Data protecton watchdog puts focus on to smart TVs
Malcolm Dowden says probe was trailed as the ICO published new guidance for ‘internet of things’ products and services
The way manufacturers of “smart” TVs use consumers’ personal data is to be scrutinised by the Information Commissioner’s Office (ICO) which trailed the probe as it published new guidance for consumer “internet of things” products and services.
The term “internet of things” (IoT) refers to the growing array of everyday products and services that are connected to online networks, such as smart TVs, smart fridges and ovens, smart doorbells and baby monitors, fitness trackers and smart watches, as well as connected toys and smart speakers.
It is common for IoT products and services to collect data about their users and to use that information for a range of purposes, including to create personalised experiences for their users, provide them with insights, or enable personalised adverts to be served to those users based on their interaction with those products and services.
In its guidance, the ICO highlighted how this activity constitutes processing of personal data and is subject to data protection laws and the UK’s Privacy and Electronic Communications Regulations (PERC).
The ICO said there is potential for IoT products to collect information about people that is intrusive and that manufacturers of IoT products and services therefore must consider whether they need to process personal information from those products at all and, if they do, how long it is necessary to retain that data.
It said that most personal data processing involving IoT products “is likely to result in a high risk” and highlighted that where this is the case, manufacturers must undertake a data protection impact assessment, to identify and reduce associated data protection risks before they undertake the processing.
Its guidance also addresses how the processing of data from IoT products and services can engage data protection principles under the UK General Data Protection Regulation (GDPR), including around fair and lawful processing, accuracy, data minimisation and data security, as well as requirements manufacturers face around accountability.
The ICO further confirmed that where IoT products have been designed to use cookies or other tracking technologies and consent has been obtained to their use, manufacturers should ensure that they obtain user consent for any subsequent processing of the personal data they gather about them. It said consent must be obtained if the trackers are to be used for online advertising purposes.
The ICO’s intended focus on the data protection compliance of smart TV manufacturers comes amidst research that found that the products are in 70 per cent of UK households.
“Smart TVs can collect a large amount of data and use this information to serve targeted advertising – but this must be done transparently and with genuine consent,” the ICO said, adding that it will engage with manufacturers of the products this year “to assess whether they are complying with the law and offering consumers meaningful choice over how their data is used”.
While this is not new law, it does signal a significant sharpening of the ICO’s enforcement focus as it prepares to move to its new corporate structure and as penalties under PECR have been increased to align with the UK GDPR maximum of £17.5 million or, if higher, 4 per cent of global annual turnover.
Malcolm Dowden, Managing Senior Practice Development Lawyer at Pinsent Masons
Comments
Want to join the conversation? Please or to comment on this article.