Spreadsheet: 81d09999-3736-4e6d-abaf-f7bfccbfb6f3
Sheet: Risk Assessment

 |  | Identification & Assessment of Risks (Asset - Threat - Vulnerability)
 | Aggregate Risk -ID | Risk-ID | Risk Value | Asset Description | Asset Value | Vulnerability Description | Vulnerability Value | Threat Description | Threat Value | A/V/T ID | Risk ID | Risk Value | Risk Value (Final) | Final Risk from 0-8 |  | Values | Counts | Weighted Average
 | R1, R4, R6, R9, R12 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4 |  |  |  |  |  |  | 1
 | R1, R4, R9 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3 |  |  |  |  |  |  | 2
 | R1, R4, R9 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2 |  |  |  |  |  |  | 3
 | R1, R4, R9 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4 |  |  |  |  |  |  | 4
 | R1, R4, R9 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5 |  |  |  |  |  |  | 5
 | R1, R4, R9 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4 |  |  |  |  |  |  | 6
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4 |  |  |  |  |  |  | 7
 | R1 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4 |  |  |  |  |  |  | 8
 | R1 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5 |  |  |  |  |  |  | 9
 | R1 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4 |  |  |  |  |  |  | 10
 | R1 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3 |  |  |  |  |  |  | 11
 | R1 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2 |  |  |  |  |  |  | 12
 | R1 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5 |  |  |  |  |  |  | 13
 | R1 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 |  |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 |  |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R9, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R9 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R9 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R4, R7, R8, R11, R12 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R11 |  | 10 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8, R11 |  | 12 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1 |  | 9 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 12 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 8 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R10 |  | 11 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4, R10 |  | 11 | A2. Social reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R10 |  | 12 | A2. Social reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 12 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R8, R10, R12 |  | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 8 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R10 |  | 7 | A2. Social reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4, R10 |  | 10 | A2. Social reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R7, R8, R11 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R11 |  | 10 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 9 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8, R11 |  | 12 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4, R8 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1 |  | 9 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 12 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R10 |  | 11 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4, R10 |  | 11 | A3. Professional reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R10 |  | 12 | A3. Professional reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 12 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 8 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R10 |  | 7 | A3. Professional reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4, R10 |  | 10 | A3. Professional reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R5, R6, R7, R8, R12 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8 |  | 9 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8 |  | 11 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4, R8 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R10 |  | 10 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 9 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4, R10 |  | 10 | A6. Life-logging services | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R10 |  | 11 | A6. Life-logging services | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A6. Life-logging services | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4, R5, R8, R10, R12 |  | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R10 |  | 6 | A6. Life-logging services | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4, R10 |  | 9 | A6. Life-logging services | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R2, R5, R12 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 7 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R2 |  | 10 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R2 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R2 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1 |  | 5 | A8. Smart home objects / appliances | 2 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1 |  | 5 | A8. Smart home objects / appliances | 2 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T5. Intermittent or no connectivity | 2
 | R1 |  | 8 | A8. Smart home objects / appliances | 2 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T18. Monitoring and surveillance | 4
 | R1 |  | 10 | A8. Smart home objects / appliances | 2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2.1 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 7 | A8. Smart home objects / appliances | 2.1 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1 |  | 10 | A8. Smart home objects / appliances | 2.1 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 10 | A8. Smart home objects / appliances | 2.1 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1 |  | 10 | A8. Smart home objects / appliances | 2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2.1 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 7 | A8. Smart home objects / appliances | 2.1 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R9 |  | 10 | A8. Smart home objects / appliances | 2.1 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 7 | A8. Smart home objects / appliances | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R1 |  | 8 | A8. Smart home objects / appliances | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 8 | A8. Smart home objects / appliances | 2 | V11. PC and home infrastructure vulnerabilities | 4 | T18. Monitoring and surveillance | 4
 | R1 |  | 6 | A8. Smart home objects / appliances | 2.1 | V11. PC and home infrastructure vulnerabilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R7 |  | 8 | A8. Smart home objects / appliances | 2.1 | V11. PC and home infrastructure vulnerabilities | 4 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1 |  | 6 | A8. Smart home objects / appliances | 2 | V11. PC and home infrastructure vulnerabilities | 4 | T5. Intermittent or no connectivity | 2
 | R1 |  | 9 | A8. Smart home objects / appliances | 2 | V11. PC and home infrastructure vulnerabilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2.1 | V11. PC and home infrastructure vulnerabilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 5 | A8. Smart home objects / appliances | 2.1 | V9. Lack of third party system reviews and software integrity certification | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1 |  | 5 | A8. Smart home objects / appliances | 2.1 | V9. Lack of third party system reviews and software integrity certification | 3 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R7 |  | 5 | A8. Smart home objects / appliances | 2 | V9. Lack of third party system reviews and software integrity certification | 3 | T5. Intermittent or no connectivity | 2
 | R1 |  | 8 | A8. Smart home objects / appliances | 2 | V9. Lack of third party system reviews and software integrity certification | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V9. Lack of third party system reviews and software integrity certification | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A8. Smart home objects / appliances | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R7 |  | 9 | A8. Smart home objects / appliances | 2.1 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 10 | A8. Smart home objects / appliances | 2.1 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 6 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R7 |  | 8 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 5 | A8. Smart home objects / appliances | 2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 7 | A8. Smart home objects / appliances | 2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 5 | A8. Smart home objects / appliances | 2.1 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 |  |  | 5 | A8. Smart home objects / appliances | 2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R6, R12 |  | 7 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R10 |  | 7 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R8, R10 |  | 10 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 11 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R10 |  | 7 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R8, R10 |  | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R1, R8, R10 |  | 10 | A6. Life-logging services | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R10 |  | 11 | A6. Life-logging services | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R10 |  | 9 | A6. Life-logging services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R5, R12 |  | 8 | A6. Life-logging services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T5. Intermittent or no connectivity | 2
 | R1, R5, R12 |  | 11 | A6. Life-logging services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R5, R12 |  | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R1, R4, R5, R6, R7, R12 |  | 8 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T11. Constrain consumer choices | 3
 | R1, R4, R12 |  | 6 | A6. Life-logging services | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4, R12 |  | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R2 |  | 9 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R4 |  | 8 | A15. Databases of aggregated data | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 10 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 11 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A15. Databases of aggregated data | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A15. Databases of aggregated data | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A15. Databases of aggregated data | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A15. Databases of aggregated data | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T12. Vested interests | 4
 | R1, R4, R10 |  | 9 | A15. Databases of aggregated data | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 8 | A15. Databases of aggregated data | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 11 | A15. Databases of aggregated data | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R1, R4, R6, R10 |  | 7 | A15. Databases of aggregated data | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R1, R4, R6, R8 |  | 8 | A15. Databases of aggregated data | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T11. Constrain consumer choices | 3
 | R1, R4, R8 |  | 7 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R4, R8 |  | 6 | A15. Databases of aggregated data | 3 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 8 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 8 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 8 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 8 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 7 | A2. Social reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 10 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4 |  | 8 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R4, R6, R8 |  | 10 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R6, R8, R12 |  | 10 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R6, R7, R8, R12 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R1, R4, R8 |  | 8 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 10 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R1, R4, R8 |  | 7 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R1, R4 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R1, R4 |  | 10 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 7 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 7 | A3. Professional reputation | 4 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4 |  | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4 |  | 8 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 11 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4 |  | 11 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R4 |  | 10 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4 |  | 8 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 8 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4, R8 |  | 8 | A5. Ideas | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4, R8, R12 |  | 7 | A5. Ideas | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R12 |  | 10 | A5. Ideas | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 10 | A5. Ideas | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4, R8 |  | 10 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R4 |  | 9 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 9 | A7. Social networking services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R8 |  | 9 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R4, R8 |  | 9 | A8. Smart home objects / appliances | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 10 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 8 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R10 |  | 8 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 6 | A8. Smart home objects / appliances | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R10 |  | 7 | A8. Smart home objects / appliances | 2.1 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R5 |  | 5 | A8. Smart home objects / appliances | 2.1 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 11 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 10 | A9. Laptops and PC computers | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 9 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 6 | A9. Laptops and PC computers | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 6 | A9. Laptops and PC computers | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T5. Intermittent or no connectivity | 2
 | R1, R10 |  | 9 | A9. Laptops and PC computers | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R10 |  | 8 | A9. Laptops and PC computers | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R5, R6, R8, R12 |  | 8 | A9. Laptops and PC computers | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R1, R4, R5, R8, R10, R12 |  | 10 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1, R5 |  | 11 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R5 |  | 10 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R5 |  | 9 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R5 |  | 8 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R6, R9 |  | 11 | A9. Laptops and PC computers | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R6, R9, R12 |  | 8 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R6, R8 |  | 7 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 7 | A9. Laptops and PC computers | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 7 | A9. Laptops and PC computers | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T5. Intermittent or no connectivity | 2
 | R1, R4, R8 |  | 9 | A9. Laptops and PC computers | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R12 |  | 9 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 8 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8, R10 |  | 6 | A9. Laptops and PC computers | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R10 |  | 6 | A9. Laptops and PC computers | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R8 |  | 10 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R4, R8, R10, R12 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8, R10 |  | 12 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4, R8 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1, R8, R10 |  | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8, R10 |  | 11 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 10 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4, R8, R10 |  | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R4, R8, R10 |  | 8 | A8. Smart home objects / appliances | 2.1 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 10 | A8. Smart home objects / appliances | 2.1 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 9 | A8. Smart home objects / appliances | 2.1 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R8, R10 |  | 9 | A8. Smart home objects / appliances | 2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 9 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R9 |  | 9 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R9, R12 |  | 10 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R2 |  | 10 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R2 |  | 9 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R2 |  | 9 | A8. Smart home objects / appliances | 2.1 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1 |  | 7 | A8. Smart home objects / appliances | 2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1 |  | 7 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 8 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 7 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R9 |  | 7 | A11. e-cars and e-bikes | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1 |  | 8 | A11. e-cars and e-bikes | 3 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 6 | A11. e-cars and e-bikes | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 8 | A11. e-cars and e-bikes | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 6 | A11. e-cars and e-bikes | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1 |  | 6 | A11. e-cars and e-bikes | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R7 |  | 9 | A11. e-cars and e-bikes | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R9 |  | 8 | A12. Home security system | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R1, R9 |  | 9 | A12. Home security system | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 9 | A12. Home security system | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A12. Home security system | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R9 |  | 10 | A12. Home security system | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R7 |  | 10 | A12. Home security system | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 11 | A12. Home security system | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 11 | A12. Home security system | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 10 | A12. Home security system | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R7, R9 |  | 9 | A12. Home security system | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R7 |  | 9 | A12. Home security system | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R2 |  | 7 | A12. Home security system | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R2 |  | 8 | A12. Home security system | 3 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R2 |  | 6 | A12. Home security system | 3 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R2 |  | 6 | A12. Home security system | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 6 | A12. Home security system | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 |  |  | 6 | A12. Home security system | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1 |  | 9 | A12. Home security system | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R9 |  | 7 | A13. Energy management system | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R9 |  | 8 | A13. Energy management system | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R2 |  | 8 | A13. Energy management system | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R2 |  | 8 | A13. Energy management system | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R9 |  | 9 | A13. Energy management system | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R2 |  | 9 | A13. Energy management system | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R2 |  | 10 | A13. Energy management system | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R2 |  | 10 | A13. Energy management system | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R2 |  | 9 | A13. Energy management system | 2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R2 |  | 6 | A13. Energy management system | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R2 |  | 7 | A13. Energy management system | 2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 |  |  | 5 | A13. Energy management system | 2 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1 |  | 5 | A13. Energy management system | 2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R8, R9 |  | 5 | A13. Energy management system | 2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R8, R9 |  | 8 | A13. Energy management system | 2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R9 |  | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R4, R8, R9 |  | 10 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R8, R9 |  | 9 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R9 |  | 10 | A14. External recognition / monitoring system | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R9 |  | 6 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R9 |  | 7 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 |  |  | 5 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 |  |  | 7 | A14. External recognition / monitoring system | 2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R3, R6 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R3, R6, R12 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R3, R6 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R3, R6 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R3, R6 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R3, R6 |  | 8 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R3, R10 |  | 10 | A6. Life-logging services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T12. Vested interests | 4
 | R3 |  | 9 | A6. Life-logging services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T11. Constrain consumer choices | 3
 | R3, R5, R6 |  | 6 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R3, R8 |  | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R3 |  | 8 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 | R3 |  | 8 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R3, R8 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R3 |  | 9 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R3, R8 |  | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R3 |  | 8 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R3, R10 |  | 10 | A7. Social networking services | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T12. Vested interests | 4
 | R3 |  | 9 | A7. Social networking services | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T11. Constrain consumer choices | 3
 | R3, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R3 |  | 7 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R3, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R3 |  | 6 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R3 |  | 6 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R10 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R10 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R1, R4 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8 |  | 5 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R1, R4, R8, R10 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V12. Smart phone vulnerabilities | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V11. PC and home infrastructure vulnerabilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 9 | A2. Social reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R4 |  | 11 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 12 | A2. Social reputation | 4 | V12. Smart phone vulnerabilities | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R6, R8 |  | 11 | A2. Social reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R6, R8, R12 |  | 11 | A2. Social reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R6, R7, R8, R12 |  | 12 | A2. Social reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 12 | A2. Social reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8 |  | 7 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R1, R4, R8 |  | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R1, R4, R8 |  | 9 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R1, R4 |  | 9 | A3. Professional reputation | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R1, R4 |  | 11 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 12 | A3. Professional reputation | 4 | V12. Smart phone vulnerabilities | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V11. PC and home infrastructure vulnerabilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 12 | A3. Professional reputation | 4 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 11 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 12 | A3. Professional reputation | 4 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 7 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R4 |  | 8 | A5. Ideas | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 9 | A5. Ideas | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A5. Ideas | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A5. Ideas | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A5. Ideas | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R4 |  | 8 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 7 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R4, R8, R12 |  | 8 | A5. Ideas | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R12 |  | 10 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 9 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T2. Identity theft | 4
 | R1, R4, R8 |  | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 10 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A6. Life-logging services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8 |  | 6 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R10 |  | 7 | A6. Life-logging services | 3 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R1, R4 |  | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R10 |  | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 6 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R10 |  | 6 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 5 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R10 |  | 7 | A6. Life-logging services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R1, R4, R10 |  | 8 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R5, R6, R8, R12 |  | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R5, R8, R10, R12 |  | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 9 | A6. Life-logging services | 3 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 7 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R5 |  | 9 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R6, R9 |  | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R6, R9, R12 |  | 9 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R6, R8 |  | 7 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 10 | A6. Life-logging services | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R12 |  | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 6 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R10 |  | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 9 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10, R12 |  | 9 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 10 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 11 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8 |  | 8 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R8, R10 |  | 11 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4, R9 |  | 10 | A7. Social networking services | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R9, R12 |  | 9 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 10 | A7. Social networking services | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4 |  | 8 | A7. Social networking services | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4 |  | 8 | A7. Social networking services | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4 |  | 7 | A7. Social networking services | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4 |  | 9 | A7. Social networking services | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R4, R8 |  | 8 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4, R8 |  | 6 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 6 | A7. Social networking services | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R4, R8, R10 |  | 6 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8 |  | 5 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8 |  | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R4, R8 |  | 8 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R4, R8 |  | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8 |  | 9 | A7. Social networking services | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R10 |  | 10 | A7. Social networking services | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R4, R10 |  | 10 | A7. Social networking services | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4, R10 |  | 11 | A7. Social networking services | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R10 |  | 11 | A7. Social networking services | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4 |  | 10 | A7. Social networking services | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 7 | A7. Social networking services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 9 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8 |  | 8 | A7. Social networking services | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R4, R8, R10 |  | 7 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8, R10 |  | 6 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 8 | A7. Social networking services | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R10 |  | 6 | A7. Social networking services | 3.2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 |  |  | 6 | A7. Social networking services | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R4, R10 |  | 9 | A7. Social networking services | 3.2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 11 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 6 | A9. Laptops and PC computers | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 6 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 5 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V11. PC and home infrastructure vulnerabilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V11. PC and home infrastructure vulnerabilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V11. PC and home infrastructure vulnerabilities | 4 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V11. PC and home infrastructure vulnerabilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V11. PC and home infrastructure vulnerabilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 11 | A9. Laptops and PC computers | 2.8 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R6, R8 |  | 11 | A9. Laptops and PC computers | 2.8 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R6, R8, R12 |  | 10 | A9. Laptops and PC computers | 2.8 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4, R6, R7, R8, R12 |  | 10 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 10 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8 |  | 9 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 10 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8 |  | 11 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R1, R4, R8 |  | 11 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R1, R4, R8 |  | 10 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R4 |  | 10 | A9. Laptops and PC computers | 2.8 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R1, R4 |  | 7 | A9. Laptops and PC computers | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4 |  | 7 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 8 | A9. Laptops and PC computers | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R4 |  | 9 | A9. Laptops and PC computers | 2.8 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T2. Identity theft | 4
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T1. Accidental loss  of device | 4
 | R1, R4 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R12 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R12 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4, R8 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3 | V21. Reliance on legacy, un-patched systems or integration mistakes | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V20. Increase of (unprotected) data storage capacity in smart-devices | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V18. Lack of noticeable (and usable) notification systems | 2 | T2. Identity theft | 4
 | R1, R4, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R10 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R10 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R5, R6, R8, R12 |  | 5 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R5, R8, R10, R12 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R1, R5 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T18. Monitoring and surveillance | 4
 | R1, R5 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R6, R9 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R6, R9, R12 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R6, R8 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V12. Smart phone vulnerabilities | 5 | T1. Accidental loss  of device | 4
 | R1, R4, R8, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R12 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10, R12 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T6. Malicious physical attacks (theft, vandalism, misuse, etc.) | 4
 | R1, R4, R8, R10 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 11 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T2. Identity theft | 4
 | R1, R4, R8 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T1. Accidental loss  of device | 4
 | R1, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R8, R10 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R9 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R9, R12 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R9 |  | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 7 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 8 | A15. Databases of aggregated data | 3.2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R1, R7 |  | 10 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 8 | A15. Databases of aggregated data | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R1 |  | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 7 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1 |  | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R7 |  | 10 | A15. Databases of aggregated data | 3.2 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 8 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R7 |  | 9 | A15. Databases of aggregated data | 3.2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 10 | A15. Databases of aggregated data | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T1. Accidental loss  of device | 4
 | R1 |  | 10 | A15. Databases of aggregated data | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R7 |  | 10 | A15. Databases of aggregated data | 3.2 | V8. Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 5 | T2. Identity theft | 4
 | R1, R4 |  | 8 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R5 |  | 7 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R5 |  | 9 | A15. Databases of aggregated data | 3.2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R5 |  | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R6, R9 |  | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R6, R9, R12 |  | 9 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R6, R8 |  | 7 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 10 | A15. Databases of aggregated data | 3.2 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R12 |  | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R10 |  | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R10 |  | 7 | A15. Databases of aggregated data | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R8 |  | 7 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10, R12 |  | 9 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 8 | A15. Databases of aggregated data | 3.2 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R4, R8, R10 |  | 7 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 8 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 6 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8, R10 |  | 8 | A15. Databases of aggregated data | 3.2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 6 | A15. Databases of aggregated data | 3.2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R8 |  | 6 | A15. Databases of aggregated data | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4, R8, R10 |  | 9 | A15. Databases of aggregated data | 3.2 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 6 | A15. Databases of aggregated data | 3.2 | V9. Lack of third party system reviews and software integrity certification | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4, R8, R10 |  | 6 | A15. Databases of aggregated data | 3.2 | V9. Lack of third party system reviews and software integrity certification | 3 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R8, R10 |  | 6 | A15. Databases of aggregated data | 3.2 | V9. Lack of third party system reviews and software integrity certification | 3 | T5. Intermittent or no connectivity | 2
 | R1, R8 |  | 9 | A15. Databases of aggregated data | 3.2 | V9. Lack of third party system reviews and software integrity certification | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 9 | A15. Databases of aggregated data | 3.2 | V9. Lack of third party system reviews and software integrity certification | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R9, R10 |  | 7 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R8, R9 |  | 8 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R9 |  | 7 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R4, R9, R12 |  | 6 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R4, R8, R9 |  | 6 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R8, R9 |  | 8 | A16. Data mining pack / software | 2 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 |  |  | 9 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 |  |  | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4 |  | 8 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 |  |  | 7 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 |  |  | 7 | A16. Data mining pack / software | 2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 |  |  | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 |  |  | 10 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 |  |  | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R8 |  | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4 |  | 9 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R4 |  | 8 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 |  |  | 8 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 |  |  | 10 | A16. Data mining pack / software | 2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 8 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 |  |  | 9 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4 |  | 8 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 |  |  | 7 | A16. Data mining pack / software | 2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4 |  | 8 | A16. Data mining pack / software | 2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 |  |  | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 |  |  | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R8 |  | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 |  |  | 5 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 |  |  | 5 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 |  |  | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 7 | A16. Data mining pack / software | 2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 7 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T18. Monitoring and surveillance | 4
 |  |  | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R9 |  | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R9 |  | 8 | A16. Data mining pack / software | 2 | V13. Lack of revocation/correction/deletion mechanisms | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R9 |  | 7 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R4, R9 |  | 8 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R9 |  | 7 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R4, R9 |  | 8 | A16. Data mining pack / software | 2 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R4 |  | 7 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4 |  | 6 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R4 |  | 5 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 |  |  | 5 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R4, R6 |  | 5 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R5, R6 |  | 7 | A16. Data mining pack / software | 2 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R6 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R4, R5, R6 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R4, R5, R6, R8 |  | 11 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R5, R6, R8 |  | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R5, R6 |  | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R5, R6 |  | 9 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R4, R5, R6, R8, R9, R12 |  | 12 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R5, R6, R8, R9 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R5, R6, R9, R10, R12 |  | 10 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R5, R6, R9 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R5, R6, R9, R10, R11, R12 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4, R5, R6, R9, R10, R11, R12 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R4, R5, R6, R8, R10 |  | 11 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R5, R8, R9, R10, R12 |  | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R5, R8, R9 |  | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R5 |  | 8 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R5, R6, R8, R12 |  | 11 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R5, R8, R10, R12 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R5 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R5 |  | 9 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R5 |  | 9 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R5 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R6, R9 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R6, R9, R12 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R4, R6, R8 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 10 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8 |  | 8 | A6. Life-logging services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R12 |  | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R8, R10 |  | 9 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R10 |  | 8 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R1, R8 |  | 7 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 9 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10, R12 |  | 8 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 7 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R4, R8 |  | 6 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R8, R10 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R10 |  | 9 | A8. Smart home objects / appliances | 2.1 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R8 |  | 7 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 6 | A8. Smart home objects / appliances | 2.1 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R10 |  | 6 | A8. Smart home objects / appliances | 2.1 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 5 | A8. Smart home objects / appliances | 2.1 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R9, R10 |  | 8 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 9 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 8 | A17. Recommendation systems | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T12. Vested interests | 4
 | R1, R8, R10 |  | 10 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 11 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R9 |  | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R9, R12 |  | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R5 |  | 10 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R5 |  | 9 | A17. Recommendation systems | 2.8 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1 |  | 9 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 11 | A17. Recommendation systems | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R9 |  | 8 | A17. Recommendation systems | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 8 | A17. Recommendation systems | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 8 | A17. Recommendation systems | 2.8 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R1 |  | 7 | A17. Recommendation systems | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 9 | A17. Recommendation systems | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A17. Recommendation systems | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R1, R7 |  | 9 | A17. Recommendation systems | 2.8 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 9 | A17. Recommendation systems | 2.8 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T12. Vested interests | 4
 | R1 |  | 8 | A17. Recommendation systems | 2.8 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1 |  | 7 | A17. Recommendation systems | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1 |  | 8 | A17. Recommendation systems | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R1, R7 |  | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1 |  | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1 |  | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R1, R7 |  | 6 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1 |  | 6 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1 |  | 5 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1 |  | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R7 |  | 8 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4 |  | 7 | A17. Recommendation systems | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T2. Identity theft | 4
 | R1 |  | 8 | A17. Recommendation systems | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R5 |  | 9 | A17. Recommendation systems | 2.8 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R5 |  | 8 | A17. Recommendation systems | 2.8 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R5 |  | 7 | A17. Recommendation systems | 2.8 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R4, R9, R10 |  | 9 | A17. Recommendation systems | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R9 |  | 8 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R4, R5 |  | 9 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R5 |  | 8 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R6, R9 |  | 8 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R6, R9, R12 |  | 7 | A17. Recommendation systems | 2.8 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R6, R8 |  | 7 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A17. Recommendation systems | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T2. Identity theft | 4
 | R1, R4, R8, R12 |  | 7 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 8 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 7 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R10 |  | 6 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R8 |  | 6 | A17. Recommendation systems | 2.8 | V2. Inadequate policy framework | 2 | T10. Spamming of users with ads and other non-solicited information; they can also use open, public information | 3
 | R1, R4, R8, R10 |  | 6 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10, R12 |  | 8 | A17. Recommendation systems | 3 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 6 | A17. Recommendation systems | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R4, R8, R10 |  | 6 | A17. Recommendation systems | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T5. Intermittent or no connectivity | 2
 | R1, R4, R8 |  | 9 | A17. Recommendation systems | 3 | V1. Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R8, R10 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 11 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R8 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8, R10 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R8, R10 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R9 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R4, R9, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R4, R6, R9 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R6, R9, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R6 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R4, R6 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R4, R6 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R3, R6 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T11. Constrain consumer choices | 3
 | R4, R5, R6, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T11. Constrain consumer choices | 3
 | R4, R6 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R4, R6, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R3, R6 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R3, R6, R12 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R4, R6, R8 |  | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R5, R6, R8 |  | 10 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R5, R6 |  | 9 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 | R4, R6, R8, R9 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R5, R6, R8 |  | 11 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R5, R6, R12 |  | 10 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R4, R6, R9, R10 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R6, R11 |  | 8 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R5, R6, R10 |  | 9 | A4. Sentiments | 4 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R4, R6, R8, R10 |  | 10 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R5, R6, R8, R10 |  | 10 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R5, R6 |  | 9 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R4, R6 |  | 9 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R4, R6 |  | 10 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R6 |  | 9 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R6 |  | 9 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R3, R6 |  | 9 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R3, R6 |  | 8 | A5. Ideas | 3.2 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 | R4, R6 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R4, R6 |  | 9 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R6 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R6 |  | 7 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R4, R6 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4, R6 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R3, R6 |  | 8 | A5. Ideas | 3.2 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T12. Vested interests | 4
 | R4, R6 |  | 9 | A5. Ideas | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R4, R6 |  | 10 | A5. Ideas | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R6 |  | 9 | A5. Ideas | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R6 |  | 8 | A5. Ideas | 3.2 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R1, R4, R6, R8 |  | 10 | A6. Life-logging services | 3 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T15. Increased need for attention / social exposure | 3
 | R1, R4, R8 |  | 9 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R12 |  | 9 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T12. Vested interests | 4
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R1, R10 |  | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 9 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10, R12 |  | 7 | A6. Life-logging services | 3 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 10 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R1, R4, R8 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3 | V12. Smart phone vulnerabilities | 5 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R1, R8, R10 |  | 8 | A10. Smart phone / mobile phone / life-logging devices | 3 | V12. Smart phone vulnerabilities | 5 | T5. Intermittent or no connectivity | 2
 | R1, R8, R10 |  | 9 | A10. Smart phone / mobile phone / life-logging devices | 3 | V5. Inherent features of smart devices (size, material etc.): easy to lose or steal | 5 | T11. Constrain consumer choices | 3
 | R1, R8 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R4, R8, R10 |  | 6 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V2. Inadequate policy framework | 2 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 8 | A12. Home security system | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R6, R8, R10 |  | 7 | A15. Databases of aggregated data | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R1, R8 |  | 11 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R8, R10 |  | 9 | A5. Ideas | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R1, R8, R10 |  | 10 | A5. Ideas | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1, R8 |  | 10 | A5. Ideas | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T12. Vested interests | 4
 | R1, R4, R9 |  | 9 | A5. Ideas | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T11. Constrain consumer choices | 3
 | R1, R4, R9, R12 |  | 10 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R4,R5 |  | 10 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R7 |  | 9 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R7, R10, R12 |  | 10 | A6. Life-logging services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R4, R12 |  | 7 | A7. Social networking services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T11. Constrain consumer choices | 3
 | R10 |  | 10 | A7. Social networking services | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R4, R5 |  | 10 | A7. Social networking services | 3 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R7 |  | 9 | A7. Social networking services | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T15. Increased need for attention / social exposure | 3
 | R7, R10 |  | 10 | A7. Social networking services | 3.2 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R4, R12 |  | 8 | A7. Social networking services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T11. Constrain consumer choices | 3
 | R4 |  | 8 | A7. Social networking services | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T12. Vested interests | 4
 | R10 |  | 7 | A7. Social networking services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T9. Exploring new ‘vulnerabilities’ in the new applications | 2
 | R4 |  | 7 | A7. Social networking services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T15. Increased need for attention / social exposure | 3
 | R4, R10, R12 |  | 8 | A7. Social networking services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R10 |  | 9 | A7. Social networking services | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T8. Overhearing/recording logging/blogging activity | 3
 |  |  | 8 | A7. Social networking services | 3 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T5. Intermittent or no connectivity | 2
 | R10 |  | 11 | A7. Social networking services | 3.2 | V7. Lack of interoperability between devices/ services/ technologies and/or systems | 5 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8 |  | 8 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R12 |  | 10 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8, R10 |  | 9 | A2. Social reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R8, R10 |  | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R1, R10 |  | 11 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8 |  | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R1, R4, R8, R10, R12 |  | 9 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 | R1, R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 12 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 11 | A2. Social reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8 |  | 10 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 12 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8 |  | 11 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8, R10 |  | 10 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8, R10 |  | 9 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R8 |  | 12 | A2. Social reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R9 |  | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R9, R12 |  | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R12 |  | 9 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8 |  | 8 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R8 |  | 10 | A2. Social reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R8, R10 |  | 9 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R4, R8, R10 |  | 8 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R8, R10 |  | 10 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R4, R8 |  | 8 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 11 | A2. Social reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10, R12 |  | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 9 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 10 | A2. Social reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8 |  | 8 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 9 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 8 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R8, R10 |  | 7 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8 |  | 9 | A2. Social reputation | 4 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 8 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 9 | A3. Professional reputation | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R8, R10 |  | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 11 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8 |  | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R9 |  | 10 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T12. Vested interests | 4
 | R1, R4, R9, R12 |  | 9 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T11. Constrain consumer choices | 3
 | R4, R8 |  | 9 | A3. Professional reputation | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8 |  | 12 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 11 | A3. Professional reputation | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R10 |  | 10 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 11 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 11 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 12 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 11 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8 |  | 10 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8, R10 |  | 9 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R8, R10 |  | 12 | A3. Professional reputation | 4 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R9 |  | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R9, R12 |  | 9 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8 |  | 8 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R8 |  | 10 | A3. Professional reputation | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R8, R10 |  | 9 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T12. Vested interests | 4
 | R4, R8, R10 |  | 8 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V6. Lack of appropriate, common or harmonized legislation in EU Member States | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8 |  | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R8, R10 |  | 10 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T12. Vested interests | 4
 | R4, R8 |  | 8 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T7. Malicious (logical) attacks on devices and systems | 2
 | R4, R8, R10 |  | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R10 |  | 11 | A3. Professional reputation | 4 | V4. Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 9 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4, R8, R10 |  | 10 | A3. Professional reputation | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 8 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 9 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R8, R10 |  | 8 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T12. Vested interests | 4
 | R1, R8 |  | 7 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R9 |  | 9 | A3. Professional reputation | 4 | V2. Inadequate policy framework | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R9, R12 |  | 9 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R10 |  | 10 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R8, R10 |  | 8 | A4. Sentiments | 4 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8 |  | 9 | A4. Sentiments | 4 | V27. Cognitive biases – Some people accept what they should not… | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8, R9, R11 |  | 10 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R8 |  | 9 | A4. Sentiments | 4 | V25. Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R4, R8, R10 |  | 9 | A4. Sentiments | 4 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R8, R9 |  | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R8, R9 |  | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R8, R9 |  | 8 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R2, R8 |  | 10 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R4, R8, R9, R10 |  | 9 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R4, R8, R9, R10 |  | 8 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R2, R4, R8, R10 |  | 10 | A4. Sentiments | 4 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R8, R10 |  | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R8, R10 |  | 9 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R1, R4, R8, R10 |  | 7 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R8, R10 |  | 9 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 8 | A6. Life-logging services | 3 | V28. Data linkability / lifelogging data can be aggregated with other data | 3 | T2. Identity theft | 4
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V23. Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8, R10 |  | 9 | A6. Life-logging services | 3 | V22. Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 4 | T18. Monitoring and surveillance | 4
 | R1, R8 |  | 8 | A6. Life-logging services | 3 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R9 |  | 10 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R4, R9, R12 |  | 9 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8 |  | 8 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R8, R10 |  | 11 | A6. Life-logging services | 3 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R8 |  | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R8, R10 |  | 8 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8 |  | 7 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R8 |  | 9 | A6. Life-logging services | 3 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R8 |  | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T18. Monitoring and surveillance | 4
 | R8 |  | 9 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R8 |  | 8 | A7. Social networking services | 3.2 | V17. Lack of mechanisms to validate reputation or trustworthiness of service provider | 4 | T8. Overhearing/recording logging/blogging activity | 3
 | R8, R10 |  | 10 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T18. Monitoring and surveillance | 4
 | R8, R10 |  | 11 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R8, R10 |  | 10 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R8, R10 |  | 9 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R8 |  | 8 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R8, R10 |  | 11 | A7. Social networking services | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R8 |  | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T18. Monitoring and surveillance | 4
 | R8 |  | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R8 |  | 8 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R8 |  | 7 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R8 |  | 9 | A7. Social networking services | 3.2 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T4. Unintentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R8, R10 |  | 7 | A7. Social networking services | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R8 |  | 7 | A10. Smart phone / mobile phone / life-logging devices | 3.2 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R1, R8, R10 |  | 10 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R1, R8, R10 |  | 9 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R8 |  | 8 | A15. Databases of aggregated data | 3.2 | V16. Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 5 | T7. Malicious (logical) attacks on devices and systems | 2
 | R1, R4, R9 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V24. Social reliance/over-confidence and trust on individual’s digital identity | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R1, R4, R9, R12 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V19. Increased complexity of controls (making it difficult for users to follow) | 3 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R9 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T18. Monitoring and surveillance | 4
 | R4, R9, R12 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R9 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R4, R9, R12 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 | R4, R9 |  | 7 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T12. Vested interests | 4
 | R4, R9 |  | 6 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T8. Overhearing/recording logging/blogging activity | 3
 | R4, R9 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V14. Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1, R4, R9 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T18. Monitoring and surveillance | 4
 | R1, R4, R9, R12 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T17. Data mining and profiling (large-scale, excessive and/or inappropriate) | 5
 | R4, R9 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V3. Inadequate privacy/security interfaces (poor interface design) | 3 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R9, R10 |  | 11 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T18. Monitoring and surveillance | 4
 | R9 |  | 11 | A4. Sentiments | 4 | V26. Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 5 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R9, R12 |  | 9 | A4. Sentiments | 4 | V15. Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | T13. Peer-pressure and social pressure to constantly share data and conform; fear of violent response / or ridicule from peers, friends etc; | 4
 | R1 |  | 10 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1 |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 9 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 11 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 10 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 10 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1, R7 |  | 10 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 10 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 11 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 10 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 10 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1 |  | 10 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 10 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 10 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1, R7 |  | 9 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 9 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R2 |  | 11 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 10 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 10 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R2 |  | 10 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1 |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 8 | A1. Actors’ digital presence not including social or professional reputation | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1, R7 |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 9 | A2. Social reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1 |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 9 | A3. Professional reputation | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 |  |  | 9 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R2 |  | 9 | A4. Sentiments | 4 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 |  |  | 10 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 |  |  | 9 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 9 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R7 |  | 9 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 9 | A5. Ideas | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1 |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 |  |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T11. Constrain consumer choices | 3
 |  |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4
 | R1, R7 |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T14. Individual being negligent, careless, making mistakes; e.g. does not follow procedures appropriately, e.g. clicks through | 4
 |  |  | 8 | A6. Life-logging services | 3 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T16. Changes in perception of privacy and / or privacy needs | 4
 | R1, R4 |  | 10 | A15. Databases of aggregated data | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T3. Intentional misuse, unauthorised disclosure, modification or destruction of individual’s data | 5
 | R1 |  | 9 | A15. Databases of aggregated data | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T2. Identity theft | 4
 | R9 |  | 9 | A15. Databases of aggregated data | 3.2 | V10. Over reliance and excessive dependency on electronic devices and systems | 4 | T12. Vested interests | 4