The ICO has published its finalised guidance on consumer Internet of Things (IoT) products and services, which sets out clear expectations for manufacturers and developers on how to use people’s personal information responsibility. It explains how data protection law and the Privacy and Electronic Communications Regulations 2003 apply when processing process personal information in consumer IoT products. The guidance is based on feedback from the public and industry following a consultation last year. The guidance aims to provide regulatory certainty on areas such as asking for informed consent, how to provide transparent privacy information and the tools that need to be available for people to exercise rights over their own data.
The ICO has set out five expectations for IoT manufacturers and developers:
- Privacy must be built in from the start with protective settings on by default and data collection is only what is strictly necessary
- Consent must be real, specific and must be given via a clear opt-in with an equally easy withdrawal mechanism
- Users must be clearly informed about how data is used, in plain language and at relevant points across the entire product.
- Firms will be required to carry out a Data Protection Impact Assessment due to the sensitive nature of the data they collect and a higher threshold if children are using the product
- Security is an ongoing legal obligation which requires regular updates, encryption and multifactor authentication throughout the product’s lifetime.
The ICO guidance is a constituent part of its wider online tracking strategy, aiming to provide people with meaningful choice and confidence in how their information is used in addition to giving businesses the ability to innovate responsibly.
The ICO plans to investigate smart TVs this year will be engaging with connected TV manufacturers this year to assess whether they are complying with the law and offering consumers meaningful choice over how their data is used.
