Privacy
Privacy
XR-apparaten zijn ten behoeve van hun functioneren uitgerust met een (groot) aantal sensoren die gegevens over locatie, omgeving en beweging kunnen vastleggen. Ook is het mogelijk dat XR-apparaten gezondheids- en biometrische gegevens vastleggen (oogbewegingen, pupilreflexen, hartslag, ademhaling et cetera). Tenslotte kunnen bij specifieke toepassingen diverse data worden verzameld over het gebruik van de toepassing en de gebruiker zelf.
De IX-professional dient zich bewust te zijn van de privacygevoeligheid van deze gegevens en er op een zorgvuldige en rechtmatige wijze mee om te springen. Dit betreft zowel data die de aanbieder zelf verzamelt, data die door fabrikanten/aanbieders van XR-platformen worden verzameld, als data van omstanders die via sensoren worden vastgelegd.
Voor de rechtmatige verwerking van persoonsgegevens vormt de Algemene Verordening Gegevensbescherming (AVG) het belangrijkste kader. De toepassing moet rechtmatig en transparant zijn, gegevens worden niet voor andere doeleinden gebruikt (doelbinding), enkel noodzakelijke gegevens worden verwerkt (dataminimalisatie), de gegevens worden niet langer bewaard dan noodzakelijk (opslagbeperking), en worden goed beveiligd.
Door het volgen van deze richtlijn committeert de IX-professional zich aan de vereisten van de AVG voor wat betreft de eigen invloedssfeer.
To function properly, XR devices are equipped with a (large) number of sensors that can record data about location, environment and movement. XR devices may also record health and biometric data (eye movements, pupillary reflexes, heart rate, breathing, etc.). And finally, for specific applications, various data can be collected regarding the use of the application and the user themselves (such as account details and preferences).
The IX professional should be aware of the privacy-sensitivity of this data and handle it in a careful and lawful manner. More specifically, this concerns the following privacy-sensitive aspects:
- First, the data of users that the provider themselves collects to allow the application to function properly.
- Second, user data collected by the manufacturers/providers of the XR (hardware) platforms that the application uses. On the one hand, data collection is necessary for the product to function; but on the other, it is an essential part of the revenue model for some hardware providers.
- Third, data collected via sensors on devices from bystanders without their permission. For the sake of bystander privacy, it is important to exercise restraint when collecting data.
The General Data Protection Regulation (GDPR) is the most important framework for the lawful processing of personal data. The GDPR sets the following requirements for the processing of personal data within IX applications:
- The application is lawful (has a clear purpose with a legal basis).
- The application is transparent (people concerned are informed).
- The data is not used for other purposes (purpose limitation).
- Only necessary data is processed (data minimisation).
- The data is not stored longer than necessary (storage limitation).
- The data is well secured.
The IX professional should first ensure their own processing operations within IX meet these requirements. Not only in terms of the privacy of the application’s users but also that of bystanders.
In order to reduce the privacy risk around data collection by providers and manufacturers of IX hardware and platforms, it is important that IX professionals do all they can within their sphere of influence to limit data acquisition and storage. This can be done, for example, by minimizing data collection, using locally hosted servers and anonymizing personal data.
The choice of specific hardware can also make a difference here. For example, by comparing the privacy conditions (and options for setting them) of different providers. If hardware and/or software from third parties is used, there must be clear agreements about the data processing, for example by means of a (processing) agreement.
Finally, it is important that the IX user is informed in simple and clear language about which data will be collected and for what purposes, where and for how long the data is stored, and which parties have access to it. If this information is (partially) unknown, the user must also be informed of this fact.
By following these guidelines, the IX professional commits themselves to the requirements of the GDPR with regard to their own sphere of influence.