# DPIA in Context: Applying DPIA to Assess Privacy Risks of Cyber Physical Systems
## 2 Background
### CPS and Privacy  
Privacy has many facets; everyone perceives privacy in their own unique way, and privacy tolerances vary from one person to the next. For example, what constitutes an attack on privacy? Historically, the tagging clothing to enable identification of someone's whereabouts has been considered an invasion of privacy [10], yet, many people do not consider allowing their Smart Meter to update their supplier on usage an invasion of privacy, despite the fact that this data could, in the wrong hands, also be used to pinpoint their home location, or establish their preferences [9]. Thus, privacy is more nuanced than a simple public/private dichotomy. Privacy is difficult to define and, therefore, difficult to design into systems, processes or decision-making. This problem becomes even more difficult to address with CPS that traverse modern technology and physical systems, that traditionally did not have internet connectivity, such as industrial control systems, national infrastructure and smart objects, because of the multiple disparate elements that need considering. CPS can be used to transfer data from physical devices, such as smart meter sensors, via the internet to send usage or location data to be monitored to control systems that can then be used to, for example, monitor performance [11]. This interaction however, gives rise to a number of security and privacy concerns that need to be explored and addressed. Moreover, with CPS, the boundaries between the three disparate elements, the physical, the human and the machine, can be difficult to distinguish and, therefore, privacy considerations become more complicated to assess. GDPR obliges organisations to reconsider how they use and make decisions around data, with failure to comply giving rise to large monetary fines of up to 20 million Euro [6]. This means that organisations must reconsider practices such as establishing customer preferences from their purchasing history, without first assessing the privacy risks associated with such use of the data. This means that, whereas historically, conducting risk assessment for privacy has been advisable, GDPR has made this a mandatory obligation, requiring organisations to assess the privacy risk for any _\"high risk\"_ data processing activities [12]. Moreover, such privacy risk assessment must be conducted from the perspective of the service recipient or customer (_the data subjects_), rather than the organisation (Article 35, GDPR). Therefore, the organisation who wishes to profile their customers, need to consider the whole cyber-physical process involved in such data use, as part of their decision making. This should encompass both the physical and technological processes, and systems that the data crosses as part of the analysis, in order to gain a complete picture of the potential privacy risks. While the safety and security risks of CPS have been considered [13], and the security threats, vulnerabilities and implications has been discussed extensively [2], including how privacy may be affected as a result of CPS [3], what most of these papers have in common is that they consider privacy as one component part of the security consideration, rather than as an overarching consideration across the whole of the CPS areas, the physical, the technological and the human in a holistic manner. This, therefore, requires privacy risk to be assessed in context, taking into account the human, technical and physical components of CPS and how these interact to generate data and, thus, value. One study does discuss privacy to consider how the new provision of GDPR might apply and affect CPSs (or IoT devices), and what this is likely to mean for organisations who operate and use CPSs [4]. This study identifies four challenges in ensuring the data subjects (a.k.a.