IoT allows any devices to connect to a server which collect sensitive privacy data such as whether or not you are at home etc.
What are the main consent of users that need to be addressed when it comes to IoT devices?
1 Answer
I've just started reading about privacy in IoT therefore I thought I might give you some pointers (my day to day work is spent on making privacy policies and their management for websites and apps easier at iubenda).
I think reading through any privacy by design principles might be the best start.
I'm citing from a worksheet published by a Pan-European entity called the Article 29 Working Party (which I will link to at the bottom of this answer):
In particular, users must remain in complete control of their personal data throughout the product lifecycle, and when organisations rely on consent as a basis for processing, the consent should be fully informed, freely given and specific.
Consent on IoT devices isn't really a simple matter.
For example, displaying a privacy policy document on your site is not sufficient. The FTC recommends (relevant for US based activities) that you find a way to present privacy notices and multiple choices of levels to customers, including in the set-up or purchase of the IoT device itself.
Again, here is the Art 29 WP
In addition, classical mechanisms used to obtain individuals’ consent may be difficult to apply in the IoT, resulting in a “low-quality” consent based in a lack of information or in the factual impossibility to provide fine-tuned consent in line with the preferences expressed by individuals. In practice, today, it seems that sensor devices are usually designed neither to provide information by themselves nor to provide a valid mechanism for getting the individual’s consent. Yet, new ways of obtaining the user’s valid consent should be considered by IoT stakeholders, including by implementing consent mechanisms through the devices themselves.
There is no one-size-fits-all approach. Users must be able to access, view and remove the data you collect from them. Users should be able to disconnect their IoT devices when they want to do so.
Another issue deserving of your attention is "sensitive data", again quoted from the Art 29 WP document:
Applications in the IoT may process personal data that can reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or sex life, which actually qualify as “sensitive data”, deserving special protection in the sense of Article 8 of Directive 95/46/EC. In practice, the application of Article 8 to sensitive data in the IoT requires that data controllers obtain the user’s explicit consent, unless the data subject has made himself the data public.
This type of data needs explicit consent.
Beyond the requirement of fair collection of the data, you must communicate specific information about the product: the identity of the controller, the purposes of the processing, the recipients of the data, the existence of their rights of access and right to oppose (which includes information about how to disconnect the object to prevent disclosure of further data).
Hopefully this helps to get started and here are some resources:
