Implementing GDPR for Mobile and Ubiquitous Computing

Abstract

The General Data Protection Regulation (GDPR) presents directives to give data subjects control over their personal data. These directives impose data-collecting and processing organizations to take concrete actions for privacy preservation of users and non-users alike. Significant challenges arise when applying these directives to mobile and ubiquitous computing. Mobile and ubiquitous computing aim for computer use to be as transparent and seamless as possible. Inconspicuous devices continually sense their environment, often without the data subject's knowledge. This context significantly complicates the implementation of core GDPR directives, such as informing the user and collecting consent. In this paper, we challenge the mobile computing research community on how to address such issues in practical implementations that combine the philosophy of mobile and ubiquitous computing with often constraining privacy-regulations.