RT @confinservlaw: I'm hearing rumblings that May 8th is the day we've been anxiously awaiting for proposed debt collection rules.
#wineandcheese #omgfunwithsd https://t.co/lYdiWOSLkt
The Federal Trade Commission (FTC) has issued a staff report on the “Internet of Things,” recommending businesses take concrete steps to enhance and protect the privacy and security of consumers. The report titled Internet of Things: Privacy & Security in a Connected World (http://www.ftc.gov/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things) provides a look at the FTC’s expectations for consumer data privacy and security for internet connected products. While the report does not have the force of law, it does provide insight as to the FTC’s minimum expectations should a data breach or other FTC Act violation occur.
In the report, the FTC defined the Internet of Things as being devices (other than computers, smart phones or tablets) that connect or transmit information with or with each other by way of the Internet. These devices can include embedded intelligence like smart appliances and medical devices. The report expressly excludes business to business products.
FTC REPORT RECOMMENDATIONS:
Companies developing Internet of Things (“IoT”) products should implement reasonable security. As noted by the FTC Staff, reasonable security is not a one size fits all proposition. It should take into account a number of factors, including the amount and sensitivity of the data collected, the sensitivity of the device’s functionality, and the costs of remedying the security vulnerabilities. At a minimum, however:
Companies should examine their data practices and business needs, and engage in data minimization. The FTC noted that data minimization helps safeguard against the potential harms of a data breach because the lack of valuable data is obviously less attractive to cyber thieves. At a minimum:
The FTC continued to emphasize that companies should provide consumers with notice and choice as to what data will be collected, particularly if data would be used in a way the consumer would not expect. While the FTC staff recognized the practical difficulties of providing choice where there is no consumer interface (for instance, smart appliances), the report does include several examples of how notices can be provided to consumers, through the use of icons, set up menus, and affixed barcodes linked to website interfaces.
Recognizing that this industry is in the early stages, the FTC did not advocate specific IoT legislation at this time; however, the report did recognize a need for general data security legislation. The report reiterated the Commission’s previous recommendation that Congress enact “strong, flexible, and technology-neutral legislation to strengthen the Commission’s existing data security enforcement tools and require companies to notify consumers when there is a security breach.”
If you have questions or would like more information on this topic, please contact attorney Caren D. Enloe at 919.250.2125 or by email at email@example.com.
Caren Enloe is a partner who concentrates her practice in consumer financial services litigation and compliance, bankruptcy, and commercial litigation with an emphasis on creditor’s rights. She has a deep understanding of the complex compliance environment surrounding the financial services industry and regularly advises financial service companies on licensing and compliance issues involving state and federal consumer protection and finance statutes. Caren is the author of a daily blog titled: Consumer Financial Services Litigation and Compliance where she posts timely and informative updates regarding the CFPB, FTC, and a host of topical litigation issues involving consumer protection law....LEARN MORE