Towards a legally-compliant Internet of Things

迈向合法合规的物联网

• 批准号: EP/P024394/1
• 负责人: Jatinder Singh
• 金额: $ 121.32万
• 依托单位: University of Cambridge
• 依托单位国家: 英国
• 项目类别: Fellowship
• 财政年份: 2017
• 资助国家: 英国
• 起止时间: 2017 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FP024394%2F1
• 关键词: Towards; legally; compliant; Internet; Things

This project is to forge new directions towards the important, but largely unexplored challenge of aligning the Internet of Things (IoT) with legal and regulatory realities. The broad vision of the IoT is where the physical world comes online. It entails sensors and actuators seamlessly integrated with virtual services, as part of a wide-scale, potentially global systems infrastructure that dynamically reacts and responds to meet various goals. This vision has captured mainstream imagination. The connected infrastructure, a large-scale distributed system, enables a potentially limitless range of applications, which can be customised to individuals, groups and organisations, in areas including cities, retail, energy, health and lifestyle, transport and agriculture. However, with this vision comes legal, regulatory and social challenges. The scale and physical nature of this emerging systems environment involves sensors generating data on many detailed aspects of the world, much of it (potentially) highly personal or otherwise sensitive, and where actuation capabilities give systems a real, physical-world effect. As such, IoT (and more generally, ICT) applications, systems and services are increasingly subject to law and visible to regulators, while consumers, businesses and governments are beginning to demand more transparency and agency. Having the means for managing the associated risks, responsibilities, and obligations of the IoT is crucial for realising its potential, and the significant economic and social benefits it promises.This project directly targets these issues, by taking an interdisciplinary (tech-legal) approach towards legally-compliant distributed systems. The aim is to develop the conceptual frameworks for considering tech-legal compliance issues as well as the technical means for enabling systems (and therefore, those responsible) to comply with legal and regulatory obligations. By facilitating compliance, we work to improve agency, trust and accountability in the IoT, as well as reducing the overheads of compliance.As the IoT is data driven, the specific focus is on data flow management. We seek to improve the *control* and *visibility* of data as it moves throughout the IoT, in line with data management policy, reflecting legal obligations. This is so that those who have rights over data (including end-users), and those responsible for data (including service providers), are able to ensure their requirements and obligations are met, even as data moves `out of their hands'. This entails investigating how law and regulation, reflecting responsibilities and obligations, and personal preferences, can be embodied in policy, which technical mechanisms enforce end-to-end, system-wide. This includes auditing policy enforcement, to assist in demonstrating compliance, apportioning liability and indicating whether policy adequately captures legal responsibilities. This also entails the development of legal-technical frameworks that provide the methodology for investigating, enumerating and aligning compliance concerns across the disciplines, and identifying the mismatches between law and technology.Addressing such challenges requires an interdisciplinary approach. This project embodies a technical/legal symbiosis: work on the technical mechanisms for system-wide control and audit will be driven by legal and regulatory realities, and at the same time, we consider how the technical work impacts the emerging liability and policy concerns arising from the physical and increasingly pervasive and intrusive nature of the IoT. In undertaking this work, we seek to build the foundations for a broader area of multidisciplinary research concerning legally compliant systems.

该项目旨在打造新的方向，以应对将物联网（IoT）与法律的和监管现实相结合的重要但基本上尚未探索的挑战。物联网的广泛愿景是物理世界在线的地方。它需要将传感器和执行器与虚拟服务无缝集成，作为大规模、潜在的全球系统基础设施的一部分，动态地做出反应和响应，以满足各种目标。这一愿景吸引了主流的想象力。互联基础设施是一个大规模的分布式系统，可以为个人、团体和组织定制潜在的无限应用，包括城市、零售、能源、健康和生活方式、交通和农业等领域。然而，这一愿景带来了法律的、监管和社会挑战。这种新兴系统环境的规模和物理性质涉及传感器生成关于世界的许多详细方面的数据，其中大部分（潜在地）是高度个人化的或以其他方式敏感的，并且其中致动能力给予系统真实的物理世界效果。因此，物联网（以及更广泛的ICT）应用、系统和服务越来越多地受到法律的约束，监管机构也越来越关注这些应用、系统和服务，而消费者、企业和政府也开始要求更高的透明度和代理权。拥有管理物联网相关风险、责任和义务的方法对于实现其潜力以及其承诺的重大经济和社会效益至关重要。该项目通过跨学科（技术-法律）方法直接针对这些问题，实现合法的分布式系统。其目的是为审议技术-法律的合规问题制定概念框架，并制定技术手段，使各系统（以及负责者）能够遵守法律的和监管义务。通过促进合规性，我们致力于改善物联网的代理、信任和问责制，并减少合规性的间接费用。由于物联网是数据驱动的，因此特别关注数据流管理。我们寻求改善数据在物联网中移动时的“控制”和“可见性”，以符合数据管理政策，反映法律的义务。这样，对数据拥有权利的人（包括最终用户）和对数据负责的人（包括服务提供商）就能够确保满足其要求和义务，即使数据“从他们手中”转移。这就需要调查反映责任和义务以及个人偏好的法律和法规如何体现在政策中，技术机制在全系统端到端地执行这些政策。这包括审核政策执行情况，以协助证明合规性、分摊责任以及说明政策是否充分涵盖了法律的责任。这还需要制定法律-技术框架，为调查、列举和协调各学科的合规问题提供方法，并确定法律与技术之间的不匹配。该项目体现了技术/法律的共生关系：全系统控制和审计技术机制的工作将由法律的和监管现实驱动，同时，我们考虑技术工作如何影响物联网的物理和日益普遍的侵入性所产生的新兴责任和政策问题。在开展这项工作时，我们力求为有关合法合规系统的更广泛的多学科研究领域奠定基础。

项目成果

Understanding accountability in algorithmic supply chains

• DOI: 10.1145/3593013.3594073
• 发表时间: 2023-04
• 期刊: Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency
• 作者: Jennifer Cobbe;Michael Veale;Jatinder Singh

Regulating Recommending: Motivations, Considerations, and Principles

规范推荐：动机、考虑因素和原则

• DOI: 10.2139/ssrn.3371830
• 发表时间: 2019
• 期刊: SSRN Electronic Journal
• 作者: Cobbe J

Auditable Augmented/Mixed/Virtual Reality The Practicalities of Mobile System Transparency

可审计的增强/混合/虚拟现实移动系统透明度的实用性

• DOI: 10.1145/3495001
• 发表时间: 2021
• 期刊: Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies
• 作者: Cloete R

Reviewable Automated Decision-Making

• DOI: 10.1016/j.clsr.2020.105475
• 发表时间: 2020-11-01
• 期刊: COMPUTER LAW & SECURITY REVIEW
• 影响因子: 2.9
• 作者: Cobbe, Jennifer;Singh, Jatinder
• 通讯作者: Singh, Jatinder

Is Law Computable? - Critical Perspectives on Law and Artificial Intelligence

法律是可计算的吗？

• DOI: 10.5040/9781509937097.ch-001
• 发表时间: 2020
• 作者: Deakin S