This paper explores the importance of accountability to data protection, and how it can be built into the Internet of Things (IoT). The need to build accountability into the IoT is motivated by the opaque nature of distributed data flows, inadequate consent mechanisms, and lack of interfaces enabling end-user control over the behaviours of internet-enabled devices. The lack of accountability precludes meaningful engagement by end-users with their personal data and poses a key challenge to creating user trust in the IoT and the reciprocal development of the digital economy. The EU General Data Protection Regulation 2016 (GDPR) seeks to remedy this particular problem by mandating that a rapidly developing technological ecosystem be made accountable. In doing so it foregrounds new responsibilities for data controllers, including data protection by design and default, and new data subject rights such as the right to data portability. While GDPR is technologically neutral, it is nevertheless anticipated that realising the vision will turn upon effective technological development. Accordingly, this paper examines the notion of accountability, how it has been translated into systems design recommendations for the IoT, and how the IoT Databox puts key data protection principles into practice.

中文翻译：

---

证明在物联网中负责

本文探讨了责任制对数据保护的重要性，以及如何将其构建到物联网（IoT）中。分布式数据流的不透明特性，不充分的同意机制以及缺乏使最终用户能够控制启用Internet的设备的行为的接口，促使了将问责制纳入IoT的动机。缺乏问责制使最终用户无法有效参与其个人数据，并且对在IoT和数字经济的互惠发展中建立用户信任度提出了关键挑战。欧盟《 2016年通用数据保护条例》（GDPR）旨在通过强制要求快速发展的技术生态系统承担责任来纠正这一特殊问题。这样做可以使数据控制器承担新的责任，包括通过设计和默认设置进行的数据保护，以及新的数据主体权利，例如数据可移植性。尽管GDPR在技术上是中立的，但可以预见的是，实现愿景将取决于有效的技术发展。因此，本文研究了问责制的概念，如何将其转化为针对IoT的系统设计建议以及IoT Databox如何将关键数据保护原则付诸实践。