When is Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA) necessary and mandatory according to the General Data Protection Regulation (GDPR)? So far there has been a lot of ambiguity surrounding the issue. I previously wrote about the DPIA guidelines (and its challenges) suggested by the Privacy Commission Read More
ePrivacy is one of the most crucial European privacy and data protection regulations. I already wrote about ePrivacy, analysing its leaked and the later official draft versions. The ePrivacy regulation is important because it touches a number of influential aspects such as: electronic communication, web technologies, and web browsers. To Read More
Designing standards with privacy in mind should be a standard in itself. Historically this was not always the case and the idea of designing systems with privacy is relatively new - it dates from the beginning of this decade. One of the milestones is accepting this view on the IETF Read More
One of the most important cultural change companies and organisations are beginning to face is the need of systematic inclusion of privacy and data protection in technical and organisational frameworks. A crucial aspect of these changes is the need of conducting Privacy Impact Assessments (PIA) and Data Protection Impact Assessments Read More
European Commission has revealed their proposal for updating of ePrivacy directive. I have previously analysed a version of ePrivacy document leaked in December. The new regulation still provides strong guarantees of integrity and confidentiality of communication (concerning also Instant messengers such as Facebook Messenger, WhatsApp, Google Hangout, etc.). That’s Read More
Understanding and perceiving privacy as a technological and strategic aspect is becoming a standard practice. The recently published NIST Internal Report “An Introduction to Privacy Engineering and Risk Management” is an interesting attempt to systematize the understanding of privacy engineering. Privacy in this view forms an important technical and strategic Read More
I'm interested in battery status security/privacy potential for a while now. I have previously written about it here and recently my research led to web browser vendors removing battery readout functionality, citing privacy issues (Firefox, WebKit; Chrome has not decided yet). I'm also very happy Read More
It's 2016 and we are experiencing something unprecedented in the history of the Web. Apparently, Web browsers (Firefox, Safari?) are removing parts of their functionality citing privacy concerns. This is a fascinating development. Introduction I am analysing security and privacy of modern Web for more than 8 years Read More
Web Bluetooth - a web API under development, and will be one of the core components of Web of Things, the application layer of Internet of Things. It will enable sensors, beacons and user devices to communicate with each other. But at first: it will enable a web browser to Read More
Ambient Light Sensor is one of the more interesting data sources from privacy point of view. I recently highlighted a number of potential privacy issues in my analysis. I described how the ability to access and track the changes of lighting conditions in the user's environment might contribute Read More
The debate around surveillance around the world is a developing story. Multiple states are considering, working on or applying new investigative powers (e.g. United Kingdom’s Investigatory Powers Bill or France’s Patriot Act à la française) strengthening surveillance capabilities; this trend is visible around the world. Investigatory powers Read More
Introduction Smartphones are equipped with a sensor letting the device to detect the brightness levels in their environment (modern sensors are even capable to measure the intensity of green, red and blue lights). The simplest application of the sensor is to adjust the screen's brightness in accordance with Read More
Introduction Privacy risks and threats arise and surface even in seemingly innocuous mechanisms. We have seen it before, and we will see it again. Recently, I participated in a study assessing the risk of W3C Battery Status API. The mechanism allows a web site to read the battery level of Read More
Vibrating devices are a familiar thing. From the era of flip-phones, to vibrations induced by mobile apps. Or websites. [Edit 15/11/19: Firefox is limiting access to Vibration API] Vibration API The mechanism allowing websites to utilize device's vibration motor is called Vibration API. The mechanism allows Read More
It was never my intention to have a "blog". Then, as I have found myself increasingly interested in, and doing more and more things, I indentified a need to have a place for writing. It is not a good idea to put my thoughts on my site; I Read More