Towards a legally-compliant Internet of Things

该项目旨在为使物联网(IoT)与法律和监管现实保持一致这一重要但基本上未被探索的挑战制定新的方向。物联网的广阔愿景是物理世界联网的地方。它需要传感器和执行器与虚拟服务无缝集成，作为大规模、潜在的全球系统基础设施的一部分，该基础设施可以动态地做出反应和响应，以满足各种目标。这一愿景抓住了主流的想象力。互联基础设施是一个大规模的分布式系统，可以实现潜在的无限范围的应用，这些应用可以为个人、团体和组织定制，涉及城市、零售、能源、健康和生活方式、交通和农业等领域。然而，随着这一愿景而来的是法律、监管和社会挑战。这种新兴系统环境的规模和物理性质涉及传感器生成关于世界许多详细方面的数据，其中许多(潜在地)高度个人或其他敏感，其中驱动能力给系统带来真实的物理世界效果。因此，物联网(以及更广泛地说，信息和通信技术)应用、系统和服务越来越受到法律的约束，监管机构也越来越容易看到，而消费者、企业和政府开始要求更多的透明度和代理权。拥有管理物联网相关风险、责任和义务的手段，对于实现其潜力以及带来的重大经济和社会效益至关重要。该项目直接针对这些问题，对符合法律规定的分布式系统采取跨学科(技术-法律)方法。其目的是制定概念框架，以审议遵守技术法律的问题，以及使系统(因此，责任人)能够遵守法律和监管义务的技术手段。通过促进合规性，我们致力于改善物联网中的代理、信任和责任，并减少合规性管理费用。由于物联网是数据驱动的，因此具体重点是数据流管理。我们寻求改善数据在整个物联网中移动时的“控制”和“可见性”，这符合数据管理政策，反映了法律义务。这是为了使对数据拥有权利的人(包括最终用户)和对数据负责的人(包括服务提供商)能够确保他们的要求和义务得到满足，即使数据“离开了他们的手”。这需要调查反映责任和义务以及个人偏好的法律和条例如何体现在政策中，由哪些技术机制在全系统范围内端到端地执行。这包括审计政策的执行情况，以帮助证明合规性、分摊责任和表明政策是否充分地抓住了法律责任。这还需要制定法律-技术框架，为调查、列举和协调各学科的合规问题提供方法论，并查明法律与技术之间的不匹配。该项目体现了一种技术/法律共生：关于全系统控制和审计的技术机制的工作将受到法律和监管现实的推动，同时，我们考虑技术工作如何影响物联网的有形和日益普遍和侵入性的性质所产生的新的责任和政策关切。通过开展这项工作，我们寻求为有关合法合规系统的更广泛的多学科研究领域奠定基础。

This project is to forge new directions towards the important, but largely unexplored challenge of aligning the Internet of Things (IoT) with legal and regulatory realities. The broad vision of the IoT is where the physical world comes online. It entails sensors and actuators seamlessly integrated with virtual services, as part of a wide-scale, potentially global systems infrastructure that dynamically reacts and responds to meet various goals. This vision has captured mainstream imagination. The connected infrastructure, a large-scale distributed system, enables a potentially limitless range of applications, which can be customised to individuals, groups and organisations, in areas including cities, retail, energy, health and lifestyle, transport and agriculture. However, with this vision comes legal, regulatory and social challenges. The scale and physical nature of this emerging systems environment involves sensors generating data on many detailed aspects of the world, much of it (potentially) highly personal or otherwise sensitive, and where actuation capabilities give systems a real, physical-world effect. As such, IoT (and more generally, ICT) applications, systems and services are increasingly subject to law and visible to regulators, while consumers, businesses and governments are beginning to demand more transparency and agency. Having the means for managing the associated risks, responsibilities, and obligations of the IoT is crucial for realising its potential, and the significant economic and social benefits it promises.This project directly targets these issues, by taking an interdisciplinary (tech-legal) approach towards legally-compliant distributed systems. The aim is to develop the conceptual frameworks for considering tech-legal compliance issues as well as the technical means for enabling systems (and therefore, those responsible) to comply with legal and regulatory obligations. By facilitating compliance, we work to improve agency, trust and accountability in the IoT, as well as reducing the overheads of compliance.As the IoT is data driven, the specific focus is on data flow management. We seek to improve the *control* and *visibility* of data as it moves throughout the IoT, in line with data management policy, reflecting legal obligations. This is so that those who have rights over data (including end-users), and those responsible for data (including service providers), are able to ensure their requirements and obligations are met, even as data moves `out of their hands'. This entails investigating how law and regulation, reflecting responsibilities and obligations, and personal preferences, can be embodied in policy, which technical mechanisms enforce end-to-end, system-wide. This includes auditing policy enforcement, to assist in demonstrating compliance, apportioning liability and indicating whether policy adequately captures legal responsibilities. This also entails the development of legal-technical frameworks that provide the methodology for investigating, enumerating and aligning compliance concerns across the disciplines, and identifying the mismatches between law and technology.Addressing such challenges requires an interdisciplinary approach. This project embodies a technical/legal symbiosis: work on the technical mechanisms for system-wide control and audit will be driven by legal and regulatory realities, and at the same time, we consider how the technical work impacts the emerging liability and policy concerns arising from the physical and increasingly pervasive and intrusive nature of the IoT. In undertaking this work, we seek to build the foundations for a broader area of multidisciplinary research concerning legally compliant systems.