Antitrust Law Daily Wrap Up, PRIVACY NEWS: Navigating the legal implications of the Internet of Things, (Nov 13, 2015)

By Jody Coultas, J.D.

The 37th annual BAA Marketing Law Conference, entitled “Walking the Line: Between Innovation and Regulation,” featured a session on November 10 on the implications of the growth of Internet-enabled devices on privacy and advertising law.

The session was moderated by Christin McMeley, a partner at Davis Wright Tremaine LLP, and conducted by Brenda Pritchard, a partner at Gowling Lafleur Henderson LLP, Simon Krauss, Deputy General Counsel of Cable Television Laboratories, Inc., and Steven Caldwell, Senior Counsel for The Procter & Gamble Company.

Although 73 percent of people do not recognize what the term “Internet of Things” means, there were almost 5 billion connected devices around the world and $655.8 billion spent on these devices in 2014. Many industry specialists opine that connected devices will outnumber the world population 5 to 1 by 2020. The Internet of Things refers to any devices that are able to collect and transmit data. As with other technological advances, connected devices present significant challenges for Congress, federal and state regulators, the companies that manufacture and advertise the devices, and data brokers.

According to the panel, the legal implications are vast. Manufacturers face product liability claims when sensors fail, intellectual property and ownership and data licensing rights claims, and consumer backlash when they do not understand or agree with the use of the technology. Every device is a possible point of attack, as well as a way into a network for hackers. Many devices lack adequate security systems. Most importantly for marketers is the issue of what data will be collected and how that data will be used.

Practitioners face a web of laws that never contemplated the technology involved. Existing privacy-specific laws––such as the Children’s Online Privacy Protection Act (COPPA) and Section 5 of the FTC Act––can and have been applied by regulators, consumer advocates, and companies to connected devices and their data-collection activities. These laws require certain security measures and disclosures of how data is collected and used. However, these laws are often too narrowly drawn to contemplate the implications of how the devices track, store, and share data.

To remedy this issue, the FTC issued a staff report entitled “The Internet of Things: Privacy and Security in a Connected World” on January 27. Acknowledging that the Internet of Things is “in its infancy” and specific legislation would be premature, the FTC staff urged Congress to enact both general data security legislation and baseline privacy legislation that would include mandatory privacy disclosures and offer consumers choices concerning how their data is collected and used. The Report recommended the adoption of certain best practices without offering specific solutions.

Despite the guidance provided by established privacy and advertising laws and the FTC, the panel noted that there are still many unsettled issues. While certain disclosures are required before collecting data, there is an issue with how broad these disclosures must be. This is made more complicated by the ability to store data and use it in ways companies cannot foresee. The ability of data brokers to re-identify data that has been de-identified and anonymized also creates privacy concerns. The panel also noted that even companies that adopt best practices may still be held liable for the privacy failures of contractors, employees, and third parties.

The panel also noted that we are still a ways from fully automated, “smart” homes based on issues with platform standards. Today, most devices manufactured by different companies cannot “talk” to each other. However, the panel opined, we are very likely moving in that direction, a development that will undoubtedly lead to even more legal issues.

News: Privacy Advertising