# Privacy Framework for the Development of IoT-Based Systems
## 6 Proposal of Privacy Guidelines
### Key Findings and Reflections
#### Importance of Automated Privacy Enforcement  
Several participants emphasized the need for automated privacy mechanisms, arguing that privacy policies should not depend solely on manual configurations. Key recommendations included:  
1. Developing real-time privacy risk assessment tools to proactively identify potential violations before they occur. 2. Establishing automated data expiration policies to ensure compliance with minimal human intervention. 3. Leveraging ML-based anomaly detection to dynamically monitor and address privacy threats. 4. _Improving Data Aggregation and Query Answering_ Aggregation-based guidelines, such as Geography-Based Aggregation and Time-Based Aggregation, received moderate ratings, suggesting that their effectiveness is highly dependent on the specific use case. Respondents suggested the following: 1. Designing context-sensitive aggregation strategies that balance data usability with privacy protection. 2. Refining query-answering models to ensure differential privacy, preventing the exposure of individual data points. 3. Introducing threshold-based aggregation policies to limit the risk of sensitive data overexposure. 5. _Expanding Privacy Guidelines to Cover Emerging Challenges_ Several participants identified gaps in the current privacy guidelines, particularly in relation to emerging technologies and evolving privacy challenges. They proposed expanding the guidelines to address: 1. AI and Privacy: Strategies to ensure that AI-driven analytics handle IoTS data responsibly while preserving user privacy. 2. Edge Computing Privacy: Approaches for securing decentralized data processing at the network edge. 3. User-Controlled Privacy Mechanisms: The need for greater transparency and user-accessible privacy settings in IoTSs to empower end users. 2.3 Analysis Part 3: Exploring the Influence of Developers' Backgrounds on Their Interpretation of Privacy Guidelines  
This section shows a detailed analysis of how developers' professional roles influenced their responses to the different aspects of privacy guidelines, particularly in terms of relevance, clarity, and practicality. The participants' job titles provide insights into their interpretation of guideline relevance. For instance, roles such as Data Scientist, Cybersecurity Specialist, and Privacy Engineer tended to assign higher relevance scores across most guidelines, likely due to their direct engagement with privacy-preserving systems and regulatory compliance. In contrast, participants with titles like Software Developer or Embedded Systems Engineer exhibited more variation in relevance ratings, possibly reflecting competing priorities such as functionality and performance in their development workflows. Academic roles (e.g., Assistant Professor, Researcher) also demonstrated consistently high relevance scores, which may stem from a stronger theoretical understanding of privacy principles and ethical considerations. These differences highlight that the interpretation of guideline relevance is not uniform and can be shaped by practical responsibilities, regulatory exposure, and organizational focus. Thus, accounting for job roles provides valuable context for understanding how privacy guidelines are perceived and prioritized in real-world settings. The observed variation in relevance ratings among software developers suggests a potential gap in understanding the practical significance of certain privacy guidelines. Unlike roles in academia or data security, developers may not always be directly exposed to privacy risks or regulations, which underscores the need for more targeted education and contextual examples when introducing privacy principles within development environments. The evaluation results also revealed noticeable variations in how different professional roles perceive the clarity and practicality of the privacy guidelines. Academic participants, such as assistant professors and PhD students in cybersecurity, consistently rated the guidelines as clearer and more practical.