RT @confinservlaw: I'm attending Keynote Morning! https://t.co/lc9QzlM5Wd really engaging discussion of the 2020 election.
RT @confinservlaw: What do Elvis and Auto Finance have in common? Both are in Vegas this week. Excited to be attending AFSA’s Auto Finance…
CFPB Issues Semi-Annual Report to Congress https://t.co/IqT8mF0RRr
The Federal Trade Commission (FTC) has issued a staff report on the “Internet of Things,” recommending businesses take concrete steps to enhance and protect the privacy and security of consumers. The report titled Internet of Things: Privacy & Security in a Connected World (http://www.ftc.gov/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things) provides a look at the FTC’s expectations for consumer data privacy and security for internet connected products. While the report does not have the force of law, it does provide insight as to the FTC’s minimum expectations should a data breach or other FTC Act violation occur.
In the report, the FTC defined the Internet of Things as being devices (other than computers, smart phones or tablets) that connect or transmit information with or with each other by way of the Internet. These devices can include embedded intelligence like smart appliances and medical devices. The report expressly excludes business to business products.
FTC REPORT RECOMMENDATIONS:
Companies developing Internet of Things (“IoT”) products should implement reasonable security. As noted by the FTC Staff, reasonable security is not a one size fits all proposition. It should take into account a number of factors, including the amount and sensitivity of the data collected, the sensitivity of the device’s functionality, and the costs of remedying the security vulnerabilities. At a minimum, however:
Companies should examine their data practices and business needs, and engage in data minimization. The FTC noted that data minimization helps safeguard against the potential harms of a data breach because the lack of valuable data is obviously less attractive to cyber thieves. At a minimum:
The FTC continued to emphasize that companies should provide consumers with notice and choice as to what data will be collected, particularly if data would be used in a way the consumer would not expect. While the FTC staff recognized the practical difficulties of providing choice where there is no consumer interface (for instance, smart appliances), the report does include several examples of how notices can be provided to consumers, through the use of icons, set up menus, and affixed barcodes linked to website interfaces.
Recognizing that this industry is in the early stages, the FTC did not advocate specific IoT legislation at this time; however, the report did recognize a need for general data security legislation. The report reiterated the Commission’s previous recommendation that Congress enact “strong, flexible, and technology-neutral legislation to strengthen the Commission’s existing data security enforcement tools and require companies to notify consumers when there is a security breach.”
If you have questions or would like more information on this topic, please contact attorney Caren D. Enloe at 919.250.2125 or by email at firstname.lastname@example.org.
Caren Enloe leads Smith Debnam’ s consumer financial services litigation and compliance group. In her practice, she defends consumer financial service providers and members of the collection industry in state and federal court, as well as in regulatory matters involving a variety of consumer protection laws. Caren also advises fintech companies, law firms, and collection agencies regarding an array of consumer finance issues. An active writer and speaker, Caren currently serves as chair of the Debt Collection Practices and Bankruptcy subcommittee for the American Bar Association’s Consumer Financial Services Committee. She is also a member of the Defense Bar for the National Creditors Bar Association, the North Carolina State Chair for ACA International’s Member Attorney Program and a member of the Bank Counsel Committee of the North Carolina Bankers Association. Most recently, she was elected to the Governing Committee for the Conference on Consumer Finance Law. In 2018, Caren was named one of the “20 Most Powerful Women in Collections” by Collection Advisor, a national trade publication. Caren oversees a blog titled: Consumer Financial Services Litigation and Compliance dedicated to consumer financial services and has been published in a number of publications including the Journal of Taxation and Regulation of Financial Institutions, California State Bar Business Law News, Banking and Financial Services Policy Report and Carolina Banker. ...LEARN MORE