IoT Is In The Dark When It Comes To ePrivacy

Roll the clocks back to 25th May 2018. Businesses were fearing the worst about the General Data Protection Regulation (GDPR), cue a string of last-minute website changes, consent emails being sent, and records removed from databases.

Surprisingly, a December 2018 survey by IT Governance discovered that only 29% of firms in the EU are fully GDPR compliant.

If we look back, although GDPR stole much of the limelight, there were three other data protection regulations brought about at the same time, with the new UK Data Protection Act 2018, Data Protection, Charges and Notifications Act 2018, and the Privacy and Electronic Communications Regulation of 2003 (PECR), which goes to show how much of a challenge businesses face when it comes to data protection in 2019 and beyond.

In late-2019 to early-2020, the landscape is set to change again.

As if GDPR wasn’t enough of a challenge, the new ePrivacy regulation is set to shake things up massively when it comes to the Internet of Things. You’d be forgiven for not knowing much about ePrivacy, as the regulation remains in European Parliament for approval, with decisions on its future likely being made in the Spring of 2019.

What you do need to know, however, is that ePrivacy will intensify the levels of consent needed to operate online, in an effort to provide greater transparency on personal data processes.

Now, while the ePrivacy regulation will affect many types of business, none are as in the dark as those within IoT. While we outlined this as a piece that could spell trouble for the IoT, it could as easily be resolved as it is brought to a (temporary) standstill.

The current issue is that the ePrivacy regulation is broad, with no specific information on individual types of communication, which means machine to machine transmissions that include personal data and those that don’t contain this type of information are currently classed in the same bracket.

What does this mean? Well for those transmissions that contain personal data, it’s soon to become apparent that people will have to consent to the processing of this data. Which in reality is completely fine, as it’s something we’ve all become used to over the last year or two, particularly following the introduction of GDPR.

However, a complaint made currently is that there is no indication of how blanket rules would be applied as they currently are. Theoretically, a user would have to consent to personal data processing every time they enter a new network range whilst using a smartwatch, for example, which is completely unmanageable. There is a proposal in front of the EU petitioning for the two to be separated.

In essence, this would make total sense, as there is a clear distinction between the type of data a smartwatch would monitor (where it’s processing incredibly personal data, whether that be anything from body mass to exercise habits) and the information an application that controls home heating would process.

A recent amendment of Recital 12 of the ePrivacy regulation provided some hope, which made a distinction between the types of transmissions IoT devices make, only one of which falls under the scope of ePrivacy.

This outlines that previous consent, given at the time of installation would be enough to provide long-term consent without having to ask each time a different interaction is noticed. However, there is still come debate about the personal data processed in terms of there being more than one subject.

Kieran McGeehan, Data Protection Specialist at Univate, commented:

“Anyone operating within the IoT finds themselves in an unfortunate position. The ePrivacy is the next phase of the intensification of data privacy, and while its effect will be huge to the industry, as it’s still in draft stage, many of the implications are changing on a regular basis.

Therefore, while it’s easy to interpret current legislation as spelling disaster for the industry, we’d recommend preparing for the elements we know are going to come into force, and keeping a keen eye on the draft updates.

This involves a fightback against the number of unsolicited emails are sent, particularly relevant to the B2B arena, as this previously didn’t affect them as specifically as the ePrivacy regulation will.

Whilst we know that consent is a key element of the legislation, cookies apply to more than the devices within our homes. Ensuring websites and other methods of electronic communication have processes in place that control consent is essential and will provide a footing when it comes to complying with any law that relates to IoT.”

Ensuring compliance in 2019 and beyond

As we saw with GDPR, there is a practical aspect to ensuring compliance in terms of putting measures in place to effectively handle the changes, and another in terms of ensuring policies and procedures are up to date should an investigation ever take place.

Ensuring these formal documents are up to date, covering the requirements of the latest regulations, is an essential aspect of compliance. And remember, this will apply whether the UK is part of the EU or not!

Author: Kieran McGeehan, Managing Director & Compliance / Data Protection Specialist at Univate.  

Kieran has over 15 years of experience in data compliance, holding positions within businesses such as AXA Insurance, HSBC, The Co-Operative Insurance, and is currently chairperson of the Global Association of Data Protection Representatives.