Purpose and Function Creep by Design: Transforming the Face of Surveillance through the Internet of Things

Abstract

Since 2006 the European Commission expresses the ambition to transform our current Internet from a network of computers to a network of things and to increasingly merge the physical and the digital world. This new Internet will be an Internet of Things, a network that autonomously sets flows of data in motion without direct human involvement. Another thing that the IoT allows is the control over devices from a distance. Neelie Kroes said that the Internet of Things "is surrounded by a value system: as it comes so close to the heart of everyday life, social relations and daily services, it needs a broad societal consensus to fulfill its potential." The processing of data regarding these highly intimate aspects of citizens their lives could have an enormous impact on their privacy. The potential of the IoT to fuel a surveillance society through purpose - and function creep is a subject that has a less prominent place in the mainstream discourse of the European Commission.

This paper addresses the question whether the policy of the EU with regard to the IoT does not amount to a purpose- and function creep by design that conflicts with the right to privacy as protected by Article 8 of the European Convention on Human Rights. The first part of this paper explains how EU funding contributes to realizing the IoT vision and uses examples to reveal how this relates to surveillance activities. The second part is used to explain how IoT-devices enable authorities to exercise control from a distance and to construct my hypothesis that EU policy on IoT guides a process aimed at the capturing of people their everyday behavior. The Commissions approach to data protection in the IoT is highlighted and critically assessed. IoT-devices will autonomously set flows of data in motion which are transmitted over (publicly) available electronic communication networks which results in a large amount of data that could fuel the future surveillance assemblage of Europe. Furthermore I argue why the IoT will have a transformative effect on the face of surveillance.

Keywords: Internet of Things, privacy, data protection, surveillance, EU policy, technology, data retention, human rights.