FPF Statement on FTC Internet of Things Report

The Report, which appropriately does not call for IoT specific legislation, reflects the fact that the Internet of Things is in its infancy, and strongly supports context as a way to assess appropriate uses.  The staff recognized concerns that a notice and choice approach could restrict unexpected new uses of data with potential societal benefits.  They sensibly  incorporated certain elements of the use-based model into its approach linking the idea of choices being keyed to context to take into account how the data will be used.

However, the report is overly cautious in that it recognizes that there are beneficial uses that can strain data minimization or could warrant out of context uses, but worries that allowing companies alone to judge the bounds of such uses without legislation would lead to mistakes.  In many cases, the FTC already has the ability to use deception or unfairness authority to take action when a company creates risk to consumers without countervailing benefit.  We hope the Administration’s soon to be released Consumer Bill of Rights charts options that can frame the parameters for out of context uses or data retention, by looking to codes of conduct and consumer subject review boards.

-Jules Polonetsky & Christopher Wolf, Future of Privacy Forum