Abstract:A user's devices such as their phone and computer are constantly bombarded by IoT devices and associated applications seeking connection to the user's devices. These IoT devices may or may not seek explicit user consent, thus leaving the users completely unaware the IoT device is collecting, using, and/or sharing their personal data or, only marginal informed, if the user consented to the connecting IoT device but did not read the associated privacy policies. Privacy policies are intended to inform users of what personally identifiable information (PII) data will be collected about them and the policies about how those PII data will be used and shared. This paper presents novel tools and the underlying algorithms employed by the Personal Privacy Assistant app (UTCID PPA) developed by the University of Texas at Austin Center for Identity to inform users of IoT devices seeking to connect to their devices and to notify those users of potential privacy risks posed by the respective IoT device. The assessment of these privacy risks must deal with the uncertainty associated with sharing the user's personal data. If privacy risk (R) equals the consequences (C) of an incident (i.e., personal data exposure) multiplied by the probability (P) of those consequences occurring (C × P), then efforts to control risks must seek to reduce the possible consequences of an incident as well as reduce the uncertainty of the incident and its consequences occurring. This research classifies risk according to two parameters: expected value of the incident's consequences and uncertainty (entropy) of those consequences. This research calculates the entropy of the privacy incident consequences by evaluating: (1) the data sharing policies governing the IoT resource and (2) the type of personal data exposed. The data sharing policies of an IoT resource are scored by the UTCID PrivacyCheck™, which uses machine learning to read and score the IoT resource privacy policies against metrics set forth by best practices and international regulations. The UTCID Identity Ecosystem uses empirical identity theft and fraud cases to assess the entropy of privacy incident consequences involving a specific type of personal data, such as name, address, Social Security number, fingerprint, and user location. By understanding the entropy of a privacy incident posed by a given IoT resource seeking to connect to a user's device, UTCID PPA offers actionable recommendations enhancing the user's control over IoT connections, interactions, their personal data, and, ultimately, user-centric privacy control.

Identifying personal physiological data risks to the Internet of Everything: the case of facial data breach risks

Study on Compliance of Personal Biometric Information Processing Protocols in Financial APPs

The Shield of Privacy in the Digital Age: The Clash between Facial Recognition Technology and Personal Information ProtectionCase Analysis and Strategy Discussion

Human Factor, a Critical Weak Point in the Information Security of an Organization's Internet of Things

Legal protection of a citizen’s right to a facial image when applying facial recognition technology in Chinese law

Research on Face Recognition and Privacy in China—Based on Social Cognition and Cultural Psychology

A mixed-methods investigation of the factors affecting the use of facial recognition as a threatening AI application

Privacy Threats in Facial Recognition-Based Identity Verification

A Decision Tree Approach for Assessing and Mitigating Background and Identity Disclosure Risks.

Analysis of Legal Issues of Personal Information Protection in the Field of Big Data

Physiological Data: Challenges for Privacy and Ethics

IoT Privacy Risks Revealed

Research on Data Security and Privacy Protection of Wearable Equipment in Healthcare

An Empirical Study On The Data Security And Privacy Awareness To Use Health Care Wearable Devices

Responsible Facial Recognition and Beyond

Artificial intelligence in physiological characteristics recognition for internet of things authentication

Face Recognition Technology and Privacy

Research on Personal Medical Information Protection Based on Big Data

Research on Personal Information Security Protection Measures in the Big Data Era

Research on the Security of Personal Information in the Era of Big Data

Study on the Protection of the Right to Self-Determination of Personal Information with the Development of Facial Recognition Technology