Antitrust Law Daily Wrap Up, PRIVACY NEWS: Ramirez advocates protecting privacy in the era of the Internet of Things, (Jan 7, 2015)
By Linda O’Brien, J.D., LL.M.
The number of new connected products, services, and technologies available show that the Internet of Things (IoT) has the potential to transform consumers’ daily lives, FTC Chairwoman Edith Ramirez observed in a January 6 speech before the International Consumer Electronics Show in Las Vegas.
In her remarks, entitled “Privacy and the IoT: Navigating Policy Issues," Ramirez stated that observers have predicted that the world will have 25 billion connected devices and the number of smart home devices will reach 25 million. These predictions highlight the complexity of the IoT, which has the potential to provide enormous benefits for consumers, but also has significant privacy and security implications.
There are three key challenges that the IoT poses to consumer privacy: (1) ubiquitous data collection; (2) the potential for unexpected uses of consumer data that could have adverse consequences; and (3) heightened security risks, in Ramirez’s view. The risks to privacy and security undermine consumer trust, which is as important to the widespread consumer adoption of new IoT products and services as a network connection is to the functionality of an IoT device. To enhance consumer privacy and security and thereby build consumer trust in IoT devices, companies should adopt “security by design,” engage in data minimization, and provide consumers with notice and choice for unexpected data uses.
Data collection. Ramirez noted that, in the near future, many aspects of consumers’ lives will leave a digital trail containing a wealth of revealing information which will, when patched together, present a personal and complete picture of each individual. Connected devices effectively allow companies to monitor consumers’ otherwise private activities. Moreover, the sheer volume of granular data that a small number of devices can generate allows those with access to the data to perform analyses and compile detailed profiles of consumer behavior.
Consumer data. The pervasive collection of data inevitably leads to concerns about how all of the personal information will be used, Ramirez continued. Will consumer information gathered from smart telephones, televisions, tablets and other devices be shared with prospective employers or determine what advertising and customer services consumers will receive? As businesses use the vast amount of data generated by connected devices to segment consumers to determine what products are marketed to them, what prices they are charged, and level of customer service they receive, will it exacerbate existing socio-economic disparities? Ramirez noted that consumers and businesses cannot continue with pervasive date collection without considering these questions.
Security risks. The IoT poses a number of security risks, with any device connected to the Internet at risk of being hijacked, Ramirez stated. Data security is already challenging, as seen by the growing number of high profile data breaches, but the world of the IoT presents unique challenges. To address the risks, Ramirez recommended that companies (1) conduct a privacy or security risk assessment as part of the design process; (2) test security measures before products launch; (3) use smart defaults; (4) consider encryption; and (5) monitor products throughout their life cycle and, to the extent possible, patch known vulnerabilities.
Additionally, companies should follow the principle of data minimization by collecting only the data needed for a specific purpose and then safely disposing of the data afterwards. To the extent that companies collect information, they should de-identify consumer data where possible. Finally, companies should give consumers clear notice and provide simplified choices for unexpected collection or uses of their data.
Some observers have argued that the IoT is in its early stages and should be allowed to evolve before privacy and security issues are addressed. However, there is an important opportunity to ensure that new technologies with the potential to provide enormous benefits develop in a way that also protects consumer information. Since companies are investing billions of dollars in this growing industry, they should also make appropriate investments in privacy and security, Ramirez concluded.
News: ConsumerProtection Privacy FederalTradeCommissionNews