Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC report on Internet of Things encourages companies to take measures to protect consumer privacy, (Jan 27, 2015)
By Dan Selcke, J.D.
Today, the FTC staff released a detailed report on the Internet of Things (IoT), which refers to the ability of everyday devices to connect to the Internet and to send and receive data. According to an agency announcement, the report outlines best practices companies should adopt to protect consumers from the unique risks the IoT presents.
The report, which limited itself to covering IoT devices that are sold or used by consumers, recognizes that the IoT is beneficial. For example, household appliances connected to the Internet could result in more efficient energy use, while connected cars could make highways safer. With over 25 billion connected devices currently in use worldwide, many consumers are already experiencing some of these benefits, but the IoT also raises privacy and security concerns.
“The only way for the Internet of Things to reach its full potential for innovation is with the trust of American consumers,” said FTC Chairwoman Edith Ramirez. “We believe that by adopting the best practices we’ve laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized.” Some of those best practices include:
build security into devices at the outset, rather than as an afterthought in the design process;
train employees about the importance of security, and ensure that security is managed at an appropriate level in the organization;
ensure that when outside service providers are hired, those providers are capable of maintaining reasonable security, and provide reasonable oversight of the providers;
when a security risk is identified, consider a “defense-in-depth” strategy whereby multiple layers of security may be used to defend against a particular risk;
consider measures to keep unauthorized users from accessing a consumer’s device, data, or personal information stored on the network; and
monitor connected devices throughout their expected life cycle, and where feasible, provide security patches to cover known risks.
Recognizing that a company with a large store of consumer data will become an enticing target for data thieves, the report also recommended that companies limit the amount of consumer data they collect and that they retain it for only a set period of time. Also, companies should notify consumers when their data is being collected and give them choices as to how it is used.
When it came to legislation, the report agreed with many stakeholders that the IoT was still evolving too quickly for any piece of legislation to effectively address it in a comprehensive way. It did, however, advocate for strong data security and breach notification legislation, as well as privacy legislation that is both flexible and technology-neutral.
Finally, the press release identified some of the tools currently available to the FTC to protect consumer privacy—including the FTC Act and the Fair Credit Reporting Act—and directed readers toward “Careful Connections: Building Security in the Internet of Things,” a new FTC publication that advises business on how to build security into products connected to the IoT.
While the Commission voted 4-1 to publish the IoT report, Commissioner Wright voted against it on the ground that the report did not contain analytical support to establish that its recommendations concerning best practices and broad-based legislation would actually improve consumer welfare.
News: ConsumerProtection Privacy FederalTradeCommissionNews