# Data Privacy in the Internet of Things: A Perspective of Personal Data Store-Based Approaches
## 3 Data Privacy in the Internet of Things
### Information Privacy Protection
#### 3.3.2 Privacy Regulation  
Keeping personal data private and safe has become a priority for consumers, companies, and governments. Thus, governments have been enacting legislation to protect their citizens [35]. Hence, the number of privacy regulation laws has been increasing throughout the years, reflecting the need to protect individual privacy against data misuse. The GDPR, the PIPEDA, the CCPA, the APP, New Zealand's Privacy Act 1993, and the Brazilian GDPL are some examples of privacy protection legislation. Privacy legislation aims to discipline how personal data are collected, processed, stored, and disclosed. It establishes boundaries for data-driven business models and defines mandatory practices and processes to guarantee privacy protection. The first privacy protection initiative was launched by the Fair Information Practices (FIPs) in the 1974 US Privacy Act, comprising the principles of notice, consent, individual access and control, data minimization, purposeful use, adequate security, and accountability [31]. Currently, 71% of countries worldwide have enacted legislation to ensure data privacy protection [43]. The most prominent regulation law is the GDPR [33], adopted in May 2018, which emphasizes personal data processing in an appropriate privacy and security manner, including measures and technologies to safeguard personal data against unauthorized access, processing, and disclosure. To ensure these objectives, the GDPR encompasses rules for all companies operating within EU countries. Consequently, it forces worldwide organizations and governments to develop policies and regulations to protect individual privacy if they want to do business with any EU country or face financial sanctions [35; 44]. According to [35], the GDPR aims to protect individual (data subjects) personal data and grant them control over them. It does not protect the personal data of individuals: (i) living outside the EU, (ii) who use services from people outside the EU, (iii) who are non-human, (iv) who are anonymous, and (v) who are deceased. Besides data subjects, we find in the GDPR two other essential entities: data controllers and data processors. As Art. 4 states, controller _\"means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data\"_, and processor _\"means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller\"_[33]. Art. 5 of the GDPR presents the seven key principles relating to personal data processing [33]:  
* Lawfulness, fairness, and transparency implies that any personal data processing by a controller must have a legal basis, be fair towards the individual, and be transparent to individuals and regulators. Users must be informed in a concise, easily accessible, and easy-to-understand manner;
* Purpose limitation implies that personal data must be collected for specific, explicit, and legitimate purposes, and it should not be processed in ways that are incompatible with those purposes;
* Data minimization implies that personal data must be adequate, relevant, and limited to what is necessary for the purposes;
* Accuracy implies that controllers should ensure personal data are accurate and, where necessary, kept up to date;
* Storage limitation implies that controllers must hold personal data in a way that allows the identification of individuals for no longer than necessary for the specified purposes;
* Integrity and confidentiality implies that personal data must be processed securely, ensuring protection against unauthorized or unlawful use and accidental loss, destruction, or damage;
* Accountability implies that the controller shall be responsible for and able to demonstrate compliance with the principles mentioned above. Besides that, the GDPR defines the following eight data subjects' rights:  
* Right to be informed about the data collection and its purposes (Art. 13).