  The vision for 6G extends beyond mere communication, incorporating sensing
capabilities to facilitate a diverse array of novel applications and services.
However, the advent of joint communication and sensing (JCAS) technology
introduces concerns regarding the handling of sensitive personally identifiable
information (PII) pertaining to individuals and objects, along with external
third-party data and disclosure. Consequently, JCAS-based applications are
susceptible to privacy breaches, including location tracking, identity
disclosure, profiling, and misuse of sensor data, raising significant
implications under the European Union's general data protection regulation
(GDPR) as well as other applicable standards. This paper critically examines
emergent JCAS architectures and underscores the necessity for network functions
to enable privacy-specific features in the 6G systems. We propose an enhanced
JCAS architecture with additional network functions and interfaces,
facilitating the management of sensing policies, consent information, and
transparency guidelines, alongside the integration of sensing-specific
functions and storage for sensing processing sessions. Furthermore, we conduct
a comprehensive threat analysis for all interfaces, employing security threat
model STRIDE and privacy threat model LINDDUN. We also summarise the identified
threats using standard common weakness enumeration (CWE). Finally, we suggest
the security and privacy controls as the mitigating strategies to counter the
identified threats stemming from the JCAS architecture.
