Privacy in the next generation Internet:
Data Protection in the context of the European Union Policy

With the growth in social, political and economic importance of the Internet, it has been recognized that the underlying technology of the next generation Internet must not only meet the many technical challenges but must also meet the social expectations of such a pervasive technology.

As evidence of the strategic importance of the development of the Internet, the European Union has adopted a communication to the Council and the European Parliament focusing on the next generation Internet and the priorities for action in migrating to the new Internet protocol IPv6 and also a new Directive (2002/58/EC) on 'processing of personal data and protection of privacy in the electronic communication sector'. The Data Protection Directive is part of a package of proposals for initiatives which will form the future regulatory framework for electronic communications networks and services. The new Directive aims to adapt and update the existing Data Protection Telecommunications Directive (97/66/EC) to take account of technological developments. However, it is not well undersood how this policy and the underlying Internet technology can be brought into alignment.

This dissertation builds upon the results of my earlier licentiate thesis by identifying three specific, timely, and important privacy areas in the next generation Internet: unique identifiers and observability, privacy enhanced location based services, and legal aspects of data traffic.

Each of the three areas identified are explored in the eight published papers that form this dissertation. The papers present recommendations to technical standarization bodies and regulators concerning the next generation Internet so that this technology and its deployment can meet the specific legal obligations of the new European Union data protection directive.

In summary, the eight papers of this dissertation show:

• how eavesdroppers will be able to identify and track packets that belong to a particular node and the limitations of the privacy extension for stateless address autoconfiguration which in fact fails to provide privacy.
• a network architecture that provide unlinkability between a user's personal identifiable information and location information.
• a critical review of the policy initiatives to extend traditional powers of lawful access to communications traffic data and the European Union Data Protection Telecommunications Directive.

The dissertation concludes by presenting future work identified based on examining these three different areas.

1. A. Escudero, M. Hedenfalk, and P. Heselius, Location Privacy in Mobile Internet - An extension to Freedom Network. Internet Society Conference (INET2001). Stockholm, Sweden. June 2001.
   Paper #1
2. A. Escudero, Location Privacy in IPv6: 'Tracking binding updates'. Tutorial at Interactive Distributed Multimedia Systems (IDMS2001). Lancaster, UK. September 2001.
   Paper #2
3. A. Escudero, Requirements for unobservability of privacy extension in IPv6. Radio Vetenskap 2002. Stockholm, Sweden. June 2002, pp. 58.
   Paper #3
4. A. Escudero, Privacy enhanced architecture for location based services in the next generation wireless networks. 11th IEEE Workshop on Local and Metropolitan Area Networks (LANMAN2002). Stockholm, Sweden. August 2002, pp. 169-172.
   Paper #4
5. A. Escudero and G.Q. Maguire Jr., Role(s) of a proxy in location based services. 13th IEEE International Symposium on Personal, Indoor and Mobile Radio Communications. (PIMRC2002). Lisbon. Portugal. September 2002, Vol.3 pp. 1252-1257.
   Paper #5
6. A. Escudero and I. Hosein, The hazards of technology-neutral policy: questioning lawful access to traffic data. To appear in Communications of the Association for Computer Machinery (CACM) Journal. Accepted on the 5th September 2002 - Reviewed 19th October 2002.
   Paper #6
7. A. Escudero, Privacy in mobile Internet in the context of the European Union data protection policy. Internet Society Conference (INET2002). Washington DC. USA. June 2002.
   Paper #7
8. A. Escudero, T. Holleboom, and S. Fischer-Huebner, Privacy for location data in Mobile Networks (NORDSEC2002). Karlstad, Sweden. November 2002, pp. 220-232.
   Paper #8