Page - 201 - in Intelligent Environments 2019 - Workshop Proceedings of the 15th International Conference on Intelligent Environments

5.- Administrative limitations regarding privacy Through the elaboration of profiles or automated decision making, Public Administrations can dictate administrative acts that affect the privacy of citizens. In fact, in a context of the internet of things and macro data, the risk of legal principles such as security, equality or privacy can not be forgotten. In Spain the Organic Law 3/2018, in line with the provisions of the General Data Protection Regulation, regulates the protection of data from design, impact evaluation or anonymization. From a legal perspective, the transmission of data within the framework of smart cities raises the problem of consent. In effect, article 4.11 of Regulation (EU) 2016/679 makes the guarantees of the transmission of data in the consent of the affected, conceived as any expression of free will, specific, informed and unambiguous by which he accepts, either through a statement or clear affirmative action, the processing of personal data concerning him. At this point, the principles relating to the treatment of data contained in the Regulation (EU) 2016/679 in article 5 can not be forgotten. According to this Article the personal data must be: a) treated in a lawful, fair and transparent manner in relation to the interested party ("lawfulness, loyalty and transparency"); b) collected for specific, explicit and legitimate purposes, and will not be subsequently processed in a manner incompatible with said purposes; according to article 89, paragraph 1, the further processing of personal data for purposes of archiving in the public interest, scientific and historical research purposes or statistical purposes will not be considered incompatible with the initial purposes ("limitation of purpose"); c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are treated ("data minimization"); d) exact and, if necessary, updated; all reasonable measures shall be taken so that personal data that are inaccurate with respect to the purposes for which they are treated are removed or rectified without delay ("accuracy"); e) maintained in a way that allows the identification of the interested parties for no longer than necessary for the purposes of processing personal data; personal data may be kept for longer periods provided they are exclusively for the purpose of archiving in the public interest, scientific or historical research purposes or statistical purposes, in accordance with article 89, paragraph 1, without prejudice to the application of the measures appropriate technical and organizational measures imposed by this Regulation in order to protect the rights and freedoms of the person concerned ('limitation of the period of storage'); F.J.BauzáMartorell / IntelligenceTourismandPublicAdministration 201