By Alex Wall, Esq.
Senior Counsel and Global Privacy Officer, RADAR, Inc.
The Internet of Things, as its name suggests, is a big category. It’s like when I walk into a candy shop that happens to have imported Dutch licorice and I say, “I would like all of the things, please.” You may end up with more than you bargained for.
Internet of Things encompasses pretty much everything on the Internet. Our smart TVs, our voice-activated cloud-connected assistants, our streaming media devices, our smartphones, our home security systems, our thermostats, our webcams, our watches…these technologies are increasingly connected and sending sophisticated data to central servers, to each other, and who knows where else. Also, our power grid, our infrastructure, our factories, and other places where the standard consumer does not go are increasingly connected as well.
IoT: What it is and How Quickly it’s Growing
The Internet of Things is literally any device with an IP address. The Internet of Things is also not new: your ten-year-old PC is also part of the IoT.
It is estimated by the IDC that by 2020, the Internet of Things will comprise no less than 50 billion devices and 212 billion sensors, generating 44 zettabytes of information. A zettabyte is 1021 bytes or 1,000,000,000,000,000,000,000. It’s an incomprehensible number to me, like the distance to another galaxy, or the size of an atom versus the size of Jupiter.
In its recent report entitled Internet of Things: Privacy & Security in a Connected World, the FTC found that fewer than 10,000 households, which adds up to a relatively small number of devices, can together generate a whopping 150 million discrete data points—daily.
Why Should We Care About What’s Happening with ‘All of the Things?’
Privacy concerns about the multitude of IP devices relate directly to our rights as humans, our contractual relations with business partners, and our individual and collective security.
“Privacy” is not merely the ability to close the proverbial door to the outside world and mask information about ourselves. Privacy also includes our individual control over information held, and things said in databases about ourselves.
For instance, a major privacy principle behind the Fair Credit Reporting Act is the principle that an individual has a right to the accuracy of information held about them when it has important consequences with regard to their privacy rights. This principle is widely referred to as the “data integrity” or “accuracy” principle. Similarly, when connected devices capture data that relates to us, and where it has an impact upon an important decision made about us, we have a right to the accuracy of that information.
The Parade of Scary Scenarios
What if one day a company selling you fuel oil to heat your home had access to more specific data about your usage than you do, and came to your front door prepared with that information in order to sell you your fuel requirements for the year? Clearly, that salesperson would have a stronger negotiating position with superior information while you are trying to decide whether to buy monthly or yearly. Actually, this likely happens today. Your fuel company does have information about all of your usage. What they might not have yet, is detailed information about your thermostat settings over time and how that might relate to the efficiency of your home and your personal comfort preferences. If they did have that information, they might have even more detailed information about how the weather will affect your usage.
TechCrunch recently pointed out that “the most dangerous part of IoT is that consumers are surrendering their privacy, bit by bit, without realizing it, because they are unaware of what data is being collected and how it is being used“—but who among us has the time to read 20 pages of privacy policy about every device we purchase? Who among us feels as though they actually have a choice? Depending upon the manufacturer and the settings and choices they give us, either we partake of ‘the things’ or we do not. I am fairly sure I was among a very small group of people who actually read the privacy notice on the Pokémon app, where it said you surrender your right to a jury trial if you don’t uninstall the app within 30 days and send them an email (which I did).
For businesses, poorly understood IoT devices can cause problems. One internal area of privacy for a business is employee monitoring. Let’s say a company-installed webcams for security inside of the office near entryways. This is a fairly common, generally legal, and reasonable practice. On the other hand, there are many brands of webcams, and there are secure and insecure ways of configuring webcams. Some webcams don’t even encrypt the video feed that they send across the public Internet to web interfaces of questionable security practices. Such devices are easily hacked. While it may be legitimate for an employer to monitor the premises (in places that are not considered places of personal privacy like a restroom), an employer is probably violating employees’ rights to privacy and security by not protecting such systems from hackers who could access and publicly post videos and images of employees.
Similarly, device-monitoring systems are frequently employed to keep track of mobile assets like laptops and to secure networks, but a poor choice of monitoring tools can create more problems. A disreputable device monitoring software developer might not properly secure the information gathered and expose it to hackers.
Automobiles are computerized devices with Internet connections, and they have joined the IoT in recent years. The manufacturers of automobiles must be aware of the design and architecture of their data flows in order to be compliant with privacy laws. France’s data protection authority (CNIL) has recently released a “compliance package”, providing guidelines for how to treat the personal data gathered by connected cars. In a less formal setting this February, FTC Commissioner Terry Sweeney presented as keynote speaker at the Connected Cars 2016 conference, stating that the Commission was watching to ensure that automobiles protect the security and privacy of consumers. As the FTC is the agency that enforces privacy notices under their mandate to protect consumers from unfair and deceptive trade practices, manufacturers do well to ensure that their privacy notices properly represent and disclose their use of data, and even if they do so, there is still the chance that the use might be considered unfair to the consumer.
The parade can easily continue into infrastructure, highways, the energy sector, manufacturing robotics, airlines, home automation…
Risk Assessment: An IoT Privacy Incident Can Be Analyzed Like Any Other Incident
Like any other incident, an IoT incident should be analyzed under the multitude of state, federal, and international laws (and contractual obligations) to determine whether it is a breach that should be reported. For the latest trends in data breach notification law, visit https://www.radarfirst.com/offer/2016-trends-in-data-breach-notification-law.
Similar factors must be analyzed to understand the seriousness and sensitivity of the incident. In the prior example of an employer’s webcam, we are talking about the unauthorized use or access of information by a hacker third party. Under some states or according to some federal agencies (and definitely in European jurisdictions and some Canadian ones), the webcam could have leaked personal information and may therefore have been a breach.
In order to know for sure if an incident is a breach, the assessor needs to think about the facts of the incident and how they fit into the laws, rules, and guidance in these jurisdictions. This is not a simple task—consistency in conducting a multi-factor risk assessment and maintaining thorough documentation remains a key aspect in maintaining your culture of compliance.
[clickToTweet tweet=”We Are Surrounded: Privacy and the Internet of Things ” quote=”We Are Surrounded: Privacy and the Internet of Things ” theme=”style3″]