Question

Typically, the company providing an IoT( internet of things) device owns its customers’ data. What laws or rules are needed to balance the needs of the company and the privacy of customers?

Answer 1

Consumer safety regulations are largely due to the severe penalties in place for any corporation (and its managers) that provides customers with products that put their safety at risk, as well as a federal consumer protection agency's support and ability to prosecute companies on behalf of consumers. With IoT products, the same stringent, serious, and supported framework is required that puts the digital and physical safety of consumers at risk.

Not only in terms of security, but also in terms of privacy, the danger to consumers from IoT goods. I believe that similar requirements must be put in place for Privacy by Design, including severe penalties for any collection, storage and sale of consumer personal data (whether directly or indirectly through advertising targeting profiling) if it is not directly required for the proper functioning of the device and service as seen by the consumer.

Likewise, the specifications should include a strict ban on any backdoor access to user data, application information, or any form of system control, including government or law enforcement related. In addition, the provisions should include a strict ban on vendors sharing any data or control with a government or law enforcement agency / representative by "Gentleman's Agreements."

In respect to security and privacy standards, I agree that any specific requirements laid down in legislation will always be obsolete and incomplete. I would therefore require independent agencies for standards in a similar manner to other bodies regulating standards on the internet. A good example is the CA / Browser Forum's management of TLS certificate security rules.

Cases of IoT vendors leaving business or discontinuing devices and/or software updates must also be addressed. There must be a minimum duration of software updates, and if support is discontinued, vendors should be required to provide the latest firmware and update tool as an Open Source to allow the user or a third party to continue support.