Control Strategy ImpersonalThing

Th.E.IoT-Hu.9

Internet of Things device Thing is not related to any human: IoT devices contain embedded data which may be personal data, in which case they must have a 'relatesTo' link to the Human data subject. Device Thing does not have such a link. If the data used by Thing is personal data, then you should add the data subject to the model if they are not yet included (even if they are not users of the system) and add the relationship indicating that Thing relates to that subject. If Thing is non-personal, then select the control strategy to signal to SSM that the absence of such a link is not an error.