smart speakers
        
        traffic flow around the city
      - Cloud
        
        Used due to the amount of data generated.
        
        Examples
        
        Azure IoT suite
        
        Amazon web services
        
        Google Cloud
      - Smart cities.
        
        sensors to help the elderly
        
        how crowded is a beach
        
        offer alternatives to swimmers
        
        structural issues on bridges and railways for cracks and tilts.
      - 5G
        
        will be more capacity to add more devices
        
        outdoor surveillance cameras
        
        nearly 50 million by 2023
      - artificial intelligence.
        
        data collected can be fed through the AI and can be used to make predictions.
        
        e.g. Google and data centre cooling system
    - - Hacked devices can be used to conduct Denial of Service attacks.
      - legislation would require that IoT devices sold in the UK must follow three particular rules to be allowed to sell products in the UK. They are:
        
        All consumer internet-connected device passwords must be unique and not resettable to any universal factory setting
        
        Manufacturers of consumer IoT devices must provide a public point of contact so anyone can report a vulnerability and it will be acted on in a timely manner
        
        Manufacturers of consumer IoT devices must explicitly state the minimum length of time that the device will receive security updates at the point of sale, either in store or online
      - Current issues
        
        default passwords
        
        support from manufacturers may stop. and this will leave them vulnerable.
    - - IoT devices will outnumber the world's population this year for the first time
        
        in 2020 predicted 20.4 billion IoT devices.
    - - Alexa controls other devices
        
        my Alexa controls
        
        Robot hoover
        
        blinds
        
        front door
        
        security (ring system)
      - One study found 35% of manufacturers in the USA had already adopted smart sensors on their production lines
    - - The firm said more than 7.3 billion devices will need to be made secure by their manufacturers before 2020.
      - IoT botnets, created using a network of out-of-date devices took large websites and services offline in 2016
      - A Chinese firm later recalled 4.3 million unsecured connected cameras.
      - Insecure IoT systems led to toy manufacturer VTech losing videos and pictures of children using its connected devices.
      - Wikileaks later claimed the CIA has been developing security exploits for a connected Samsung TV
      - IoT Central
        
        Microsoft has introduced its own system for IoT devices
    - - Top Internet-Of-Things Examples to know
        
        connected appliances
        
        smart home security systems
        
        Autonomous farming equipment
        
        wearable health monitors
        
        smart factory equipment
        
        wireless inventory trackers
        
        ultra-high speed wireless internet
        
        biometric cybersecurity scanners
        
        shipping container and logistics tracking
      - Connected Cars
        
        AIRBIQUITY
        
        software and engineering company that provides over-the-air (OTA) updates and data management services for connected cars.
        
        an choose to have family or friends automatically and immediately notified in the event of a crash.
        
        DASH
        
        receives data from a variety of sensors to keep you informed about your car's current status and immediate or future maintenance needs.
        
        The company's app has a parental control function that allows parents or caretakers to get email alerts if a young driver exceeds set thresholds or tries to circumvent them.
        
        ZUBIE
        
        Zubie offers real-time GPS fleet tracking while monitoring vehicle health and driver performance.
        
        If a driver is in the habit of braking hard or accelerating rapidly, that information can be used to have them avoid potential accidents and increase fuel efficiency.
      - Connected Homes
        
        Tovala’s
        
        provides users with an effortless, mess-free way to cook food, creating a smart oven and meal-kit delivery service that does all the hard work and gives time back to the user.
        
        Whether using Tovala’s own chef-inspired meals or the more than 750 compatible grocery items, Tovala’s smart oven works by scanning QR or bar codes and connecting to WiFI, which it then uses to determine the best temperature and time to cook the food at to avoid undercooking or burning. The Tovala smart oven is also capable of cooking user-prepared meals, making it an excellent option for those with varying degrees of patience in the kitchen.
        
        Wyze
        
        a wide-range of IoT controlled devices and appliances designed to allow users to control the products they interact with more seamlessly.
        
        From connected home products like light strips, cordless vacuums and color-changing bulbs to smartwatches, indoor/outdoor cameras, headphones and more, Wyze makes high quality smart products that are accessible and enriching to many people.
        
        JOSH.AI
        
        provides voice-controlled home automation using a variety of devices.
        
        Got your amp cranked to 11 when an important call comes in and can't find the remote? No problem. You can turn down the volume using your watch, phone, tablet or computer.
        
        INSTEON
        
        lets users monitor windows, doors, water leaks, smoke and more via sensors.
        
        Ever gone on vacation and wondered if you left a window open for thieves and rain to breach? With Insteon, you'll know if that's actually the case so you can return home or call a neighbor to shut it.
        
        WINK
        
        Using a single app, Wink users can monitor and control nearly everything in their homes.
        
        With the Dropcam Wireless Video Monitoring Camera, you can remotely monitor your property to check for damage or intruders.
    - - key enabler of digital transformation
      - automation and analytics system that uses cloud-based IoT networks, sensing, big data, machine learning, and artificial intelligence to create complete systems for a product or service.
      - The actual value or importance of the internet of things comes from collecting valuable data from devices, communicating it, analyzing it, and using it to maximize the efficiency and the services offered by these IoT products.
      - The common building blocks used for IoT system across industries and applications include sensors, wired and wireless solutions, antennas, batteries and few smaller connectors and passive components which fuels low power, interconnect, intelligent things of the eco system.
      - The hardware utilized in IoT systems is equipped with electronic components, such as integrated sensors, smart sensors and actuators, connectivity/communication electronics and software to capture, filter and exchange data about themselves, their state and their environment.
      - Smart environment applications include Smart parking, Smart traffic management, Smart lighting, Smart cities, Smart Metering
      - Some of the IoT sensors which are frequently seen are Proximity Sensors, Position Sensors, Occupancy Sensors, Motion Sensors, Velocity sensors, Temperature sensors, Pressure Sensors, Chemical Sensors, Humidity Sensors, Water Quality Sensors, Infrared Sensors, Gyroscope Sensors, Optical Sensors
      - In the meantime, the big data analytics, machine learning, Artificial Intelligence and deep learning techniques provide a promising solution towards the analysis of IoT sensor data. These technologies are game-changing, and they can be used to automate processes, predict equipment faults, and track security threats in real time. When solutions are completely autonomous, AI uses connected IoT network devices to help lead the way. By applying AI to IoT data management and analytics, organizations can quickly pull valuable information from these massive, heterogeneous data sets and respond to real-time conditions.
      - Generally the IoT sensors have to be in active state all of the time (24/7) and they need power to perform their goal. As the number of sensors in one location grows from tens to hundreds, the energy requirements of sensors cannot be ignored. The best energy source is determined by the specific IoT application, whether it is battery-powered, energy scavenging, DC bus-powered, or mains-powered.
      - some protocols may consume more bandwidth than necessary, drawing excessive power to support it.
      - Any IoT application can be categorized into sensing layer, Network layer, middleware layer and application layer.
      - Cloud computing is based on resource sharing, which is an important requisite for IoT platforms. In the cloud computing process, a huge amount of data is collected from the IoT devices and is stored in external rented servers. The users can access the cloud services from any location via any device that has an internet connection.
- - - - Not all consented data
    - - Risk with unauthorised access
    - - Data sold to other organisations
    - - Concern about gov or other individuals
    - - anything online might stay there for years
    - - accumulation of data above an individual could have a negative impact on an individual