The Internet of Things has multiple uses in business-to-consumer and business-to-business spaces. It is typically defined as a network of devices equipped with sensors that can observe real-time data and communicate with each other. Think about connected cars, smart homes and various “smart products” designed for consumers, as well as connected machines and facilities increasingly used in workplaces.
For in-house privacy professionals, a new IoT project may present a range of legal and compliance issues, as existing laws might not be squarely suited to address privacy and security risks in the IoT environment. This article provides an overview of the current regulatory landscape and some practical tips on approaching IoT projects.
The state of play
In recent years, discussions around IoT technologies were mostly held in corporate research and development departments with some rare attention from regulators in the EU and U.S. (e.g., WP29 Opinion 8/2014, 2015 FTC Staff Report).
Existing privacy laws do not specifically call out IoT devices. The IoT security law that requires manufacturers to equip IoT devices with “reasonable security features.” Otherwise, many data protection authorities are nowadays catching up with rapid technological advancement, focusing on distinct areas of concern, such as facial recognition and artificial intelligence.
In the absence of nuanced guidance in the IoT arena, many companies strengthen their privacy programs and turn to the development of corporate Good Practices for Security of IoT, U.S. National Institute of Standards and Technology's Recommendations for IoT Device Manufacturers).
Privacy by design, along with data minimization and use limitation practices, are equally important. Despite some perception that the nature of IoT devices can be opposite to these approaches, there are a few emerging privacy-enhancing technologies, such as local processing, device-level machine learning techniques, and “small data” concepts that allow companies to innovate, comply with existing laws and stand out among competitors.
How to provide valid notice?
Transparency is the central component of many privacy frameworks; however, there might be no standard means to display notices in the context of the IoT context — imagine distracting pop-ups while driving a car. Therefore, providing notice for IoT devices may require some creativity to keep it safe, user-friendly and compliant.
For example, in the GDPR world, notice options include icons on IoT device packaging, QR codes, tutorials during setup, voice alerts and privacy dashboards, as indicated in the WP29 Guidelines 2016/676. This list could be a good starting point for your conversation with IoT project stakeholders.
Consent is (likely) not a ‘king’
The overreliance on consent is often criticized in the web domain (e.g., cookie fatigue). Indeed, the EU ePrivacy Directive, which sets special rules for “machine-to-machine communications,” is focused on consent as the prevailing ground for data processing. In an interesting turn, the ePrivacy Regulation draft released recently by the Croatian Presidency establishes that end-user consent is not required in the IoT context and that processing is allowed based on contractual necessity.
Regardless of regulatory developments, it seems more important to understand your users’ expectations. With a number of gray areas, the user-centric approach, coupled with companies’ accountability, can mitigate associated risks in the IoT space.
So, where to start?
Review the regulatory landscape: Make sure to monitor IoT regulatory developments worldwide, including laws, industry standards, guidelines and enforcement cases.
Develop the IoT review framework: Create a cross-functional data protection impact assessment review will be triggered.
Design privacy controls: Depending on jurisdiction, there might be various legal requirements for notice, consent or data subject rights. Consider providing geo-specific settings, such as a CCPA’s “do not sell” button for Californian residents.
Think like a user: User research and testing are crucial in understanding your users' expectations for the IoT. Results will help you have a meaningful discussion with stakeholders on “what is the right thing to do?”
Remember about B2B issues: Consider how to provide your enterprise customers with means to address applicable privacy and employment laws, such as restrictions on employee monitoring in certain jurisdictions.
On a big-picture scale, the wide adoption of IoT is still in the early stages. Remarkably, the contact-tracing apps. Hence, it is a crucial time for companies to step up their data protection and data ethics programs to foster trust in IoT technologies. In the end, privacy is not a compliance burden; it’s good and socially responsible business.
Photo by Federico Beccari on Unsplash
