The internet of things (IoT)

Last week, U.K. Digital Minister Margaret James announced that consultation had begun on potential legislation for IOT devices, including passwords that could not be reset to factory settings and a minimum length of time during which the device will continue to receive security updates.

Meanwhile, the Internet of Things Cybersecurity Improvement Act of 2019 was introduced to the U.S. Senate in March, the second attempt by lawmakers to place a cybersecurity standard on IoT devices purchased by government agencies. While the two countries are both looking to lead the way, it seems likely that the U.K. will get the first—and probably more rigorous—word in on IoT regulation.

“Europe, the U.K. included, has historically been more regulatory than the U.S., so it's not surprising that they would set a high regulatory bar or standard for privacy regulation,” said Robert McDowell, a partner at Cooley.

But why, exactly? On a strictly pragmatic level, U.K. politicians don't have the equivalent of a Silicon Valley to provide pressure one way or the other. Culturally, Europe has also been much more engaged with the concept of privacy as evidenced by the European Union's General Data Protection Regulation (GDPR).

And IoT is most definitely a privacy issue. McDowell pointed out that since IoT devices can run the gamut from bicycles to refrigerators, the data contained therein has the potential to be even more intimate in nature.

“It's really unlimited … IoT will tell us exponentially more about individuals and their behavior than we've ever seen in human history,” McDowell said.

But until that data becomes the center of a controversy, there's a chance that IoT legislation in the U.S. could be a ways off. The privacy debate stateside has been fueled by data breaches attached to big names like Marriott, but IoT devices have yet to catch much of that heat.

Mark Radcliffe, a partner at DLA Piper, doesn't believe that most people are aware of the risks involved outside of occasional reports about a baby monitor being hacked.

“I think unfortunately much legislation in Congress is driven more by recent events and some massive hack than it is by rational assessment of the risk to society and saying this is something we should fix,” Radcliffe said.

He noted that one particular problem with this methodology is that laws born out of crisis tend to not be very well thought-out, citing ambiguities within the California Consumer Protection Act, which in turn has echoes of the GDPR. If individual states do wind up taking the lead on IoT legislation as well, Radcliffe thinks that they would be more inclined to look across the pond for inspiration than the federal government.

“They might go to the U.K. and say 'OK, this has worked in the U.K., we ought to do it here,'” Radcliffe said.

Another factor that could eventually push the states or even the U.S. government closer towards the U.K. approach to regulation might be an increasingly global marketplace. The patchwork of varying privacy regulations criss-crossing the map have already complicated the way that data is handled or transferred for international business purposes or even e-discovery.

Radcliffe believes that many IoT devices naturally speak across borders, potentially creating many of the same hiccups caused by existing international privacy laws that don't quite align.

“If you say, 'well I'm going to comply with European rules in Europe and U.S. rules in the U.S.,' and then you have all this cross-border data chatter, that sort of makes your life incredibly complex,” Radcliffe said.