Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC staff advises NTIA on ‘lessons learned’ regarding Internet of Things, (Jun 3, 2016)

By Jeffrey May, J.D.

Despite the "vast benefits and opportunities to consumers" that "Internet of Things" (IoT) devices can provide consumers, these devices may present a variety of security and privacy risks, the staff of the FTC Bureau of Consumer Protection and Office of Policy Planning has advised the National Telecommunications and Information Administration (NTIA). The staff comments were filed in response to a request from NTIA on information regarding the benefits, challenges, and role of government in fostering innovation for devices connected to the Internet.

The comment summarizes many of the findings and recommendations from the IoT workshop and the FTC staff’s 2015 IoT report. In addition, it "highlights lessons learned from the FTC’s law enforcement, consumer and business education, and policy activities relating to these issues."

Benefits, risks of the IoT. "The Internet of Things refers to the ability of everyday objects to connect to the Internet to send and receive data," according to the comment. Focusing on the potential benefits and risks to consumers, the staff explained that connected health, consumer-facing products can help aging patients manage their health care at home and that home automation systems can provide consumers with a single platform connecting all of the devices within the home. Security risks present in traditional computers and computer networks might be heightened in the IoT, where software updates to address such issues might not be applied to IoT chips that are inexpensive and disposable. The staff noted that "[s]ecurity risks in IoT can be exploited to harm consumers by: (1) enabling unauthorized access and misuse of personal information; (2) facilitating attacks on other systems; and (3) creating safety risks." The staff recommended that companies disclose the length of time they plan to support and release software updates for a given product line in order to help consumers better understand the safe "expiration dates" for their Internet-connected devices.

In addition, privacy concerns are raised by the direct collection of sensitive personal information, such as precise geolocation, financial account numbers, or health information. "[T]he ability to link and associate multiple IoT devices to the same user can also pose material privacy risks," according to the comment. "The potential for a cross-device tracking company to associate and aggregate information about consumers’ sleeping patterns, driving habits, movie preferences, and household activities implicates privacy risks not previously contemplated in the era of desktop computers." The staff recommended that companies should limit the data they collect and retain and dispose of it once they no longer need it in order to guard against privacy-related risks.

Notice and choice. Offering consumers notice and choice in the IoT is difficult when there is no consumer interface; however, the FTC staff believes that providing notice and choice remains important and practicable. The staff noted that companies can consider developing video tutorials, affixing QR codes on devices, and providing choices at the point of sale, within set-up wizards, in a privacy dashboard, or a combination of approaches.

The staff expressed concern about adopting a pure use-based model for the IoT. Under this approach, if a use is consistent with the context of the interaction—an expected use—then a company need not offer a choice to the consumer. Rather, the staff advocated for giving consumers information and choices about their data.

Role of government in fostering the IoT. The FTC has called for broad-based, technology-neutral, general privacy legislation. According to the staff, broader privacy legislation is preferable to IoT-specific privacy and data security legislation at this time. Privacy legislation could help both consumers and businesses by promoting trust in the IoT marketplace, it was noted.

Interoperability and standardization. Lastly, the FTC staff suggested that an IoT marketplace with different and competing technical approaches to interoperability might provide stronger privacy and data security benefits to consumers compared to a marketplace with a single interoperability standard. "When considering standardization and the interoperability of technologies, NTIA should carefully balance the potential benefits and costs to consumers and firms of standardization and competition," the staff comment concluded.

News: ConsumerProtection Privacy FederalTradeCommissionNews