Implementing Data Protection and Information Security in AAL

Abstract

Ambient Assisted Living (AAL) tries to keep up user’s independence by means of applying technology, i.e., it collects, aggregates, and analyzes data recorded by a plethora of different sensors and controls actuators of a comparable variety. Setup and functionalities are various and can involve third parties as well as communication with service providers. Thereby, the category of data within the AAL system might require compliance to legislative regulations, e.g., if personal (identifiable) information is handled. Within this paper we provide an overview of the potential legal basis and requirements which are often applicable within the context of AAL systems, a.o., the Data Protection Directive 95/46/EC and its transformations into national legislations, respectively, and describe the conditions for a legitimate data processing in terms of informed user consent. Furthermore we describe a structured approach for AAL system analysis, which is based on BSI standards which supports in identifying the necessary information security measures in accordance to data protection requirements.