Spreadsheet: 81d09999-3736-4e6d-abaf-f7bfccbfb6f3
Sheet: R2

 | Risk-ID | Risk Value | Asset Description | Asset Value | Vulnerability Description | Vulnerability Value | Threat Description | Threat Value |  | Values | Counts | Weighting factor
 | R.A2.V25.T14. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4 |  | 1
 | R.A2.V25.T8. | 10 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3 |  | 2
 | R.A2.V25.T7. | 9 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2 |  | 3
 | R.A2.V25.T6. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4 |  | 4
 | R.A2.V25.T3. | 12 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5 |  | 5
 | R.A2.V25.T2. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4 |  | 6
 | R.A2.V25.T1. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4 |  | 7
 | R.A2.V3.T14. | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4 |  | 8
 | R.A2.V3.T8. | 8 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3 |  | 9
 | R.A2.V3.T3. | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5 |  | 10
 | R.A2.V3.T2. | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4 |  | 11
 | R.A3.V25.T14. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4 |  | 12
 | [NAME]. | 10 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3 |  | 13
 | R.A3.V25.T7. | 9 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A3.V25.T6. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R.A3.V25.T3. | 12 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V25.T2. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R.A3.V25.T1. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R.A3.V3.T14. | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | [NAME]. | 8 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V3.T3. | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A6.V25.T14. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A6.V25.T8. | 9 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V25.T7. | 8 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A6.V25.T6. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R.A6.V25.T3. | 11 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V25.T2. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R.A6.V25.T1. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R.A6.V3.T14. | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | [NAME]. | 7 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V3.T3. | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V3.T2. | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A6.V16.T18. | 10 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R.A6.V16.T17. | 11 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V14.T12. | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R.A6.V4.T12. | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R.A15.V28.T12. | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A15.V23.T12. | 9 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A15.V16.T18. | 10 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R.A15.V16.T17. | 11 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V16.T3. | 11 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V6.T12. | 8 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A15.V4.T12. | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R.A15.V2.T12. | 7 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A2.V28.T12. | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A2.V25.T12. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A2.V23.T12. | 10 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A3.V28.T12. | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A3.V25.T12. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A3.V23.T12. | 10 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A4.V28.T12. | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A6.V28.T12. | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A7.V28.T12. | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A7.V23.T12. | 9 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A4.V28.T3. | 10 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V28.T2. | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R.A4.V25.T14. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A4.V25.T6. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R.A4.V25.T3. | 12 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R.A4.V25.T1. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R.A4.V15.T14. | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A4.V3.T14. | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A4.V3.T3. | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V3.T2. | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A14.V25.T18. | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A14.V25.T17. | 10 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A14.V25.T16. | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A14.V25.T14. | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A14.V25.T3. | 10 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A14.V2.T18. | 6 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A14.V2.T17. | 7 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 5 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A14.V2.T3. | 7 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V27.T12. | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R.A7.V25.T12. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A7.V17.T12. | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R.A7.V6.T12. | 8 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A7.V2.T12. | 7 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A6.V22.T17. | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V22.T7. | 7 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A6.V22.T4. | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V22.T3. | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V18.T18. | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R.A6.V18.T17. | 8 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V18.T14. | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | [NAME]. | 6 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V18.T2. | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R.A6.V14.T18. | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R.A6.V14.T17. | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V14.T16. | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V14.T14. | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A6.V14.T8. | 6 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V14.T7. | 5 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A6.V14.T4. | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V14.T3. | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V14.T2. | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R.A6.V13.T18. | 8 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R.A6.V13.T17. | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V13.T4. | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V13.T3. | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 7 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V6.T3. | 9 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V4.T18. | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R.A6.V4.T17. | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V4.T16. | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V4.T7. | 7 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A6.V4.T4. | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V4.T3. | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V3.T18. | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A6.V3.T4. | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V2.T8. | 6 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V2.T3. | 8 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V28.T18. | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A7.V28.T17. | 9 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 7 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V28.T3. | 9 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V28.T2. | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R.A7.V27.T18. | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R.A7.V27.T17. | 10 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V27.T16. | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A7.V27.T8. | 8 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V25.T18. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A7.V25.T17. | 11 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V25.T16. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A7.V25.T14. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V25.T8. | 9 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V25.T7. | 8 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A7.V25.T6. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R.A7.V25.T3. | 11 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V25.T2. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R.A7.V25.T1. | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R.A7.V23.T18. | 9 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A7.V23.T17. | 10 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V23.T8. | 8 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V22.T18. | 9 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R.A7.V22.T17. | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V22.T7. | 7 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A7.V22.T4. | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V22.T3. | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V18.T18. | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R.A7.V18.T17. | 8 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V18.T14. | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V18.T8. | 6 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V18.T2. | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R.A7.V14.T18. | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R.A7.V14.T17. | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V14.T16. | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A7.V14.T14. | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V14.T8. | 6 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V14.T7. | 5 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A7.V14.T4. | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V14.T3. | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V14.T2. | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R.A7.V13.T18. | 8 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R.A7.V13.T17. | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V13.T4. | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V13.T3. | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V6.T18. | 8 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A7.V6.T17. | 9 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V6.T8. | 7 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V6.T3. | 9 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V3.T18. | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A7.V3.T17. | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V3.T16. | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A7.V3.T14. | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V3.T8. | 7 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V3.T4. | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V3.T3. | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V3.T2. | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A7.V2.T18. | 7 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A7.V2.T17. | 8 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V2.T8. | 6 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | [NAME]. | 8 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V25.T18. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A10.V25.T17. | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A10.V25.T16. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A10.V25.T14. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A10.V25.T8. | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A10.V25.T7. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A10.V25.T6. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R.A10.V25.T3. | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V25.T2. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R.A10.V25.T1. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R.A10.V22.T18. | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R.A10.V22.T17. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A10.V22.T7. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A10.V22.T4. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V22.T3. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V18.T18. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R.A10.V18.T17. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A10.V18.T14. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A10.V18.T8. | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | [NAME]. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R.A10.V14.T18. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R.A10.V14.T17. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A10.V14.T16. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A10.V14.T14. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A10.V14.T8. | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A10.V14.T7. | 5 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A10.V14.T4. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R.A10.V3.T18. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A10.V3.T17. | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A10.V3.T16. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A10.V3.T14. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A10.V3.T8. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A10.V3.T4. | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V3.T3. | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A10.V3.T2. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A10.V2.T18. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A10.V2.T17. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A10.V2.T3. | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V28.T18. | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A15.V28.T17. | 9 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V28.T8. | 7 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V28.T3. | 9 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V28.T2. | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R.A15.V23.T18. | 9 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A15.V23.T17. | 10 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V23.T8. | 8 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V22.T18. | 9 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R.A15.V22.T17. | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V22.T7. | 7 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A15.V22.T4. | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V22.T3. | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V13.T18. | 8 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R.A15.V13.T17. | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V13.T4. | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V13.T3. | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V6.T18. | 8 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A15.V6.T17. | 9 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 7 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V6.T3. | 9 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V4.T18. | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R.A15.V4.T17. | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V4.T16. | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A15.V4.T7. | 7 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A15.V4.T4. | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V4.T3. | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V3.T18. | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A15.V3.T17. | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A15.V3.T16. | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A15.V3.T14. | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A15.V3.T8. | 7 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V3.T4. | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V3.T3. | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A15.V3.T2. | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A15.V2.T18. | 7 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A15.V2.T17. | 8 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 6 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V2.T3. | 8 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V28.T18. | 7 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A16.V28.T17. | 8 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V28.T12. | 7 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A16.V28.T8. | 6 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | [NAME]. | 8 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V27.T18. | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | [NAME]. | 9 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V27.T16. | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A16.V27.T12. | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R.A16.V27.T8. | 7 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V25.T18. | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A16.V25.T17. | 10 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V25.T16. | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A16.V25.T14. | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A16.V25.T12. | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | [NAME]. | 8 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V25.T3. | 10 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V23.T18. | 8 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A16.V23.T17. | 9 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V23.T12. | 8 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | [NAME]. | 7 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V15.T18. | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R.A16.V15.T16. | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A16.V15.T14. | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A16.V15.T8. | 6 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V15.T4. | 8 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V14.T18. | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R.A16.V14.T17. | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V14.T16. | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A16.V14.T14. | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A16.V14.T12. | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R.A16.V14.T8. | 5 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V14.T4. | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V14.T3. | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 7 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R.A16.V13.T17. | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V13.T4. | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V13.T3. | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V6.T18. | 7 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A16.V6.T17. | 8 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V6.T12. | 7 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A16.V6.T3. | 8 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A16.V2.T18. | 6 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A16.V2.T17. | 7 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A16.V2.T12. | 6 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | [NAME]. | 5 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A16.V2.T3. | 7 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V27.T17. | 11 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A4.V27.T16. | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A4.V25.T17. | 12 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A4.V25.T16. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A4.V23.T17. | 11 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A4.V3.T17. | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A4.V3.T16. | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V25.T17. | 11 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V25.T16. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V25.T12. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A6.V23.T17. | 10 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V17.T12. | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R.A6.V6.T17. | 9 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V6.T12. | 8 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A6.V3.T17. | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V3.T16. | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V2.T17. | 8 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A6.V2.T12. | 7 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A17.V28.T18. | 8 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A17.V28.T17. | 9 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V28.T12. | 8 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R.A17.V25.T18. | 10 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A17.V25.T17. | 11 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V25.T16. | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A17.V25.T14. | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A17.V25.T12. | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A17.V25.T8. | 9 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A17.V25.T3. | 11 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A17.V17.T18. | 9 | A17. Recommendation systems | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R.A17.V17.T14. | 9 | A17. Recommendation systems | 2.8 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A17.V17.T12. | 9 | A17. Recommendation systems | 2.8 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R.A17.V17.T8. | 8 | A17. Recommendation systems | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A17.V14.T18. | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R.A17.V14.T17. | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V14.T16. | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A17.V14.T14. | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A17.V14.T12. | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R.A17.V14.T8. | 6 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A17.V14.T7. | 5 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A17.V14.T4. | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A17.V14.T3. | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A17.V14.T2. | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R.A17.V6.T18. | 8 | A17. Recommendation systems | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A17.V6.T17. | 9 | A17. Recommendation systems | 2.8 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V6.T12. | 8 | A17. Recommendation systems | 2.8 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A17.V6.T3. | 9 | A17. Recommendation systems | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A17.V3.T18. | 8 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A17.V3.T17. | 9 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V3.T16. | 8 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A17.V3.T14. | 8 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A17.V3.T8. | 7 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A17.V3.T4. | 9 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A17.V3.T3. | 9 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 8 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R.A17.V2.T18. | 7 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A17.V2.T17. | 8 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A17.V2.T12. | 7 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A17.V2.T8. | 6 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A17.V2.T3. | 8 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V27.T18. | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R.A4.V27.T12. | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R.A4.V25.T18. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A4.V25.T12. | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A4.V23.T18. | 10 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A4.V23.T12. | 10 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A6.V25.T18. | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A6.V23.T18. | 9 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A6.V23.T12. | 9 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R.A6.V17.T18. | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R.A6.V17.T14. | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A6.V6.T18. | 8 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A6.V2.T18. | 7 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A10.V25.T12. | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R.A10.V2.T12. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A2.V28.T18. | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A2.V28.T17. | 10 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V28.T8. | 8 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V28.T3. | 10 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V28.T2. | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R.A2.V27.T18. | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R.A2.V27.T17. | 11 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V27.T16. | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A2.V27.T12. | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R.A2.V27.T8. | 9 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V25.T18. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A2.V25.T17. | 12 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V25.T16. | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A2.V23.T18. | 10 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A2.V23.T17. | 11 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V23.T8. | 9 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V16.T18. | 11 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R.A2.V16.T17. | 12 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V16.T14. | 11 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A2.V16.T8. | 10 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V16.T7. | 9 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A2.V16.T3. | 12 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V15.T18. | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R.A2.V15.T16. | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A2.V15.T14. | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A2.V15.T8. | 8 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V15.T4. | 10 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V6.T18. | 9 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | [NAME]. | 10 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V6.T12. | 9 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A2.V6.T8. | 8 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V6.T3. | 10 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V4.T18. | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R.A2.V4.T17. | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V4.T16. | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A2.V4.T12. | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R.A2.V4.T7. | 8 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A2.V4.T4. | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V4.T3. | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V3.T18. | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A2.V3.T17. | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V3.T16. | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A2.V3.T4. | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A2.V2.T18. | 8 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A2.V2.T17. | 9 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A2.V2.T12. | 8 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | [NAME]. | 7 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A2.V2.T3. | 9 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V28.T18. | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A3.V28.T17. | 10 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V28.T8. | 8 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V28.T3. | 10 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V28.T2. | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R.A3.V27.T18. | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R.A3.V27.T17. | 11 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V27.T16. | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A3.V27.T12. | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R.A3.V27.T8. | 9 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V25.T18. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R.A3.V25.T17. | 12 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V25.T16. | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A3.V23.T18. | 10 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R.A3.V23.T17. | 11 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V23.T8. | 9 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V16.T18. | 11 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R.A3.V16.T17. | 12 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V16.T14. | 11 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A3.V16.T8. | 10 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V16.T7. | 9 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A3.V16.T3. | 12 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V15.T18. | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R.A3.V15.T16. | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A3.V15.T14. | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A3.V15.T8. | 8 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V15.T4. | 10 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V6.T18. | 9 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R.A3.V6.T17. | 10 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V6.T12. | 9 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R.A3.V6.T8. | 8 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V6.T3. | 10 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V4.T18. | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R.A3.V4.T17. | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V4.T16. | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A3.V4.T12. | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R.A3.V4.T7. | 8 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A3.V4.T4. | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V4.T3. | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V3.T18. | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A3.V3.T17. | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V3.T16. | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A3.V3.T4. | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A3.V2.T18. | 8 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R.A3.V2.T17. | 9 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A3.V2.T12. | 8 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R.A3.V2.T8. | 7 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A3.V2.T3. | 9 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V28.T18. | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A4.V28.T17. | 10 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A4.V28.T8. | 8 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V27.T8. | 9 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V25.T8. | 10 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V25.T7. | 9 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A4.V23.T8. | 9 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V15.T18. | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R.A4.V15.T16. | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A4.V15.T8. | 8 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V15.T4. | 10 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A4.V3.T18. | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R.A4.V3.T8. | 8 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A4.V3.T4. | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V28.T18. | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R.A6.V28.T17. | 9 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | [NAME]. | 7 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V28.T3. | 9 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V28.T2. | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | [NAME]. | 8 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V22.T18. | 9 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R.A6.V17.T8. | 8 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V16.T14. | 10 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A6.V16.T8. | 9 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V16.T7. | 8 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A6.V16.T3. | 11 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A6.V15.T18. | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R.A6.V15.T16. | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A6.V15.T14. | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A6.V15.T8. | 7 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A6.V15.T4. | 9 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V17.T18. | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R.A7.V17.T14. | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V17.T8. | 8 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V16.T18. | 10 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R.A7.V16.T17. | 11 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R.A7.V16.T14. | 10 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A7.V16.T8. | 9 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V16.T7. | 8 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R.A7.V16.T3. | 11 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | [NAME]. | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | [NAME]. | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R.A7.V15.T14. | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | [NAME]. | 7 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A7.V15.T4. | 9 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R.A7.V14.T12. | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R.A10.V14.T12. | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R.A15.V16.T14. | 10 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R.A15.V16.T8. | 9 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R.A15.V16.T7. | 8 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2