## 4 Goal: Filtering for Increased Privacy  
In this research, we investigate the impact of using filtering as a technical method for protecting personal data. While notwithstanding its use within other jurisdictions or with other definitions of privacy, we suggest taking the European data protection law codified in EU Directive 95/46/EC [78] to define _personal data_ to'mean any information relating to an identified or identifiable natural person (_data subject_)' [78]. Europe's General Data Protection Regulation (Directive 95/46/EC [78]) requires one --among other things--to'minimise the amount of collected data' [79].  
Alongside the possible application of encryption to ensure the confidentiality of such personal data, we see the filtering (i.e., by a firewall) as a means to minimise data leakage. The intent is to block the transmission of data as early as possible, i.e., closer to the points where data are created, thereby allowing the user to enforce the data minimisation principle.  
While we use the technical concept of packet-filtering (see Section 2.4), one could even go further and use content re-writing rules to perform data anonymisation on the actual data within a packet. Not allowing some information to flow might be tolerated for some applications, and hence, 'the data collected [...] should be strictly necessary for the specific purpose previously determined by the data controller (the 'data minimisation' principle)' [79].  
Following the principle of privacy by design [80; 81] should lead to fewer data becoming collected or data leakage to be minimal [82]. However, in reality, users are unable, incapable [48] or unwilling to change the devices themselves for those that offer increased privacy; filtering can be adopted. Filtering demands a trusted device that allows the firewalling functions to be run inside the critical network communication. In the Smart Home, this is usually the router or wireless access points, minimising the amount of transferred unsecured data, e.g., data sent from sensors or the system to a back-end. This effort being spent to prevent accidental disclosure is sometimes called _data loss prevention_ or _data leakage prevention_ (DLP) [83]. Such a data leakage in the car and Smart Home domain is shown in Figure 6. It clearly shows that for privacy, we need to prohibit information from flowing in the opposite direction, as in Figure 4.  
Network and security architectures are developed so that the devices achieve security mostly without user interaction in the sense of'security by default'. However, we would like the user to become involved in crucial security decisions but not bothered with everyday requests, especially if they might impact security, as this can lead to _warning fatigue_ and also security fatigue in general [847 ]. We assume that guiding a user to effectively filter certain traffic or encapsulation of devices can be employed to combat warning fatigue in IT security.  
We want to provide users with the availability to have a fine-grained choice if they wish, as they are the only ones who can make privacy decisions in everyday situations.  
Figure 6: Data leakage from (**a**) the car via OBD [39; 40] and from (**b**) the IoT system.  
This would also require including tools for users to dynamically adjust or change their choices [86].  
However, we believe that the network and security architectures must provide a high level of security even without requiring constant and skilful user interaction, as many users may not have enough knowledge to properly manage their own security settings, and a system that can provide security without relying on user input can be more effective at preventing cyberattacks.