Smart Lock Data Privacy & Compliance: GDPR, CCPA, HIPAA Complete Guide

Smart Lock Data Processing - Legal Basis Selection:

Employee Access Control:
├─ Personal identifiers (name, ID) → LEGITIMATE INTEREST (Art. 6(1)(f))
│   Rationale: Workplace security necessary and proportionate
│   Balancing test: Security need > minimal privacy intrusion
│   Required: Transparency notice, opt-out for unreasonable processing
│
├─ Access logs (entry/exit times) → CONTRACT (Art. 6(1)(b)) or LEGITIMATE INTEREST
│   Rationale: Monitoring working time (if contractual), or security (legitimate interest)
│   Consider: National labor law may impose limits
│
├─ Biometric data (fingerprints) → EXPLICIT CONSENT (Art. 9(2)(a))
│   Rationale: Special category requires explicit consent
│   Required: Separate consent form, alternatives available (PIN/card), withdrawable
│   Alternative: Art. 9(2)(b) if national law specifically authorizes
│
└─ Video surveillance → LEGITIMATE INTEREST (Art. 6(1)(f))
    Rationale: Security and asset protection
    Required: Prominent signage, limited retention, privacy impact assessment

Visitor Access:
├─ Name, email → CONSENT (Art. 6(1)(a)) or LEGITIMATE INTEREST
│   Best practice: Explicit consent via visitor form
│   Retention: 30 days (unless security incident)
│
└─ Visitor logs → LEGITIMATE INTEREST (security)
    Retention: 90 days maximum (data minimization)

Business Associate Agreement Template (Key Clauses):

1. Permitted Uses and Disclosures
   - BA may use/disclose PHI only as permitted by Agreement
   - May use PHI for proper management and administration of BA
   
2. Safeguards
   - BA shall implement appropriate safeguards per 164.308, 164.310, 164.312
   - Encryption required for PHI at rest and in transit
   
3. Reporting
   - Report any security incident within 24 hours (best practice)
   - Report breaches without unreasonable delay (required)
   
4. Subcontractors
   - BA shall ensure subcontractors agree to same restrictions (written agreement)
   
5. Access and Amendment
   - BA shall provide access to PHI within 30 days if requested by covered entity
   
6. Accounting of Disclosures
   - BA shall document disclosures and provide accounting if requested
   
7. Return or Destruction
   - Upon termination, BA shall return or destroy all PHI (if feasible)

BIPA Compliance Checklist:

□ Written biometric data retention policy (public on website)
□ Informed written consent before fingerprint enrollment:
  "I consent to [Company] collecting my fingerprint for the purpose of
   building access control. My fingerprint will be stored securely and
   deleted within 30 days of my employment termination or within 3 years
   of my last building entry, whichever occurs first."
□ Alternative access method available (PIN or RFID - no fingerprint required)
□ No sharing of biometric data with third parties
□ Automated deletion upon trigger event (termination + 30 days)
□ Annual audit of retention compliance

class DSARProcessor {
  constructor(database, auditLog, notificationService) {
    this.db = database;
    this.audit = auditLog;
    this.notify = notificationService;
  }
  
  // Art. 15: Right of Access
  async processAccessRequest(requestId) {
    const request = await this.db.getDSAR(requestId);
    const subject = request.dataSubject; // email or ID
    
    // Verify identity (authentication required)
    if (!request.identityVerified) {
      throw new Error('Identity verification required before processing');
    }
    
    // Collect all personal data
    const personalData = {
      identity: await this.db.getUserProfile(subject.email),
      accessLogs: await this.db.getAccessLogs(subject.id, {
        startDate: '2020-01-01', // Or first data point
        endDate: new Date()
      }),
      credentials: await this.db.getUserCredentials(subject.id),
      biometricEnrollment: await this.db.getBiometricData(subject.id),
      visitorRecords: await this.db.getVisitorRecords(subject.email),
      auditTrail: await this.audit.getUserActivity(subject.id),
      
      // Metadata (Art. 15(1)(a-h))
      processingPurposes: this.getProcessingPurposes(),
      dataCategories: this.getDataCategories(),
      recipients: this.getRecipients(),
      retentionPeriods: this.getRetentionPeriods(),
      dataSubjectRights: this.getRightsInformation(),
      dataSource: 'Directly from data subject',
      automatedDecisionMaking: 'None'
    };
    
    // Generate human-readable report (PDF + JSON)
    const report = await this.generateAccessReport(personalData);
    
    // Log for accountability (Art. 5(2))
    await this.audit.log({
      action: 'DATA_ACCESS_REQUEST_FULFILLED',
      dataSubject: subject.id,
      requestId: requestId,
      timestamp: new Date(),
      dataProvided: Object.keys(personalData)
    });
    
    // Deliver via secure channel (encrypted email or portal)
    await this.notify.sendSecurely(subject.email, {
      subject: 'Your Personal Data Access Request',
      body: 'Please find attached your personal data as requested.',
      attachments: [report.pdf, report.json]
    });
    
    // Update request status
    await this.db.updateDSAR(requestId, {
      status: 'COMPLETED',
      completedAt: new Date(),
      deliveryMethod: 'ENCRYPTED_EMAIL'
    });
    
    return { success: true, requestId };
  }
  
  // Art. 17: Right to Erasure ("Right to be Forgotten")
  async processErasureRequest(requestId) {
    const request = await this.db.getDSAR(requestId);
    const subject = request.dataSubject;
    
    // Verify identity
    if (!request.identityVerified) {
      throw new Error('Identity verification required');
    }
    
    // Check for legal retention obligations (Art. 17(3) exceptions)
    const retentionCheck = await this.checkRetentionObligations(subject.id);
    
    if (retentionCheck.mustRetain) {
      // Cannot delete due to legal obligation (e.g., accounting, litigation)
      await this.notify.send(subject.email, {
        subject: 'Erasure Request - Partial Fulfillment',
        body: `We must retain certain data due to legal obligations:
               - ${retentionCheck.reasons.join('\n- ')}
               
               All other data has been deleted as requested.`
      });
      
      // Delete what we can
      await this.deleteNonObligatedData(subject.id);
      
    } else {
      // Full deletion
      await this.deleteAllPersonalData(subject.id);
      
      await this.notify.send(subject.email, {
        subject: 'Erasure Request Completed',
        body: 'All your personal data has been permanently deleted.'
      });
    }
    
    // Audit log (keep minimal record for accountability - anonymized)
    await this.audit.log({
      action: 'DATA_ERASURE_REQUEST_FULFILLED',
      dataSubjectId: `DELETED-${requestId}`, // Don't store actual ID
      requestId: requestId,
      timestamp: new Date(),
      fullDeletion: !retentionCheck.mustRetain
    });
    
    await this.db.updateDSAR(requestId, {
      status: 'COMPLETED',
      completedAt: new Date()
    });
    
    return { success: true, requestId };
  }
  
  async deleteAllPersonalData(userId) {
    // Delete in specific order (maintain referential integrity)
    await this.db.deleteBiometricTemplates(userId);
    await this.db.deleteAccessLogs(userId);
    await this.db.deleteCredentials(userId);
    await this.db.deleteUserProfile(userId);
    await this.db.deleteVisitorRecords(userId);
    
    // Notify dependent systems
    await this.notify.systemEvent('USER_DATA_DELETED', { userId });
  }
  
  async checkRetentionObligations(userId) {
    const obligations = [];
    
    // Check employment records (may need 2-7 years retention)
    const employment = await this.db.getEmploymentStatus(userId);
    if (employment && employment.terminationDate) {
      const daysSinceTermination = dateDiff(employment.terminationDate, new Date());
      if (daysSinceTermination < 730) { // 2 years
        obligations.push('Employment records retention (2 years post-termination)');
      }
    }
    
    // Check accounting/tax records (typically 7 years)
    const financialRecords = await this.db.hasFinancialRecords(userId);
    if (financialRecords) {
      obligations.push('Accounting records retention (7 years)');
    }
    
    // Check active legal proceedings
    const litigation = await this.db.hasActiveLitigation(userId);
    if (litigation) {
      obligations.push('Legal hold - active litigation');
    }
    
    return {
      mustRetain: obligations.length > 0,
      reasons: obligations
    };
  }
  
  // Art. 20: Right to Data Portability
  async processPortabilityRequest(requestId) {
    const request = await this.db.getDSAR(requestId);
    const subject = request.dataSubject;
    
    // Collect data in structured, machine-readable format (JSON)
    const portableData = {
      version: '1.0',
      exportDate: new Date().toISOString(),
      dataSubject: {
        name: subject.name,
        email: subject.email
      },
      accessHistory: await this.db.getAccessLogs(subject.id),
      credentials: await this.db.getUserCredentials(subject.id, { excludeSensitive: true }),
      // Note: Biometric templates typically not portable (vendor-specific format)
    };
    
    // Generate JSON + CSV for compatibility
    const exports = {
      json: JSON.stringify(portableData, null, 2),
      csv: await this.convertToCSV(portableData.accessHistory)
    };
    
    await this.notify.sendSecurely(subject.email, {
      subject: 'Your Portable Data',
      body: 'Find attached your data in machine-readable formats.',
      attachments: [
        { filename: 'my_data.json', content: exports.json },
        { filename: 'access_history.csv', content: exports.csv }
      ]
    });
    
    return { success: true, requestId };
  }
}

// Usage
const dsarProcessor = new DSARProcessor(database, auditLog, notificationService);

// Process DSAR (triggered by user portal or email)
await dsarProcessor.processAccessRequest('DSAR-2024-001');
await dsarProcessor.processErasureRequest('DSAR-2024-002');
await dsarProcessor.processPortabilityRequest('DSAR-2024-003');

├─ Incident detected via:
│   ├─ Security monitoring alert
│   ├─ User report
│   ├─ Vendor notification
│   └─ Audit log review
│
├─ IMMEDIATE ACTIONS (Hour 0-4):
│   ├─ Contain breach (disable affected systems)
│   ├─ Preserve evidence (forensic imaging)
│   ├─ Notify DPO/Legal/CISO
│   └─ Begin breach assessment
│
├─ ASSESSMENT (Hour 4-24):
│   ├─ Determine scope: How many data subjects affected?
│   ├─ Determine data types: What personal data exposed?
│   ├─ Assess risk: Likely impact on individuals?
│   ├─ Evaluate safeguards: Was data encrypted?
│   └─ Document findings
│
├─ SUPERVISORY AUTHORITY NOTIFICATION (Hour 24-72):
│   └─ Required if "likely to result in risk" to rights/freedoms
│       ├─ Submit via authority portal (e.g., ICO UK, CNIL France)
│       ├─ Include: Nature, categories, approximate numbers
│       ├─ Include: DPO contact, likely consequences, remediation
│       └─ Deadline: 72 hours from discovery
│
└─ DATA SUBJECT NOTIFICATION (If high risk):
    └─ Required "without undue delay" if high risk
        ├─ Clear, plain language notification
        ├─ Describe breach, likely consequences, remediation
        ├─ Provide DPO contact for questions
        └─ Methods: Email (primary), mail (if no email), website notice

├─ Trigger: Unauthorized acquisition of unencrypted PI
├─ Timeline: "Without unreasonable delay"
├─ Threshold: No minimum number (any breach triggers notification)
├─ Attorney General: Notify if >500 residents affected
└─ Content: Type of breach, data compromised, actions taken, contact info

New York (N.Y. Gen. Bus. Law §899-aa):
├─ Trigger: Unauthorized access to computerized data
├─ Timeline: "Most expedient time" + no more than "reasonable delay"
├─ Threshold: No minimum
├─ Attorney General + Consumer Reporting Agencies: If >500 residents
└─ Free credit monitoring: Must offer if SSN compromised

Illinois (BIPA - 740 ILCS 14/):
├─ Trigger: Breach of biometric data
├─ Timeline: "Without unreasonable delay"
├─ Threshold: No minimum
├─ Attorney General: Notify
└─ Private Right of Action: Individuals can sue directly
    └─ Damages: $1,000-5,000 per violation

1. Was PHI acquired, accessed, used, or disclosed?
   └─ Example: Hospital access logs showing patient employee names + timestamps

2. Does exception apply?
   ├─ Unintentional acquisition by authorized person? (Limited exception)
   ├─ Inadvertent disclosure within facility? (Limited exception)
   └─ Good faith belief recipient couldn't retain? (Limited exception)

3. Risk Assessment (4 Factors):
   ├─ Nature/extent of PHI (dates, names, SSN, diagnosis?)
   ├─ Unauthorized person who used/received (hacker vs mistaken email?)
   ├─ Was PHI actually acquired/viewed? (or just accessible?)
   └─ Extent of risk mitigation (data encrypted? deletion confirmed?)

4. Notification Requirements:
   
   Individual Notification (164.404):
   ├─ Timeline: 60 days from discovery
   ├─ Method: First-class mail (or email if opted in)
   ├─ Content: Brief description, types of PHI, steps individuals should take,
   │           what entity is doing, contact info
   └─ Substitute Notice: If contact info insufficient for >10 individuals
       └─ Website + major media (if >500 residents in state)
   
   HHS Secretary Notification (164.408):
   ├─ If ≥500 individuals: Within 60 days + contemporaneous with individuals
   ├─ If <500 individuals: Annually (within 60 days of year end)
   └─ Submit via HHS Breach Portal ("Wall of Shame")
   
   Media Notification (164.406):
   ├─ Trigger: Breach affecting ≥500 residents in state/jurisdiction
   ├─ Timeline: Without unreasonable delay (same as individual notification)
   └─ Media: Prominent media outlets in affected area

5. Documentation (164.414):
   └─ Maintain for 6 years: Risk assessment, notifications sent, complaints

Before Deployment:
├─ Minimize data collection (timestamp only vs timestamp+location+device ID)
├─ Evaluate necessity of each data field
├─ Default settings: Privacy-maximizing (e.g., auto-delete logs after 90 days)
└─ Threat model privacy risks before security incident occurs

Example: Facial Recognition Decision
├─ Question: Do we need facial recognition for access control?
├─ Privacy Impact: High (biometric data, special category, BIPA/GDPR)
├─ Alternative: Badge-only access (lower privacy impact)
└─ Decision: Use facial recognition ONLY if no alternative meets security needs

OUT OF BOX:
├─ Data retention: 90 days (vs unlimited)
├─ Location tracking: Disabled (vs enabled)
├─ Cloud sync: Opt-in (vs automatic)
├─ Analytics: Anonymized only (vs identified)
└─ Third-party sharing: Disabled (vs enabled)

User Action Required to REDUCE Privacy:
└─ Not: User must enable privacy protections
    But: User must disable privacy protections if desired

Access Control System Design:
├─ Edge Processing: Biometric matching on device (not cloud)
│   └─ Benefit: Template never leaves lock → no cloud exposure
│
├─ Encryption Everywhere:
│   ├─ Data at rest: AES-256 (access logs, credentials)
│   ├─ Data in transit: TLS 1.3 (lock ↔ hub ↔ cloud)
│   └─ Data in use: Encrypted RAM for biometric processing
│
├─ Access Segmentation:
│   ├─ HR can see: Employee names, door assignments
│   ├─ HR cannot see: Entry/exit timestamps (unless specific request)
│   └─ Security can see: Timestamps, door IDs (not employee names unless investigating)
│
└─ Audit Immutability:
    └─ Cryptographic chaining prevents retroactive log alteration

Example: Offline Capable Locks
├─ Security Benefit: Works during internet outage
├─ Privacy Benefit: No cloud dependency for basic operation
└─ Functionality: Full access control without degradation

Example: Local-First Architecture
├─ Performance: Faster unlock (<500ms vs 2-3 seconds cloud)
├─ Privacy: Data stays on-premise
└─ Availability: 99.99% uptime (not dependent on cloud)

Collection → Storage → Use → Sharing → Archival → Deletion

1. Collection:
   └─ Only collect data with lawful basis (document per Art. 6)

2. Storage:
   └─ Encrypted at rest, access controls, geographic restrictions

3. Use:
   └─ Purpose limitation (don't use access logs for employee performance reviews)

4. Sharing:
   └─ Processor agreements (DPA), encryption in transit, audit logging

5. Archival:
   └─ Long-term retention only if legal obligation (e.g., 7-year accounting)

6. Deletion:
   └─ Secure deletion (crypto-shredding, multi-pass wipe, certificate destruction)

Privacy Portal (User Self-Service):
├─ View My Data: See all access logs, credentials, settings
├─ Download My Data: Export JSON/CSV (Art. 20 portability)
├─ Delete My Data: Submit erasure request (Art. 17)
├─ Privacy Settings: Manage consents, notifications
└─ Audit Trail: See who accessed my data and when

Privacy Notice (Layered Approach):
├─ Short Notice: 1-page summary (what, why, who, how long, rights)
├─ Full Notice: Detailed privacy policy (legal basis, recipients, retention)
└─ Just-in-Time Notices: Contextual explanations (e.g., "We use your fingerprint for access. Learn more...")

Consent Management:
├─ Granular Consent: Separate opt-ins for analytics, marketing, third-parties
├─ Easy Withdrawal: One-click "revoke all consents"
├─ No Consent Bundling: Don't require marketing consent for service access
└─ Records: Log consent grants/withdrawals with timestamps

Data Minimization Choices:
├─ Offer privacy modes: "Standard" vs "High Privacy" (minimal logging)
├─ Let users choose retention: 30 days, 90 days, 1 year
└─ Anonymous mode: Use service without creating account (where feasible)

1. Data Processing Agreement (DPA)
   ├─ Does vendor offer GDPR-compliant DPA? (Mandatory)
   ├─ CCPA Service Provider Agreement? (Mandatory if CA users)
   ├─ HIPAA BAA if healthcare? (Mandatory for HIPAA)
   └─ Sub-processors disclosed + approval rights? (Check carefully)

2. Data Residency & Transfers
   ├─ Where is data stored? (EU, US, Asia?)
   ├─ International transfers: What mechanism? (SCCs, DPF, BCR?)
   ├─ Can you restrict data to specific regions? (EU-only, US-only?)
   └─ Government access: Under what legal framework? (CLOUD Act, GDPR Art. 48)

3. Security & Certifications
   ├─ ISO 27001 certified? (Gold standard)
   ├─ SOC 2 Type II report available? (Review annually)
   ├─ GDPR compliance certification? (e.g., ISO 27701)
   └─ Third-party penetration testing? (At least annually)

4. Data Subject Rights Support
   ├─ How do they facilitate DSARs? (API, portal, manual?)
   ├─ Typical DSAR response time? (Must enable your 30-day deadline)
   ├─ Do they support data portability? (Export formats)
   └─ Secure deletion process? (Certificate of destruction)

5. Breach Notification
   ├─ SLA for breach notification to you? (<24 hours ideal)
   ├─ Do they notify regulators directly? (Should be your responsibility)
   ├─ Incident response plan shared? (Review for adequacy)
   └─ Insurance coverage? (Cyber liability for breaches)

6. Data Retention & Deletion
   ├─ Automatic deletion after termination? (Within 30-90 days)
   ├─ Can you trigger deletion on demand? (Via API or request)
   ├─ Backup retention: How long? (Clarify for compliance)
   └─ Backup deletion process? (Ensure backups also deleted)

7. Audit Rights
   ├─ Do you have right to audit? (Art. 28(3)(h) GDPR)
   ├─ SOC 2 reports available? (At least annually)
   ├─ Can you review their sub-processors? (Transparency)
   └─ Onsite audits permitted? (May be negotiable for enterprise)

When Needed:
└─ Transferring personal data from EEA → Non-adequate country (e.g., US, China)

Module Selection:
├─ Module 2: Controller to Processor (Most common for cloud services)
├─ Module 3: Processor to Sub-processor (If vendor uses sub-processors)
└─ Module 4: Processor to Controller (Rare for access control)

Transfer Impact Assessment (TIA):
├─ Required per Schrems II CJEU ruling
├─ Assess: Laws in destination country (surveillance, access)
├─ Assess: Technical measures (encryption, pseudonymization)
├─ Document: Why transfer is necessary + safeguards adequate
└─ Review: Annually or when laws/circumstances change

Supplementary Measures (Schrems II Recommendations):
├─ Encryption in transit (TLS 1.3)
├─ Encryption at rest with customer-managed keys (vendor can't decrypt)
├─ Pseudonymization before transfer (if feasible)
└─ End-to-end encryption (ideal but rare for access control logs)