Internet of Things is making everything smart through a network of items with sensors connected to the Internet (Minn et al., 2015). Smart devices are those items that connect to other devices or networks using wireless connectivity such as Wi-Fi, 5G (IGI Global, 2021). Smartphones, smart locks and smartwatches are examples of smart devices. According to the UK Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), personal data is any information that relates to an identified or identifiable individual such as name, email, NI number, location data (ICO, n.d.). Both the DPA and GDPR mandate that the design process for new products and services consider data protection and privacy risks within it. We argue that the state-of-the-art for storing personal data in the home and setting user preferences in smart devices requires research.  

Our research will (i) provide design and governance guidelines in a non-legalistic language for the manufacturers and service providers of smart devices to consider in the design process for new products and services. (ii) Consequently through standardisation, they will yield competitive advantage, and reduce their compliance, and data processing burden. (iii) Further, our research will bridge the gap between the manufacturers, service providers, privacy professionals and regulators concerning the data protection and privacy risks leading to privacy issues in smart devices. 

Our eventual goal is to translate the design and governance guidelines to a policy.

Why is it important? Smart device users lack understanding of data privacy (Marwick & Boyd, 2014) and control over how their personal data is shared and processed (Broenink et al., 2010). Our proposed research will (a) enable and empower the users of smart devices to make informed choices about how much and who they share their data with and therefore have control over their personal data. (b) So the users can enjoy the tailored services of smart devices, to improve convenience and not worry about their data privacy. 

We will do this through co-creation of design and governance guidelines. A technical standpoint of our starting position is to assume a solution that brings data processing and storage closer to where it is generated, akin to Databox (McAuley et al., 2016). The guidelines for the solution will cover the architecture, user interface and interactions, so users can model their privacy settings and preferences without difficulty. It will also cover cybersecurity areas such as user authentication and data security.