Leonardo H Iwaya

Fausto Giunchiglia
email: fausto@disi.unitn.it

Leonardo A Martucci

Alethia Hume
email: hume@disi.unitn.it

Simone Fischer-Hübner

Ronald Chenu-Abente

Ontology-Based Obfuscation and Anonymisation for Privacy

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In today's Information Society, people are surrounded by information technology in their everyday life. Providers of information services often record and categorize people, or data subjects, into profiles. Profiles consist of personal data that is managed, shared and modified by different information systems; often without the individual's consent [START_REF] Camenisch | Privacy and identity management for everyone[END_REF]. To protect the subject's rights over their personal data, security and privacy are imperative in the design of solutions that handle sensitive information. Security is commonly addressed by means of the principles of confidentiality, integrity, and availability. Privacy, in turn, stands for fundamental rights and freedoms of subjects to have their right to privacy with regards to the manipulation and processing of personal data [START_REF]Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF].

Among current technologies, Healthcare Information Systems (his) are frequent target of information security and privacy researches. The reasons are manifold. HIS are essential and widely-deployed systems that manage highly sensitive data; providers have to comply with security/privacy regulations; and, data breaches might cause expensive penalties and damage to the company's reputation. Notwithstanding, the patient's records have to be shared among multiple healthcare service providers, either for primary and secondary purposes. For instance, Electronic Health Records (ehr) might be distributed, within affiliated hospitals and medical centers (i.e., inter-institutional ehr). In this case, medical data is exchanged for primary use, i.e., meaningful use for patient's treatment, with an implied trusted domain and confidentiality among medical staff. However, ehr are also increasingly being used for secondary purposes, such as release of data for governmental health programs and research [START_REF] El Emam | Methods for the de-identification of electronic health records for genomic research[END_REF]. ehr can also be integrated to Personal Health Records (phr)(e.g., HealthVault 3 and PatientsLikeMe 4 ), and consecutively linked to all sorts of patient-centered and patient-controlled information systems (e.g., mobile healthcare). These multiple data flows add further concern regarding security and privacy.

One way, that we focus in this paper, to cope with the dilemma between data sharing and data privacy refers to the use of abstractions; in particular the use of obfuscation and anonymisation. In our research we are considering the concept of abstraction as a broader field -that remains to be understood. By abstraction we mean, the process of mapping a problem representation onto a new one, preserving certain desirable properties and reducing its complexity [START_REF] Giunchiglia | A theory of abstraction[END_REF]. Particular cases of abstraction studied here are obfuscation and anonymisation.

By obfuscation we mean, to lower individual data item accuracy in a systematic, controlled, and statistically rigorous way [START_REF] Bakken | Data obfuscation: Anonymity and desensitization of usable data sets[END_REF]. By anonymisation, we intent to protect privacy by making a number of data transformations so that individuals whom the data describe remain anonymous 5 . In this case, data transformations are essentially obfuscation functions that can achieve anonymity. Anonymity, in turn, is a property of an individual that cannot be identified within a set of individuals, the anonymity set [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, unlinkability, undetectability, unobservability, pseudonymity, and identity management[END_REF]. The anonymisation process can have variable degrees of robustness [19], depending on how likely is to: 1) single out an individual in the dataset; 2) link records concerning the same individual; or, 3) infer the value of one attribute based on other values. Therefore, we claim that anonymisation is a special case of obfuscation; and accordingly, obfuscation is a special case of abstraction.

In this paper, we aim to investigate the problem of data obfuscation and its particular case of anonymisation, through the use of a privacy-enhancing ontology-based obfuscation mechanism for releasing phr and ehr to selected audiences with different degrees of obfuscation. Data minimisation and access control are supported, as different actors, e.g., doctors, nurses and managers, will need to get access to the just amount of information needed for their tasks. In addition, an ontology-based obfuscation can be used to decrease the semantic loss, i.e., maintain a high degree of utility of the anonymised data. This research contributes to: stating the problems in the area; reviewing privacy and data protection legal requirements; discussing ontology-based obfuscation and anonymisation methods; and defining relevant healthcare use cases. As a result, we present the early concept of our Ontology-based Data Sharing Service (O-DSS) that enforces patient's privacy by means of obfuscation and anonymisation functions.

This paper is organized as follows. In Section 2 we briefly motivate this research with respect to the legal aspects of privacy and data protection regulations and legislations around HIS. In Section 3 we provide a summary of the relevant terminology, existing methods for data obfuscation and anonymisation, and related work on ontology-based approaches. In Section 4 we introduce a preliminary design of our privacy-preserving O-DSS. In Section 5 we discuss the research future work, and in Section 6 we present our conclusions.

Data Protection Regulations and Legislation

The European legal privacy framework that we will in this section refer to is based on the EU Data Protection Directive 95/46/EC [START_REF]Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF] and the upcoming General EU Data Protection Regulation (GDPR) [START_REF]Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[END_REF], which was approved by the European Council in June 2015 and is expected to replace the national laws implementing the Directive in the near future (probably in 2016).

For the Health Care section, there is no specific harmonized EU data protection legislation, as this is rather regulated by different national legislation that takes consideration of the national different heath care practices.

Still, the general rules of the Directive and soon of the GDPR will apply unless there are overriding (national or EU) legal rules.

Of particular importance for motivating our work is the general privacy principle of data minimisation included in the Data Protection Directive and Regulation, for instance cf. Art. 5 (c), (e) GDPR: Personal data should be: "(c) adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed"; "they shall only be processed if, and as long as, the purposes could not be fulfilled by processing information that does not involve personal data (data minimisation)"; and "(e) kept in a form which permits direct or indirect identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed"; Furthermore, the Art 23 of the GDPR requires that the data controller should follow a Data Protection by Design and by Default approach by implementing "technical and organisational measures appropriate to the processing activity being carried out and its objectives, such as data minimisation and pseudonymisation...".

Besides the European framework, in the United States the Health Insurance Portability and Accountability Act of 1996 (hipaa), is also another well-known example of regulatory mechanism for privacy. Some of the most traditional methods (e.g., k-anonymity) as well as the HIPAA's standards for anonymisation/deidentification are discussed in Section 3.

Background and related work

According to [START_REF] Giunchiglia | A theory of abstraction[END_REF], the process of abstraction relates to the process of separating, extracting from a representation another "abstract" representation, which consists of a brief sketch of the original representation. Therefore, the same authors were able to informally define abstraction as: the process of mapping a representation of a problem onto a new representation, which helps to deal with the problem in the original search space by preserving certain desirable properties, and, is simpler to handle. This concept was originally define in the field of artificial intelligence, in which abstraction refers to reasoning. Likewise, the objective of obfuscation also incorporates the very same elements. Obfuscation is a reasonable transformation of the data that preserves certain properties (e.g., semantics, analytics, statistics), and typically entails generalization. That is why we also define obfuscation (and anonymisation) as special cases of this broader theory of abstraction.

For this research, we are particularly interested in abstractions that can be supported by ontology-based knowledge representations to either obfuscate or anonymise values. In addition, we also consider practical aspects of the healthcare field, such as: clinical vocabularies and ontologies that are employed in the data structures used in ehr. This and other concepts that are grounding our work are explained and briefly discussed in this section.

EHR's data elements

Medical standards for EHR vary from one country to another, but the Health Level Seven (HL7) and Comite Europeen de Normalization -Technical Committee (CEN TC) 215 are probably the most renowned ones. The HL7 group develops the most widely messaging standard for healthcare in United States. The CEN CT 215 operates in 19 European member states and is the main healthcare IT standards in Europe. The work of such organizations is important to achieve interoperability among HIS, which for EHR refers to the definition of clinical vocabularies, message exchange formats, and EHR ontologies. In the present research, however, we are only interested in how to exploit the structured vocabularies and ontologies during the anonymisation process.

In brief, clinical vocabularies or standard vocabularies are used to agree upon the use of medical terminologies when writing in a patient record. All the terms are usually encoded in order to facilitate data exchange, comparison, or aggregation among HIS. Some established examples are the International Classification of Disease (ICD6 ) and the Systematized Nomenclature of Medicine -Clinical Terms (SNOMED-CT). Nevertheless, data elements inside EHR may also be in free-form text, for example, clinician's notes. Any anonymisation method for EHR needs therefore to cope with structured data elements as well as form-free running text.

Conventional anonymisation methods

The k-anonymity, formulated by Sweeney [START_REF] Sweeney | k -Anonymity: a Model for Protecting Privacy[END_REF], was one of the first and wellknown formal methods that address the issue of data anonymisation. In a more formal definition, the initial scenario consists of a data holder that held a collection of person-specific, field structured data; and wants to share a version of this data with researchers. The data holder considers the following problem [START_REF] Sweeney | k -Anonymity: a Model for Protecting Privacy[END_REF]: "How can the data holder release a version of its data with scientific guarantees that the individuals who are the subjects of the private data cannot be re-identified while data remain practically useful? " The solution is the k-anonymity property, which means that the information for each person contained in the released data cannot be distinguished from at least k-1 individuals whose information also appear in the released data. In brief, anonymised data with k-anonymity property guarantee an anonymity set size of k -1.

To do so, the program receives as input a table with n rows and m columns, in which each row of the table represents a person-specific record of the population and the entries in various rows should not be unique. The algorithm than applies two different methods to achieve k-anonymity:

-Suppression, certain values have to be simply replaced by an asterisk * . For instance, person direct identifiers should be omitted (e.g., name, address, phone, personal numbers). -Generalization, individual values of attributes are replaced by broader category. For instance, an attribute 'age' can be replaced by a range of values, i.e, age 21 by ≥ 20 .

The k-anonymity offers a straightforward and to some extent effective method, but the approach is still susceptible to homogeneity and background knowledge attacks, leading researchers to the design of improved version, such as l-diversity [START_REF] Machanavajjhala | L-diversity: Privacy beyond k-anonymity[END_REF] and t-closeness [START_REF] Li | t-closeness: Privacy beyond k-anonymity and l-diversity[END_REF]. All these methods are, however, somewhat naive when dealing with non-numerical values and are unable to maintain enough semantic coherence after anonymisation [START_REF] Martínez | Ontology-based anonymization of categorical values[END_REF]. To cope with semantics, many authors proposed different ontology-based anonymisation methods, further explained in the next section.

Besides the formal methods for data anonymisation, we could also consider heuristic-based strategies. For instance, with respect to the hipaa Privacy Rule [START_REF]OCR: Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule[END_REF], the EHR can be de-identified using the "Safe Harbor " standard. In this case, a number of 18 types of identifiers that compose the Protected Health Information (PHI) should be removed. Safe Harbor is a very simple approach, but it does not provide any scientific guarantees for anonymity sets nor protection to re-identification attacks [START_REF] Benitez | Evaluating re-identification risks with respect to the hipaa privacy rule[END_REF]. Fortunately, the hipaa Privacy Rule also considers a second standard called "Expert Determination", which means the application of statistical or scientific principles to reduce re-identification to a very small risk.

Ontology-based approaches

An ontology is a method for knowledge representation, which uses a formal, explicit and machine readable structure of concepts hierarchically interconnected by a semantic network [START_REF] Fensel | Ontologies[END_REF]. These powerful data structures enable knowledge organization, sharing, and emulation of cognitive processes and / or common understandings of specific domains. We are particularly interested in the concept of semantic obfuscation of ontology-based systems that can be used to restrict the release of information according to the audience. A few ontology-based privacypreserving mechanisms were recently proposed. In this section, we made an effort to summarize and briefly evaluate the findings of these studies.

Access control and context obfuscation. In a more generic approach, the work of [START_REF] Wishart | Context obfuscation for privacy via ontological descriptions[END_REF] proposes a context obfuscation mechanism for pervasive networking and context-aware programs. The system allows the users to set different privacy preferences and stipulate rules to control the access of context information. In brief, all the attributes related to an user can have different access control settings for information, depending on the context, requesters, and use purposes. Besides the privacy preferences, the user can also define granularity levels of access, which is based on ontological structures that can capture the granularity relationship between instances of an object type.

For example, when the patient Alice wants to give to her doctor Bob access to her attribute Diagnosis, she configures her privacy preferences as follows:

privacy_pref_list.add_rule( consumer = Bob, attribute = Diagnosis, purpose = Treatment, allow = True )

In addition, Alice can set the generalization level l ∈ Z that should be applied to the attribute. The higher the level, the higher the generalization level would be, i.e., going upwards in the ontology (for instance, see Figure 5). This context obfuscation mechanism was already used in [START_REF] Rahman | Prisn: A privacy protection framework for healthcare social networking sites[END_REF], to provide a privacy-preserving and granular access control to PHR. The authors, however, are still missing the link with real ontologies and medical vocabularies, which could greatly improve the obfuscation quality in real HIS systems.

Ontology-Based Anonymisation. An ontology-based data set anonymisation with categorical (i.e., textual) values is proposed by Martínez et al. [START_REF] Martínez | Ontology-based anonymization of categorical values[END_REF][START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF]. They aim at preserving data semantics of anonymised values. The proposal relies on a set of heuristics to optimize obfuscation, and ensure scalability in cases of heterogeneous data sets and wide ontologies. In addition, their algorithm also employs k-anonymity to provide a minimum set of privacy guarantees. To do so, the solution relies of the measurement of the semantic similarity, i.e., to quantify the taxonomical resemblance of compared terms based on a knowledge base. Therefore, it is possible to semantically compare, rank and group the most similar record values. Subsequently, the method aggregates values in a group, which refers to the process of replacing the values in several records by a single one, summarizing and making them indistinguishable (i.e., k-anonymity set). This operation performed by means of the author's proposal of a centroid calculus for multi-variate non-numerical data, to obtain accurate centroids in a group (for further details we refer the reader to [START_REF] Martínez | Ontology-based anonymization of categorical values[END_REF][START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF]). Their use case [START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF] provides a more concrete example of ehr anonymisation, including many categorical values from snomed ct, which makes the method's applicability more realistic.

Ontology-based Identity Management and Access Control

In [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF], the authors introduce the concept of a privacy-enhanced Peer Manager, in which the original idea was designed to preserve privacy in collective adaptive systems. The Peer Manager works as an user-centered identity management platform that keeps user's information private. This framework was built upon the privacy policy language PPL (PrimeLife Policy Language), with which every user can control his personal information by imposing access and usage control restrictions. As a privacy-enhancing structure, this platform instead of directly allowing access to peer's information, creates a Profile structure that are sent as replies to queries. The created Profile, in turn, reveals only partial or obfuscated information about the Entities. In essence, the Peer Manager never discloses the Entities' original data, but derived Profiles previously defined by the users. Besides, if compared to [START_REF] Wishart | Context obfuscation for privacy via ontological descriptions[END_REF], the Peer Manager supports a far more general and robust approach for access control and obfuscation.

Putting things together

The approaches discussed here employ obfuscation in different scenarios yet with similar goals. In summary, we aim to integrate the proposals [START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF] and [START_REF] Wishart | Context obfuscation for privacy via ontological descriptions[END_REF] into the Peer Manager [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF] obfuscation functions, and thus, demonstrate how it can be applied to healthcare systems (e.g., ehr and phr) using real medical ontologies.

Obfuscation and anonymisation for HIS

Health information is, in general, managed by systems for primary purposes, i.e., the provisioning of health care to the benefit of the patient. It is noteworthy, however, that aforementioned requirements are still valid, such as trusted medical environment, with implied confidentiality among healthcare workers. The medical institutions usually are the data custodians in case of EHR, and thus, any data breach is the institution's responsability. Security mechanisms in the EHR should provide confidentiality, integrity, availability, and make personnel accountable for unauthorized data release, by means of logging and auditing tools.

Nevertheless, health care services also use the health information for secondary purposes, such as general public health monitoring, evaluation of healthcare programs, and research. In the case of a secondary use, data should be subject to de-identification or anonymisation, such as the aforementioned Safe Harbor and Expert Determination standards from hipaa. In this section we explain how obfuscation and anonymisation can be used in the healthcare context.

Ontology-based Data Sharing Service

We propose an ontology-based data sharing service (o-dss) to mediate access to healthcare data sets. Many his applications fit in this scenario. In this preliminary research we focus on Semantic Obfuscation (so) and Data Anonymisation (da) for standard his, such as ehr and phr. In brief, we consider the following use cases and their information flows:

1. Primary Use ehr → o-dss (so) → privacy-preserving patient treatment (hospital and clinics). phr → o-dss (so) → patient's granular control of own health.

ehr ∪ phr → o-dss (so) → reminder or alert systems for family or caregivers.

Secondary Use

ehr ∪ phr → o-dss (so + da) → medical research repository.

ehr ∪ phr → o-dss (so + da) → nationwide his network.

Each information flow refers to a different branch of this use case (examples of flows 1, 2, and 4 are depicted in Fig. 1). Therefore, the so and da techniques should deal with different requirements, according to the target application of the data. In what follows, we provide further details of each use case. UC1: Privacy-preserving patient treatment Patient's data can be accessed by clinicians, nurses, secretaries, and accountants for many purposes inside the hospital. All the employees are making meaningful use of the data, and therefore, they are under an implied confidentiality agreement. Furthermore, medical institutions also are allowed to share ehr among affiliated institutions and healthcare services -still, the institution is liable for the data's confidentiality. In such cases, it is more important to enforce access control and, in a privacy-preserving perspective, apply data minimisation whenever possible to reduce risks of data leakage.

UC2: Patient's granular control of E/PHR phr are being increasingly used by patients to track their own daily activities (e.g., wellness and fitness applications), or to have an interface to their ehr (e.g., patient web portals or dashboards). In particular, if patients transfer their data to private services (non-medical) that support the management of health records (e.g., Microsoft HealthVault), than, the medical institutions might not be liable for the secrecy of released data. This user-centered applications encourage patients to have more control of their own health, and also, provide means to granularly share phr with other healthcare services, social networks, family, and so on. In this case, we consider that patient consents with the data release, but mechanisms should provide the patient with granular control in the form of selective disclosure and obfuscation options in dependence on the different data consumers.

UC3: Reminder or alert systems Reminder systems are commonly used for drug treatment compliance, and can be linked to ehr, to provide reminders to out-patients or chronic patients. Some alert mechanisms also exist, providing ehr access to family members and caregivers in case of emergencies. As presented in Figure 1, the data flows might come from ehr or phr, since there are private non-medical services that support this applications. This use case has privacy requirements that are similar to UC2, since the user can have directly configure access control settings. UC4: Medical research repository ehr are frequently used as source of clinical information for medical-related research. To do so, ehr are usually deidentified and/or anonymised before releasing the data, in which cases there would be no need of patient's consent; exceptional cases of non-medical research, e.g., marketing or financial studies.

UC5: Nationwide HIS network Similarly to UC4, more ambitious projects aim to create nationwide HIS networks, that would interconnect ehr systems within a country (i.e., primary use), or even, medical repositories for research (i.e., secondary use) -also knows as translational research information system (TRIS). For instance, in [START_REF] El Emam | Methods for the de-identification of electronic health records for genomic research[END_REF], the authors examine the privacy issues on building a database integrating clinical information from an ehr systems with a DNA repository.

SO and DA functions

The o-dss provides two fundamental functions: semantic obfuscation (so) and data anonymisation (da). The so function is specially grounded on the proposals: peer profiling [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF] and context obfuscation [START_REF] Wishart | Context obfuscation for privacy via ontological descriptions[END_REF]. That is, we aim to partially show or obfuscate the record (i.e., to provide data minimisation instead of anonymisation), based on the concept of Peer Manager for access control, and also, exploit the medical ontologies for data obfuscation.

The da is grounded on k-anonymity [START_REF] Sweeney | k -Anonymity: a Model for Protecting Privacy[END_REF] and improved techniques presented in [START_REF] Martínez | Ontology-based anonymization of categorical values[END_REF][START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF]. Figure 2 illustrates how the o-dss manages the data flows to provide so and da. Besides, in Figures 3 and4, o-dss is placed into context in line with aforementioned use cases.

Primary use and semantic obfuscation. In the case of primary use, the semantic obfuscation (so) acts as a data minimization mechanism. The objective is to restrict the amount of health information that should be disclosed for a specific task (e.g., visualize a patient record or check a doctor's schedule) and to a specific person or role (e.g., a nurse) to the required minimum. Healthcare Personnel from different Departments will have different access right: nurses will only have access to ehr of patients that they are treating; psychiatric diagnoses, might only be seen by psychiatrists, but not by other treating doctors (who may however see that a psychiatric diagnosis exists); and, values about blood infection/HIV would be read by all Healthcare Personnel for employee's security reasons.

We define two sets of actors: data providers (P ), i.e. the data subject (patient, PHR user) and data requesters (R), where R makes queries to P about specific health information.

Alice ∈ P is first registering with the Peer Manager that acts as a data controller and enforces the Alice's privacy preferences on her behalf. The Peer Manager provides Alice with a set of PPL policies for different peer profiles representing partial identities that the Peer Manager should manage on Alice's behalf. Alice can either choose from this set of policies or construct her own policies for profile. For enabling that Alice can determine different semantic obfuscations for different "audiences", PPL is extended with obligations to apply different obfuscation operations at different granularity along a specified ontology hierarchy in dependence of different data requesters or roles of data requester (that correspond to different "downstream controllers" in PPL terminology). Alice is sending his profiles together with the PPL policies that should apply for these profiles to the Peer Manager. Once when Bob ∈ R makes queries to Alice about specific health information, following the approach in [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF], the request has to be mapped into a profile of Alice ∈ P that will be returned to Bob. Hence, before replying, the Peer Manager would check the access rights that Alice has given to Bob, i.e., the profile that Alice has decided to reveal to Bob for a given task and purpose (according to the PPL policy that Alice has defined or chosen for that profile). Furthermore, if the access conditions are fulfilled, i.e. data is to be forwarded to a so-called downstream controller (Bob), the obfuscation obligations that were defined in the policy for the event of data forwarding are first triggered by the Peer Manager: Within the revealed profile (i.e., an attribute-based description of Alice), the ontology-based semantic obfuscation is applied to each attribute, allowing Alice to obfuscate its data with different granularity levels (i.e., different semantic level) according to the obfuscation obligations defined in the profile's PPL policy for downstream controller Bob (or for his role). Thus, as shown in Figure 6, the Peer Manager follows the PPL obligations, e.g., executing the obfuscation functions accordingly.

Different attributes with different types of values will require appropriate ontologies/mechanisms to obfuscate them. The Figure 5 shows an example of how the ontology-based obfuscation can be used on an attribute describing diagnosis of a patient in order to abstract the information revealed to different requesters (namely, family member, medical staff, or doctor). Another way to perform semantic obfuscation in a patient's profile is by revealing different subsets of attributes (i.e., complete obfuscation of some attributes). For instance, a doctor would be able to retrieve the list of prescribed medications from a patient while a hospital accountant would only see the aggregate drug cost. Hence, Bob's access rights determine the accuracy of how data is accessible, i.e. the level of achieved obfuscation. Some important distinctions from the work of [START_REF] Wishart | Context obfuscation for privacy via ontological descriptions[END_REF], we did not emphasize the use of context, which would allow Alice to further refine her privacy preferences based on her location and current activity. Nonetheless, our proposal considers that the so function should exploit real medical vocabularies, such as ICD-10 and SNOMED-CT, instead of using ad-hoc or domain specific ontologies. Moreover, we integrate our mechanism with the Peer Manager [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF], which provides a more sophisticated access control model.

Secondary use and data anonymisation. If an entire data set of health information has to be shared for a secondary purpose with a data processor, such as a public health organization, an ontology-based semantic obfuscation / anonymisation can maximize data utility by preserving the data semantics while eliminating personal information from the data set to the degree required, i.e., the mandatory data anonymisation (da) process. The data consumer is usually a third party, such as a research institution or a public service that need the data for secondary purpose (see Figure 4). Also in this case the general notion of abstracting the information of profiles, as proposed in [START_REF] Hartswood | Privacy for peer profiling in collective adaptive systems[END_REF], can be applied. The main difference is that a data consumer is now asking for the whole set of, for instance, patients profiles. Before replying, the peer manager should be able to find/compute a profile for each peer (i.e., patient) in the data set such that certain level of anonymity is guaranteed. For example, if the peer agreed to reveal information for a secondary purpose provided that k-anonymity is guaranteed, then the anonymisation process has to be applied (i.e., follow PPL obligations) to attributes of profiles until such requirement is achieved. Considering again the example from Figure 5 and the attribute describing the diagnosis on each peer's profile, the anonymisation process needs to select the level of detail to be included in the revealed profiles such that a given patient's record can not be re-identified by their diagnosis. For these cases, the ontology is important to improve the data utility during the mandatory data anonymisation (da) process. Here we adopt the solution presented in [START_REF] Martínez | A semantic framework to protect the privacy of electronic health records with non-numerical attributes[END_REF], that enables k-anonymisation of structured non-numerical medical retaining semantics by using SNOMED-CT as knowledge base.

Moreover, by exploiting real medical vocabularies in the ontology-based obfuscation the approach becomes more robust and usable in real scenarios dealing with E/PHR. Another important feature to highlight is that a solution designed in this way is scalable in terms of the underlying ontology being used, i.e., the ontology can change, evolve or grow while the above approach is still applicable.

Future Work

Currently, we have mainly positioned how ontologies-based obfuscation and anonymisation can be used in HIS; by addressing legal requirements, reviewing many of the existing methods and putting them into the context of HIS. We also show how so and da can be used together with the Peer Manager and PPL. Notwithstanding, we noticed that concepts could be refined, and the link between theory of abstraction and obfuscation can be further formalized. In a broader sense, we aim to understand how the areas the privacy and the ontology areas could cooperate, in order to support data privacy.

Apart from that, future work has many challenges that remain to be addressed. Currently, we are not discussing the usability issues for setting all the privacy preferences for SO and DA. In addition, regarding obfuscation, the problem of inferences by correlations (e.g., infer the patient's original disease given the list of drugs/medical procedures) is still open. And for DA, we are considering mainly k-anonymity (i.e., anonymisation by generalization), but other methods based on randomization (e.g., noise addition, differential privacy) are also worthy considering. A complete solution would make use of many different DA methods.

Conclusions

This paper presented the use of a privacy-preserving ontology-based obfuscation mechanism intended to obfuscate health information either for primary or secondary use. In the case of primary use, minimization of personal data means that an actor gets no more information than needed and with an appropriate semantic level. For secondary use, the proposed mechanism can minimize the semantic loss of data, such that a high degree of utility is maintained, while data is anonymised to the specified da requirements. Additionally, we described five use cases to illustrate the o-dss, and we discussed how it can be integrated with the existing Peer Manager. Obfuscation capabilities were expected in the PrimeLife and Smart Society (i.e., Peer Manager) projects, but there were no clear examples on how to use them. The obfuscation functions can be implemented by extending the obligations in the PPL policy, defined between data requester and data controller, and thus, allowing so and da over the attributes.

Fig. 1 :

 1 Fig. 1: A healthcare use case for ontology-based obfuscation for his. The dashed boxes are the data requesters r ∈ R, and ehr and phr are the data providers p ∈ P . The ontology-based data sharing service obfuscates data from p that is communicated to r.

Fig. 2 :

 2 Fig.2: o-dss processes for so and da.

Fig. 3 :

 3 Fig. 3: Data release/sharing for (a) cross-institutional patient treatment and (b) usercentered (ontology-based) obfuscation and granular access control for PHR.

Fig. 4 :

 4 Fig. 4: Data release/sharing to create research repositories.

Fig. 5 :

 5 Fig. 5: Example of ontology-based obfuscation.

Fig. 6 :

 6 Fig. 6: Obfuscation process with Peer Manager and PPL.

http://www.who.int/classifications/icd/en/

Acknowledgments

The authors gratefully acknowledge Hans Hedbom for his assistance with PrimeLife Policy Language and reviews that helped to improve the manuscript. Furthermore, the authors also thank Rose-Mharie Åhlfeldt, anonymous reviewers and participants of IFIP Summer School (2015), whose comments and suggestions greatly contribute to enhance and clarify our work.

This research was funded by SmartSociety, a research project of the Seventh Framework Programme for Research of the European Community under grant agreement no. 600854.


Andreas Baur-Ahrens
email: a.baur-ahrens@uni-tuebingen.de

Felix Bieker

Michael Friedewald

Christian Geminn
email: c.geminn@uni-kassel.de

Marit Hansen

Murat Karaboga

Hannah Obersteller

Smart Technologies -Workshop on Challenges and Trends for Privacy in a Hyper-connected World

Keywords: Data Protection, Ethics, Internet of Things, Regulation, Smart Cars, Privacy, Smart Devices

In this workshop we addressed what it means to live in a smart world with particular regard to privacy. Together with the audience, we discussed the impacts of smart devices on individuals and society. The workshop was therefore interdisciplinary by design and brought together different perspectives including technology, data protection and law, ethics and regulation. In four presentations, a range of issues, trends and challenges stemming from smart devices in general and smart cars in particular -as one example of an emerging and extensive smart technology -were raised. In the discussion, it became clear that privacy and its implementation are at the core of the relationship between users on the one side and smart appliances as well as the technical systems and companies behind them on the other and that there is an ongoing need to broaden the understanding of privacy in the direction of a social and collective value.

Introduction

Smart devices are invading more and more aspects of our everyday lives. They can assist their owners while driving, while working out, while shopping and in the context of many other activities. Whereas first generation devices often lacked the refinement necessary for immediate economic success, they still acted as a window into the future by demonstrating the seemingly endless possibilities of a "smart world". Today, some smart devices and systems are already well established, for instance those that are concerned with assisted driving, whereas others, like smart glasses, remain experimental. At this stage of the technological development of smart appliances, it is worthwhile and necessary to have a thorough look at the effects and challenges that the technology poses to privacy. Coming from different professional and academic disciplines, we therefore provided four perspectives on smart devices in order to make an interdisciplinary contribution to their assessment.

(1) While some smart technologies, like smart cars, are comparatively new to the market and are still under development, the general challenges for privacy resulting from connection and interaction are not new at all. From a technical perspective, the question arises as to whether and how we can learn from experiences with internet and smart phone usage concerning data traces, profiling of users and a lack of transparency to foster a privacy-enhancing design of smart cars and their infrastructure.

(2) From a legal perspective, the increasing quantity and quality of smart devices and appliances is foremost a challenge to the right to respect for private and family life as well as the right to protection of personal data as established in the Charter of Fundamental Rights of the European Union. Furthermore, national constitutional rights like Germany's right to informational self-determination come into play.

(3) From an ethical point of view, a world where decisions are increasingly influenced -or even made -by smart and data gathering devices raises an array of questions. For instance, which opportunities for action do we value as crucial for human beings and how much control do we hand over to technologies and technical systems? One way of addressing these questions is to look at the structural and diffuse power relations that govern the field. This is not only related to the power of smart technologies themselves, but also to the power of social actors enhanced by smart devices and the power of concepts, e.g. "efficiency" that might oppose values like individual privacy. A broad concept of power can help to evaluate the impact of a world of smart appliances.

(4) The challenges that smart devices entail for privacy in modern societies necessitate solutions that are aimed at providing a reasonable balance between the interests of users, state actors and economic players and on a more generic level between socially desirable and unacceptable technological developments. With reference to the aforementioned legal and ethical perspectives, a political science point of view dealt with the question, which particular regulatory measures are taken into consideration in order to shape the digital future in a socially appropriate and sustainable manner.

Thus, the workshop was structured in a way that allowed for discussion and questions after the first half and at the end of the workshop. Therefore the first two presentations were focused on smart cars as one particular example of an emerging and potentially highly intrusive smart technology and examined them from both a technological and a legal perspective. The two following presentations also formed a unit. Here, we took a step back and emphasised on the ethical and regulatory issues of smart devices in general. In the concluding discussion, which was open to the floor, an interdisciplinary reflection took place.

Workshop Content

The workshop began with a short introduction by the organisers, giving a broad over-view of the topic, including more general challenges and trends resulting from current technological developments in the field of smart devices. In the following, we summarise the input given in the presentations:

Privacy Risks for Smart Car Users -Lessons Learned from Internet and Smart Phone Usage

The workshop started with a presentation on the challenges for privacy arising from technology itself. It was aimed at giving the audience a basic understanding of the kind of data that is collected by a smart device, of data flows, as well as possibilities of tracking and profiling the user. In order to give a comprehensive example with great practical relevance, the presentation focussed on the privacy risks posed by smart cars, [START_REF] Hansen | Das Netz im Auto & das Auto im Netz[END_REF][START_REF] Hansen | Zukunft von Datenschutz und Privatsphäre in einer mobilen Welt[END_REF], which also allowed the elaboration of the economic exploitation of user profiles by private companies. Focusing on the technical background and consequences for the user who is faced with smart devices, and thereby outlining the issues from a technical and data protection perspective, the presentation also served as a general introduction to the issues raised in the following talks. The starting point was a comparison of the rapidly advancing technologies behind smart cars with -already well-established -smart phones. It was argued that -from a technical point of view -the same data protection issues were present. Consequently, now that the number of smart cars is increasing and a strategy for handling upcoming issues has to be found, it is advisable to take a look back to earlier developments and learn from shortcomings, close gaps, and thereby create a framework which allows us to benefit from the technical progress, but which also respects the rights of individuals. Here, three main aspects have to be considered: Internet and telecommunications are used for functionalities provided in the car, information from and about the car is not only processed locally, but also in the external communication networks or even in data clouds, and finally, the car and its components have to be regarded as network nodes.

Smart cars, -every single component which makes the car a smart one -gather manifold kinds of data from manifold sources. Most of it is to be considered as personal data and as such falls under data protection legislation. The data is collected by several sensors, is transmitted with different techniques and is potentially stored and exploited in multiple ways. In smart cars, the following data concerning the vehicle is accumulated and accessible via the OBD-II-port ("On-Board Diagnostic System") in particular: the Unique Mobile Device Identifiers all mobile devices have, the numbers of SIM cards used for transfer of data needed for instance for voice controlled components (such as navigation assistance), MAC addresses of those network components needed to connect with WiFi hotspots, Bluetooth identifiers as far as Bluetooth is employed to connect for instance a smart phone with the car, RFID identifiers as they are needed for key remote controls. Whenever the respective devices or on board components communicate with the external world, this data is also transferred. Furthermore, information on the device setting (e.g. language) is communicated. This "phenomenon" is not new, but very similar to the functioning of internet browsers.

In addition to these issues already known from former technological achievements, smart cars are equipped with multiple sensors, which measure the status of mechanical car components. This means that, for example, data on tire pressure, the state of engine and gears, as well as brake performance is collected and error messages are stored. Also, in most modern cars GPS transmitters are installed. They make it possible to collect data on the exact position of a car, the direction it is going, and generally deliver more precise results than what can be achieved by tracking the vehicle via speed mobile radio cells and WiFi hotspots [START_REF]Government Accountability Office: In-Car Location-Based Services: Companies Are Taking Steps to Protect Privacy, but Some Risks May Not Be Clear to Consumers[END_REF]. Besides car data, data directly related to the driver and/or passengers is collected: The driver has to create a user account first in order to make use of the smart components of the car. For this purpose, personal data like name and address must be indicated. The smart car is able to store different preferred settings (from side mirrors to infotainment) for different drivers. Biometric data may be used to identify the driver as authorised to drive the car. Finally, some systems monitor and analyse driver medical data (e.g. heartbeat or eye movement) in order, for example, to detect signs of fatigue. All this data is collected and can be extracted from the smart car. Yet, another parallel to former technological developments is that many business models to use this data in a meaningful way already exist or are under development. Car insurance companies that offer insurance policies following the 'pay-as-you-drive' model are just one example. This means that all relevant data from the car is analysed by the insurance company and an individual insurance rate is calculated accordingly.

Another example is the "expansion" of big mobile phone or IT companies into the automobile sector (mainly with the goal of integrating their system software into the car and facilitating a connection to their mobile devices) [START_REF] Kelly | Consumers are in the Connected Car's Driver Seat in 2015[END_REF]. Just like internet user data, driver data can be analysed to offer more personalised and more specific services -like personalised maps or navigation services -which are able to take into account personal habits of the driver. This means, for instance, that the driver can choose not to drive routes which pass casinos or ex-partners' homes. All this data needs to be transferred to the service providers. This creates "usage patterns" just as they are known from internet usage. Data footprints allow the identification and tracking of the driver. Furthermore, due to the enormous volume of data that is collected, and of course for practical reasons, smart car data is often stored in the cloud. This raises the question of how it can be guaranteed that data is only used for the purpose it was collected, not merged or aggregated beyond this dedication and not accessed by an arbitrary amount of parties. As shown above, this driver data is potentially even a different quality of personal data as it brings together personal data on habits and activities, internet usage and health (e.g. control of eye movement) and thereforeespecially in combination with personal settings -can be used to create very precise profiles of drivers. This makes the question of secure storage and access to those profiles even more delicate. Of course, these issues are well known from established online services. With respect to the developing market of smart cars, a repetition of history should be avoided.

Research on data-minimising techniques and methods for use in smart cars is ongoing. But although interesting approaches, such as a frequent change of pseudonyms have been put forward, they are not yet "market-ready" [START_REF] Troncoso | On the Difficulty of Achieving Anonymity for Vehicle-2-X Communication[END_REF].

Smart Cars as Challenges for Data Protection

The second presentation dealt with the challenges that smart cars pose to data protection law. As demonstrated above, smart or connected vehicles introduce technologies that were previously predominantly associated with smartphones and big data analysis into the traffic arena ( [START_REF] Weichert | Datenschutz im Auto -Teil 1[END_REF], pp. 201 et seq.). Motor vehicles have always been considered to be symbols of freedom and independence and as such they hold special meaning for society as a whole. In the Seventies, Germany's largest automobile club, ADAC, created the slogan "Freie Fahrt für freie Bürger" which loosely translates to "Free driving for free citizens" as a reaction to an initiative to limit the maximum speed on German motorways. The slogan has been exploited for numerous agendas since then, but its ongoing popularity still highlights people's association of driving with freedom.

Cars in particular are seen as private spaces and despite the many windows and the need for adherence to traffic regulations, for social interaction and for cooperation with other drivers, most drivers seem to have high expectations of privacy when travelling in their cars. 1 As shown in the first presentation, the technical capabilities of smart cars allow for the collection of massive amounts of highly detailed personal data which can be compiled to create profiles regarding driving, usage, communication, movement, behaviour and relationships. These profiles can in turn be used to predict future actions. Thus, smart cars may not adhere to the expectation of privacy and freedom that cars are usually associated with.

Cars and driving affect -and are affected by -a number of basic rights; foremost those that guarantee mobility like Art. 45 I of the Charter of Fundamental Rights of the European Union (CFR, 2012/C 326/02), those that are concerned with life and integrity of the person like Art. 2 I and 3 I CFR, and those concerned with property like Art. 17 I CFR ( [START_REF] Roßnagel | Grundrechtsausgleich beim vernetzten Automobil[END_REF], pp. 353 et seq.). However, mobility and safety are also prerequisites, means and requirements, for instance for the freedom to choose an occupation and the right to engage in work (Art. 15 CFR), as well as the freedom to conduct a business (Art. 16 CFR). Furthermore, cars can be the subject of research and thus of Art. 13 CFR. Interconnectedness means that even more basic rights come into play; particularly the right to respect for private life and communications (Art. 7 CFR) and the right to protection of personal data (Art. 8 CFR) ( [START_REF] Roßnagel | Grundrechtsausgleich beim vernetzten Automobil[END_REF], p. 354). We have to ensure that smart cars are designed in a way that aids in the exercise of these rights and does not hinder them ( [START_REF] Rieß | Privacy by Design für Automobile auf der Datenautobahn[END_REF], pp. 391 et seq.).

The function of the law in general and of data protection law in particular in relation to smart cars is to secure freedom, responsibility and trust ( [START_REF] Roßnagel | Grundrechtsausgleich beim vernetzten Automobil[END_REF], p. 357). The risks of use and abuse are determined by the sensitivity of the collected data, the value of the data, and the manner and duration of data storage. Not too long ago, the extent to which cars were connected did not exceed the use of clunky car phones. The data collected by a smart car equipped with cameras, microphones and all kinds of sensors however will tell a lot about the status of the car, the behaviour of the driver, and much more. It is thus not difficult to imagine that numerous people and entities will be affected by and may want to have access to that data: drivers, passengers, owners, renters, vehicle fleet management, manufacturers, suppliers, insurances, repair shops, towing services, emergency services, service providers, police, secret services, people involved in accidents, courts, government agencies, advertisers, market research companies and more (cf. [START_REF] Roßnagel | Grundrechtsausgleich beim vernetzten Automobil[END_REF], pp. 355 et seq.; [START_REF] Lüdemann | Connected Cars[END_REF], p. 247). Some of the aforementioned may even be able to force access to the data. There can be a multitude of reasons for wanting such data: diagnosis, maintenance, evidence, insurance claims, to collect toll, infotainment, pay as you drive insurance models, geolocation, development of future car models, product liabilities, contractual liabilities etc..

The data collected by the sensors of a connected car is personal data, if the data relates to an identified or identifiable natural person (for more details see [START_REF] Buchner | Datenschutz im vernetzten Automobil[END_REF], pp. 373ff.). At least the owner of the car will usually be identifiable. The classification as personal data remains intact, even if the reference is false, for instance because another person is actually driving. The purpose of the collection will not always be clear or may change at a later point in time, especially in the context of autonomous driving.

So who should be allowed to have access to data collected by a connected vehicle and under which conditions? Many manufacturers have a very clear opinion: The data is ours to use as we please. This is consistent with efforts to deprive car owners of the ability to perform maintenance and repairs. Future car owners may have a lot less control and authority over their cars than car owners today; going so far as to having to face their own cars as witnesses in a court case against them -figuratively speaking. 2 Drivers become more and more transparent, while it becomes less transparent who has control over data, what the possibilities for control are, what data is actually collected and what is done with that data. This is intensified by the fact that in many countries telecommunications data retention laws are in place which means that any communication data to and from a connected car via internet or mobile telephony will be retained as well.

In the context of connected cars' data collection, processing and storage are generally based on the data subject's consent. One notable exception and an example of data processing based on a legal obligation is the emergency call or short eCall system which will become mandatory in all new cars sold from April 2018 onwards [START_REF]758 of the European Parliament and of the Council of 29 April 2015 concerning type-approval requirements for the deployment of the eCall in-vehicle system based on the 112 service and[END_REF]. The eCall system is a dormant system meaning that data is shared only in the event of an accident. The system sends a predefined data set to a public safety answering point (PSAP) and automatically enables voice communication with the emergency telephone number 112. 3 This means that -among other things -devices like a positioning system and a hands-free speakerphone has to be integrated into every car.

When it comes to consent, drivers are confronted with non-negotiable terms and conditions by the manufacturers. Furthermore, third party applications will usually be offered which will come with their own sets of terms and conditions. All of these have to be brought to the attention of relevant persons. However, it cannot be expected that these persons will actually go through these documents as is the case with many other applications. Due to the fact that users are frequently confronted with lengthy terms and conditions, mostly via the screens of desktop computers or mobile devices, and that most users never experience any consequences as a result of accepting, many get used to simply accepting them without giving the matter much thought or even any thought at all. This is further complicated by the fact that software and hardware updates may add new capabilities, requiring new consent. Consent becomes formalism instead of being an expression of private autonomy and self-determination with regard to the collection of personal data. On top of this, the requirement for consent is that it must be informed consent, whereas in reality, data subjects do not know which data is ultimately collected and processed, or by whom ( [START_REF] Buchner | Datenschutz im vernetzten Automobil[END_REF], pp. 376 et seq.).

A review of connected car privacy policies and terms of service, conducted by the British Columbia Freedom of Information and Privacy Association, indicates that many are in violation of data protection laws. The report states that there is a "lack of consent and forced agreement to unnecessary and arguably inappropriate uses such as marketing" and that standards such as 'openness, accountability, individual access and limiting collection, retention, use and disclosure of customer data' are not met ( [START_REF]British Columbia Freedom of Information and Privacy Association: The Connected Car: Who is in the driver's seat? FIPA[END_REF], p. 6).

In November 2014, members of the Alliance of Automobile Manufacturers and the Association of Global Automakers (both are U.S. trade groups) signed a commitment containing "Consumer Privacy Protection Principles" [15]. However, the principles set forth in the commitment offer a lower standard of data protection than that is already in place in the European Union and cannot serve as guidelines for the discussion in Europe. 4Another issue in the context of connected driving lies in the fact that it may not be possible for the data controller to identify whose data are processed. The owner of a car may have given consent, but what about passengers and other people driving the vehicle? Do they all have to be registered and give consent? The data of the holder of a pay-as-you-drive insurance policy may be processed based on the contract between him or her and the insurance company. If a different person drives the car, that data may not be processed on the basis of the insurance contract, since he or she is not a contracting party. So that person would have to somehow give consent, since the processing of his or her data is an infringement of a fundamental right. And what about the following example: The 2016 Chevrolet Malibu will offer a "Teen Driver System" that will provide parents with a "report card" containing statistics such as maximum speed and distance driven [17]. This example illustrates the potential to control others that comes with all the sensors built into connected cars.

Traffic infrastructure is also digitised. Examples for this are road toll systems, which use cameras to capture license plates and then check via a centralised database whether or not the toll was paid for the vehicle registered under a captured license plate. Similar systems are used by police during manhunts and as an investigative measure, but are also used by private entities, for instance at parking lots -to determine parking duration. This means that cars that are not connected, not smart, may also leave a data trail.

In summary, the emergence of smart and connected vehicles raises the following legal questions: How can we enable drivers to make informed decisions regarding any data collected by a smart vehicle? How can we ensure transparency? Is the current concept of consent up to the task? In addition to these pressing challenges, there is the issue of cyber security (for an overview see [START_REF] Krauß | IT-Sicherheit und Datenschutz im vernetzten Fahrzeug[END_REF]). Weaknesses in sophisticated systems integrated into smart vehicles could potentially be used to deliberately cause accidents. 5 Thieves and stalkers could also prey on such weaknesses. All in all, data security in connected cars is not just a matter of privacy, but also of security breaches which may result in loss of property, serious bodily harm and even death. Moreover, calls for back doors for electronic communication systems have been heard all over Europe and the U.S. in recent times. 6 Do we want to allow police officers to remotely access such systems, for instance to extract data in order to reconstruct where the driver went at what time, to create movement profiles? To allow them to use the microphones used by the eCall system for audio surveillance? Or maybe even to disable a car during a chase by activating the brakes? Already, U.S. car hire companies use GPS to track the movement of "subprime" borrowers and outfit cars with devices to remotely disable the ignition in cases of non-payment (so-called "starter interrupt devices") [START_REF] Corkery | Miss a Payment? Good Luck Moving That Car[END_REF].

The future of connected driving, an industry of particular importance to many European nations, hinges on finding solutions to these pressing challenges.

An Ethical Perspective on the Power of Smart Devices

Following the two presentations on smart cars as a comprehensive example of the use of smart technologies, the second part of the workshop broadened scope in order to discuss the ethical and regulatory implications of smart devices in general. In the third presentation, the ethical issues of smart devices in general were highlighted in order to foster a discussion on (potential) consequences and challenges and to provoke critical thinking. Three exemplary illustrations for an ethical reflection were subsequently provided.

Why Should We Talk about Ethics of Smart Devices? Ethics as a discipline is concerned with the preconditions and the evaluation of action. According to Hubig, ethical reasoning becomes necessary where 'there are specific characteristics of technology that shape the scope of possibilities to act' [START_REF] Hubig | Die Kunst des Möglichen II. Ethik der Technik als provisorische Moral[END_REF]. Ethical reasoning is important in order to avoid that technology determines the development of a society. Before highlighting and discussing some examples of (prospective) smart devices with regard to ethics, a brief overview of some conceptualisations of power is provided in order to help in recognising and analysing power relations that affect the possibilities of humans to act. For this purpose, relational power approaches and especially a constitutive understanding of power are useful. Constitutive forms of power can be defined as 'internal relations of structural positions […] that define what kinds of social beings actors are' as well as their 'social capacities and interests' [START_REF] Barnett | Power in global governance[END_REF]. Furthermore, there are forms of power that constitute 'all social subjects with various social powers through systems of knowledge and discursive practices of broad and general social scope' [START_REF] Barnett | Power in global governance[END_REF]. Constitutive power (re)produces social identities, practices and authorisations of meaning and action [START_REF] Foucault | Discipline and punish: the birth of the prison[END_REF].

Technologies play a vital part in co-constitutive (i.e. mutually reproducing) power relations as they are more than only a neutral instrument or intermediate of power relations between individuals or institutions: technology has an effect on social relations (see [START_REF] Latour | Reassembling the Social. An Introduction to Actor-Network-Theory[END_REF][START_REF]Reassembling International Theory: Assemblage Thinking and International Relations[END_REF]). Following this understanding, smart devices are in a relationship with humans that has an impact on humans' scope for action, on identities and interests, and on (power) relations between individuals and between individuals and social institutions.

This perspective on the role of technology served as the background against which we looked at three different illustrations of smart devices. By searching for and questioning the (co-constitutive) power relations that are influenced by smart technology, we can by no means grasp all ethical issues of smart devices. However, we may enhance and structure our ethical reflection by highlighting effects of smart technologies on the scope of human action.

Reflection on Some Exemplary Illustrations. Smart and Connected

Cars. The first case study picks up the example used in the previous presentations. By the introduction of a system of smart and connected cars, the character of cars and their meaning for society change. Whilst traditionally a symbol of individual liberty and of the widespread mobility -the ability to go independently wherever and whenever -smart and connected cars are much more defined by being only a small part of a greater network. It is the network and its social and economic significance that becomes the most important aspect; and cars as the network's small cogs enable its functioning. Thereby, the values of the infrastructure, of the vendors and the environment are being inscribed into cars and are represented by the smart functions of cars. Concepts such as "efficiency", "security" or "environmentalism" gain power and govern the field, subsequently also influencing and judging the behaviour of car drivers in their way. It may even become a problem if people resist using smart cars, as their behaviour can then be interpreted as antisocial resistance against the values at the core of the system. To name only one consequence: those who do not want to take part in a smart car system, but stick to old technology could be charged higher insurance fees [START_REF] Morozov | The rise of data and the death of politics[END_REF]. Based on these deliberations, we can assume that the perspective on car traffic will change completely. The traffic system providers, vendors, and producers gain power over individuals by rendering certain behaviours appropriate or inappropriate.

Fitness Wearables. The second example looked at fitness wearables such as smart watches or sleep and lifestyle trackers. Perhaps the most important aspect of fitness wearables is their constant measuring and thereby the constant evaluation of the self. With these devices comes an idea of normality that is inscribed in the practices of comparison of the data the device collects with certain pre-given "normal" behaviours and average values.

The comparison to a certain normality inscribed and always shown by the wearable changes the self-perception of individuals and their relationship and behaviour towards society. On the one hand, if the normal and the evaluation of the self diverge, there is the feeling of being abnormal or even ill. On the other hand, the envisaged effects are self-optimisation towards a goal that is written into and represented by the device. The device does not force people to obey and follow certain ways of life, but by its ubiquitous comparison to a normatively desired "standard" and persuasive design it enacts forms of self-governance. 'Even if a system were designed to only make suggestions, it would still find itself treading a fine line between inspiration and frustration, between obliging helpfulness and pig-headed patronization' [START_REF] Bohn | Living in a world of smart everyday objects -Social, economic, and ethical implications[END_REF].

The illustration of fitness wearables shows that data and smart devices can have power over individuals. But only if the devices are used and accepted, which is where we can observe the co-constitutive character. They do not unfold power on their own.

At the same time one can conceive of this kind of smart device as having an empowering effect for humans by raising self-awareness. However, this self-awareness is based on, and influenced by, the assessment of the self which has been conducted by others.

Virtual Reality and Decision Making. In the last illustration, we drew on an even more general characteristic of smart devices. By using sensors measuring the environment, then calculating and processing the gathered raw data, interpreting it and eventually by visualising and evaluating the data, smart devices occupy a position between "reality" and individuals. Technology in these cases performs a mediating role and shows an enriched reality, as many things that sensors can detect in our environments are not detectable in this way by humans. Furthermore, this reality is constantly being interpreted and evaluated.

As a consequence, smart devices can lead to better informed decisions, as humans receive more information through technology than they could collect and process on their own. Then again, these decisions are of course highly influenced and biased by the functioning of the devices and the interpretations and processes that the engineers and developing companies have (unconsciously) built into their products. One has without a doubt to consider that there is not "one reality out there" that humans can eventually and objectively conceive. But in this case, we have to deal with a mediated "virtual" reality where a company is the middleman. Furthermore, by using information from smart devices as a basis for our everyday decisions, these decisions become increasingly dependent on the (correct) functioning of the smart devices. This leads to another question: if we base our decisions deliberately and unconsciously on a virtual reality enhanced by smart devices, who is ultimately responsible and to be held accountable for these decisions? Is it always the human being, or also the smart device, respectively its developers or retailers? Can the technology be held responsible only if the information provided is "wrong" -and what is wrong information? Or is it the relation itself -the socio-technological system -that is responsible? And what are the consequences thereof in practice?

The issue of accountability becomes even more significant when we look at auton-omous decision-making by technology, e.g. when algorithms of smart technologies assess the risk to aviation security posed by individual air passengers. How can one assure that smart devices do not reproduce or reinforce discrimination or social sorting (see [START_REF] Gandy | Engaging Rational Discrimination: Exploring Reasons for Placing Regulatory Constraints on Decision Support Systems[END_REF][START_REF]Surveillance as Social Sorting: Privacy, Risk, and Digital Discrimination[END_REF])? And again, who is to be held responsible for these decisions that are taken by technology (see [START_REF] Himma | Artificial agency, consciousness, and the criteria for moral agency: what properties must an artificial agent have to be a moral agent?[END_REF][START_REF] Johnson | A dialogue on responsibility, moral agency, and IT systems Proceedings of the[END_REF])?

We may summarise from an ethical perspective that smart devices are becoming an important part in existing and emerging power relations and that this can lead to value conflicts such as efficiency vs. privacy. Power relations can evolve several ways: Humans may be empowered by intelligent devices; they may also be in a more dependent power relation and thereby be governed by the concepts, functions and decisions of smart devices; and finally, humans may even self-govern themselves along the concepts and functions of smart devices.

Regulating a Hyper-connected World

For the final part of the workshop, we concluded with a general overview of the recent regulatory challenges that derive from a hyper-connected world. However, the discussion on the regulation of smart devices, which has been ongoing for some time now, is recently most prominently referred to under the heading 'Internet of Things' (IoT). Starting with a brief terminology and description of the privacy challenges posed by the IoT, the following section introduces the different traditions in data protection regulation on either side of the Atlantic and the most recent political debates in the US and the EU on the regulation of the IoT, as these two trading blocks are most likely to have a major impact on the emerging IoT market.

The Internet of Things as the Backbone of a Hyper-connected World. Early debates on the emergence of networked devices and information systems -which in their entirety are nowadays most commonly referred to as the Internet of Things7 date back to the early 1990's. Back then, the gradual miniaturisation of computers led to debates on ubiquitous computing, pervasive computing etc. [START_REF] Weiser | The Computer for the 21st Century[END_REF]. During the 2000s, with Radio Frequency Identification (RFID), it became possible to address specific devices within a short distance sensor network and to let them communicate with other RFID-capable devices [START_REF] Fleisch | Das Internet der Dinge[END_REF]. However, these technologies did not yet incorporate the internet. Instead, the notion of ubiquitous computing envisioned relatively autonomous devices, and the notion of RFID envisioned primarily local networks. Only with the advent of communication protocols such as IEEE 802.15.4, 6LoWPAN or CoAP and by outsourcing processing power into the cloud, did the phenomenon which is today referred to as the Internet of Things, finally come to life. Based on the promises of an increasingly connected world, a substantial change is predicted in at least five different markets. First, in the consumer market through fitness trackers, ambient assisted living systems, home automation and mobility services such as Uber or iDrive by BMW; second, in the production chain and logistics sector through the industrial internet; third, in the infrastructure sector through smart traffic, smart grids and smart meters; fourth, in the healthcare sector through the data provided by e.g. fitness trackers or networked insulin devices, and finally, in the agriculture industry ( [START_REF] Sprenger | Internet der Dinge: Über smarte Objekte, intelligente Umgebungen und die technische Durchdringung der Welt[END_REF], pp. 20 et seq.). The commercial sector, in particular, sees a big opportunity for innovation and further economic growth in the spread of connected technologies [START_REF] Gartner | Gartner says a Typical Family Home Could Contain More Than 500 Smart Devices by 2022[END_REF] and the extended usage of collected data through new data literacy behaviours and big data analyses. Although personal data is not relevant in all of the aforementioned markets, for a lot of devices, applications and services, the collection and use of personal data is crucial. Unlike previous data collecting technologies, through the IoT not only is more data, but also new kinds of data of any person within sensor range collected, as described in sections 2.1 and 2.2 [START_REF] Swan | Sensor Mania! The Internet of Things, Wearable Computing, Objective Metrics, and the Quantified Self 2.0[END_REF].

The privacy challenges emerging from this development [START_REF] Weber | The digital future -A challenge for privacy?[END_REF] lead to questions as to how to deal with the future development of the IoT and how to engage these challenges with regulatory measures. However, during the past decades, two quite different traditions in the governance of data protection and privacy emerged on both sides of the Atlantic which also shape the current debates on the regulation of the IoT.

Regulatory Traditions of Data Protection in the US and EU. The European approach to data protection regulation, which is often referred to as a comprehensive regime, relies -most prominently represented by the Data Protection Directive 95/46/EC and its successor, the Data Protection Regulation -on a set of formal rules, which are derived from fundamental rights and freedoms, and enforced across the public and private sectors through independent regulatory agencies. The US approach, however, is considered as a limited regime by only applying formal rules to the public sector while relying mainly on sectoral privacy laws, self-regulation and technology in the private sector and at the same time in large parts lacking an institutional monitoring and enforcement mechanism [START_REF] Newman | The Governance of Privacy[END_REF]. These regimes, however, need to be considered as the formal side of the governance of privacy. Besides these, due to the enormous speed of technological change, a major part of the regulation of privacy takes place at numerous global, regional and national levels of governance and involves a complex web of state-regulation, self-regulation and technology [START_REF] Bennett | The governance of privacy: policy instruments in global perspective. 2nd and updated[END_REF].

Regulatory Fora and Focus on Either Side of the Atlantic. To date, there are no laws or an overarching national strategy put forward by US Congress, dealing specifically with the IoT. Instead, at least two dozen separate federal agencies -ranging from the Federal Aviation Administration (FAA) to the National Highway Traffic Safety Administration (NHTSA), the Food and Drug Administration (FDA) and the Department of Agriculture -and more than 30 different congressional committees deal with specific aspects of the IoT, usually publishing nothing more than nonbinding statements. In the meantime, the Federal Trade Commission (FTC), which is the foremost authority on privacy issues, emerged as the government's regulatory body for the IoT, while the NHTSA and the FAA are both grappling with IoT related issues such as driverless cars and drones, respectively [START_REF] Samuelsohn | What Washington really knows about the Internet of Things. A Politico investigation[END_REF]. The hearings, round tables and working groups conducted by these authorities and committees usually follow a multi-stakeholder path and involve representatives from the technology industry, privacy groups and Congressional offices [START_REF]The Internet of Things: What's Washington's Role? A politico working group report[END_REF]. Although there is no concerted regulation strategy, the position of the US on the regulation of the IoT can be described as a rather passive "laissez-faire" approach that is extremely cautious not to stifle innovative business models that may emerge with the advent of the IoT. In this context, it is regularly pointed to the major influence of the industry on even the most minimal steps in the field of IoT regulation in order to explain the cautious attitude of Congress [START_REF] Romm | Round 1 goes to the lobbyists: A barely there technology is already winning the influence battle in Washington. Here's how[END_REF].

Both in the US and EU, a core component of efforts in dealing with the IoT relates to device and network security, most notably data security and breach notification. In the US, data security legislation is the lowest common denominator in regulatory matters on which many of the relevant stakeholders can give their assent [START_REF] Peppet | Regulating the internet of things: First steps toward managing discrimination, privacy, security & consent[END_REF] and also the one demand on which the FTC has shown itself to be intransigent [START_REF]Internet of Things. Privacy & Security in a Connected World[END_REF]. Different government policies regarding data security and cybersecurity show the increased attention this topic has received in the past on a federal level. However, regarding data protection, including its principles of data minimisation, purpose limitation and the data subject's rights to information and consent, the picture differs considerably. While the FTC recommends data minimisation as one necessary step in order to achieve better data security and data protection, it still gives companies a lot of flexibility by proposing that they can decide not to collect data at all, to collect only the types of data necessary to the functioning of the product or the service being offered, to collect data that is less sensitive or to de-identify the data they collected. In the event that a company decides that none of these options work, the FTC recommends the company to seek consumers' consent for collecting additional, unexpected data [START_REF]Internet of Things. Privacy & Security in a Connected World[END_REF]. The recommendations of the FTC led to a series of harsh criticism from industry and other governmental bodies [START_REF] Gross | FTC calls on IoT vendors to protect privacy[END_REF][START_REF] Diallo | Do Smart Devices Need Regulation? FTC Examines Internet Of Things[END_REF]. Regarding informed consent in the light of the emerging IoT sector, the FTC points out that notice and choice are particularly important when sensitive (e.g. health) data is collected and that informed choice remains practicable, although it is not considered important in every data collection. In contrast, both other governmental as well as industry representatives share the opinion that potential new uses of data, leading to societal and economic benefits, could be restricted by such measures and that a risk-based approach in dealing with the IoT should be favoured [START_REF] Samuelsohn | What Washington really knows about the Internet of Things. A Politico investigation[END_REF][START_REF]The Internet of Things: What's Washington's Role? A politico working group report[END_REF][START_REF] Romm | Round 1 goes to the lobbyists: A barely there technology is already winning the influence battle in Washington. Here's how[END_REF], [START_REF]The White House: Big Data: Seizing opportunities, preserving values[END_REF][START_REF]President's Council of Advisors on Science and Technology: Report to the President. Big Data and Privacy: A technological perspective[END_REF].

Contrary to the US approach and besides the various national strategies of EU Member States, the European Commission plays an active part in the formal regulation of the IoT [START_REF] Gabriel | Das Internet der Dinge -Basis für die IKT-Infrastruktur von morgen[END_REF]. This is mainly based on the notion that European industry -but also politics in its task of supporting economic development -largely overslept the development of the Internet during the 1990s and the spread of smart devices since the middle of the last decade and thus failed to keep up with US and Asian competitors in the microelectronics sector such as with personal computers, home entertainment and smart mobile telephony. As a result, the key idea behind the present activi-ties of the European Commission is to not repeat the mistakes previously made and instead, to actively shape emerging IoT markets. In this respect, the work of the European Commission involves the establishment of several multi-stakeholder discussion groups and consultations -involving representatives from industry and privacy groups -that started around 2005. Initially, they focused on RFID, which finally led to an action plan, that was presented back in 2009 [START_REF]European Commission: Radio Frequency Identification (RFID) in Europe: steps towards a policy framework[END_REF][START_REF]European Commission: Internet of Things -An action plan for Europe[END_REF]54] and which has, since then, shaped the rather comprehensive IoT strategy of the EU.

At the moment, the EU General Data Protection Regulation (GDPR) and the creation of the Digital Single Market are considered as playing a major role in shaping the regulatory cornerstones of the future IoT regulation. Furthermore, a review of the ePrivacy Directive is scheduled for 2016 [START_REF]European Commission: A Digital Single Market Strategy for Europe[END_REF]. Within these efforts and in contrast to the US approach, the EU not only commits itself to foster the free flow of information but also to enhance data security and -regarding data protection and privacy -also to adhere 'to the highest standards of protection guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights' ( [START_REF]European Commission: A Digital Single Market Strategy for Europe[END_REF]; see also: [START_REF]Digital Agenda: Commission consults on rules for wirelessly connected devices -the "Internet of Things[END_REF]). Thus, in line with the opinion of the Article 29 Working Party, data minimisation, purpose limitation and the data subject's right to information and consent are still favoured in the sense of the Data Protection Directive [57]. Although the worst fears of privacy groups about the weakening of the principles of purpose limitation, information and consent by the Council of Ministers [START_REF] Järvinen | Privacy and Data Protection under threat from EU Council agreement[END_REF] appear rather unfounded in the face of the final text of the GDPR, only the future will tell, how these general principles will be applied, for example through Codes of Conduct, positions, guidance or decisions by DPAs, through court decisions or through an intervention by the European Data Protection Board (EDPB). In the bottom line, however, in all of the activities of the EU, is that there is a much greater focus on individual rights, data protection and the assessment of ethical problems in comparison to the US.

Especially in the context of a technology that is regarded as disruptive as the IoT sector currently is considered to be, proponents of the new technology usually urge governments not to stifle innovation and economic growth by hard legislation, whereas privacy advocates warn of the significant privacy risks of a hyper-connected world and call for legislative reform. Furthermore, different traditions in the understanding and governance of privacy shape current governmental action in IoT regulation. Particularly the principles of data minimisation, purpose limitation and informed consent will remain both in the US and -despite the agreement on the GDPR -in the EU subject of an ongoing debate on the regulation of the IoT. While the US favours a "laissez-faire" approach, the European Union has committed itself to establish more durable, technology neutral rules which enable the free flow of information while still being able to provide a high level of protection of fundamental rights. However, IoT regulation will most likely remain a current topic, as the evolution of the IoT will probably raise new privacy challenges.

Discussion and Concluding Thoughts

The broad (technical) overview of major challenges concerning smart cars in the first part of the workshop raised several questions from the audience, as well as remarks concerning their own -personal and research -experiences with smart cars. The (potential) accessibility of the data for official authorities -mainly the police -was viewed very critically. In fact, it was put forward that in the past police authorities have used traffic information collected and shared by customers of a large navigation device and service provider to place speeding cameras.

In the final discussion, we considered certain technologies more carefully, for instance smart devices that are used in health systems. It was stated that, although there is a lot of information and data gathered about the patient, it is, above all, the health company that produces and runs the smart device/system that is empowered by the vast amount of data gathered. A similar question was raised when discussing who is really empowered by the apps and technologies that are used to run Uber cars that have a disruptive effect.

We realised that privacy is primarily defined as an individual value and as such, it is often deemed subordinate to social values such as traffic security, efficiency or environmentalism. We reasoned therefore on the need to understand privacy as a social and collective value in a democratic society in order to compete and remain valid in the conflicts of values that simmer around smart technologies.

In summary, the workshop showed that smart devices are becoming an increasingly important part in our lives. They pose severe challenges to current legal systems and they demand regulation and technology design that ensures that the technological capabilities and business possibilities of smart devices are not the only driving forces, but instead that fundamental legal and ethical values are taken into account. We should keep in mind that privacy is foremost a fundamental right and has to be upheld in the face of technological advancement. This stems from the acknowledgement that it is an important societal value which affects the relationship, not only between humans, but also between humans, the technologies they use and the systems, companies and institutions behind them. The goal of the workshop, which was to look at the manifold societal challenges from a multitude of disciplinary perspectives in a condensed way, and to bring together these perspectives, has been achieved.

For a detailed explanation of the concept of a car as a "private-in-public place" see[START_REF] Urry | Inhabiting the car[END_REF].

This could be a violation of 'nemo tenetur se ipsum accusare' ([START_REF] Mielchen | Verrat durch den eigenen PKW -wie kann man sich schützen?[END_REF], p. 85).

The eCall system is furthermore open to the implementation of additional telematics services, which also raises concerns regarding data protection and data security[START_REF] Lüdemann | Lebensretter eCall: Türöffner für neue Telematik-Dienstleistungen[END_REF].

Nevertheless pleading for a vertical solution see[START_REF] Sörup | Datenschutz bei Connected Cars[END_REF].

On the significance of IT security in cars with particular regard to embedded security see[START_REF]Embedded Security in Cars[END_REF].

Perhaps most impactful has been a speech by UK Prime Minister David Cameron given on 12 January 2015.

Whereas the term smart device describes the concrete technical artefact, the term Internet of Things was coined by a presentation by Kevin Ashton in 1999 in order to describe the broader phenomenon of interconnected smart devices[START_REF] Ashton | That 'Internet of Things' Thing[END_REF]. Highlighting the pervasive character of this development, the term Internet of Everything (IoE)[START_REF] Bajarin | The Next Big Thing for Tech: The Internet of Everything[END_REF] is also quite popular, while Weber[START_REF] Weber | The digital future -A challenge for privacy?[END_REF] refers to it as the Data of Things respectively DoT.

Acknowledgement: This work is partially funded by the German Ministry of Education and Research within the project "Forum Privacy and Self-determined Life in the Digital World". For more information see: http://www.forum-privatheit.de