Privacy Subteam

Recommendations

April 18-19, 2023

Internet of Things Advisory Board (IoTAB)
 

 

 

 

 

Privacy Subteam Members

Subteam Members: Debbie Reynolds, Kevin Kornegay, Maria Rerecich, Mike Bergman

Advisor: Barbara Cuthill

Contractors: Brad Hoehn, Greg Witte

Chair: Debbie Reynolds
Opportunities

Policy and / or Regulation should be considered in the US

Privacy by Design throughout the IoT lifecycle

Enable International data-sharing agreements

Promote best practices for data collection and data sharing

Education about the use of IoT devices (user or worker)

Standardization of Privacy Policies

Investigate the cybersecurity label program for privacy

Incentives regarding liability protections for compliance

Metrics to assess the risks of how the user interacts with IoT
Barriers

Lack of transparency about IoT

Lack of Trust in IoT

Lack of education about the use of IoT devices, including

hazards (user or worker)

Lack of understanding of the data being collected by IoT devices

Lack of control or agency in data collection

Re-identification of individuals from data sources

Digital divide (not everyone has access to 5G, IoT, etc.)
 

 

 

 

 

 

 

Recommendations list (summary list)

1.Simplifying Privacy Policies for Reading Accessibility

2.Establish “data use” basics for privacy policies

3.Learning from CCPA, GDPR, and other Privacy

Regulations

4.Create a National Privacy Framework for Innovation and

Data Protection

5.Implementing US Federal Privacy Regulation

6.Privacy Label Creation for IoT
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #1

Simplifying Privacy Policies for Reading Accessibility for IoT

Recommendation

Advocate for the simplification of

privacy policies, privacy notices, and

data use policies to enhance

accessibility and comprehension for

users.

Promote the adoption of the "Plain

Writing Act of 2010" (Public Law

111-274) as a means for the

government to enforce this

recommendation on organizations

that provide IoT technology to the

government.

Justification

Improved understanding of data

privacy policies for users, leading to

more informed decisions when using

IoT devices.

Enhanced public trust in IoT devices

and related technologies.

Simplified policies may lead to

increased compliance and reduced

legal disputes
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #1 (details)

Implementation considerations

Develop guidelines and best

practices for organizations to follow

when simplifying privacy policies.

Establish high-level guidance for

evaluating and assessing the

readability of privacy policies.

Coordinate with relevant

stakeholders, including the private

sector and consumer advocacy

groups, to ensure widespread

adoption.

Implementation barriers

Resistance from organizations that

may perceive simplification as a

limitation on their legal protections.

Possible challenges in defining the

appropriate level of simplification

while maintaining accuracy and

comprehensiveness.
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #1 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

National Institute of Standards and

Technology (NIST)

Department of Commerce (DoC)

Federal Communications Commission

(FCC)

The Office of Management and Budget

(OMB) is responsible for overseeing the

implementation of the Act and ensuring

that each agency has a Plain Writing

program in place.

Federal considerations

Ensuring that simplification efforts do not

inadvertently lead to the omission of

critical information in privacy policies.

Recognizing that simplified language may

not resolve all issues related to data

privacy and that additional efforts to

educate the public on IoT and data privacy

may be necessary.

Continuously monitoring and updating the

simplification guidelines to account for

technological advancements and emerging

privacy concerns.
 

 

 

 

 

Recommendation #1 (details)

Benefits

The law already exists

All US government agencies already have a plain language

policy

The US government could extend these requirements to

organizations that do business with the government
 

 

 

Recommendation #1 (details)

References

Public Law 111 - 274 - Plain Writing Act of 2010 GovInfo.

https://www.govinfo.gov/app/details/PLAW-111publ274. Accessed 17 Apr. 2023
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #2

Establish “data use” basics for privacy policies

Recommendation

Create a set of "data use" basics that

must be included in privacy policies

for IoT devices

Ensure that these policies are

designed with the consumers' needs

and understanding in mind

Justification

Provides consumers with a

standardized baseline of information

regarding data use, making it easier for

them to compare and understand

different policies

Enhances trust in IoT technology by

ensuring transparency and consistent

communication of data practices
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #2

Implementation considerations

Create guidelines on how to

effectively communicate these

basics in privacy policies

Encourage or require IoT device

manufacturers to adopt these "data

use" basics in their privacy policies

Implementation barriers

Ensuring broad adoption and

compliance with the established "data

use" basics across different industries

and sectors

Balancing the need for standardized

information with the unique

characteristics and data practices of

individual IoT devices and services
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #2 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

Department of Commerce (DoC)

National Institute of Standards and

Technology (NIST)

Federal Communications Commission

(FCC)

Federal considerations

The potential impact on market

competition and innovation if new

regulations are perceived as burdensome

or restrictive

Providing resources and support to

companies in adopting and implementing

the "data use" basics in their privacy

policies

Regularly reviewing and updating the "data

use" basics to ensure they remain relevant

and effective as IoT technology evolves

and new data privacy concerns emerge
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #3

Learning from CCPA, GDPR, and other Privacy Regulations

Recommendation

Analyze and learn from existing

privacy regulations, such as the

California Consumer Privacy Act

(CCPA), General Data Protection

Regulation (GDPR), and others

Develop a high-level privacy

framework for IoT devices,

incorporating successful elements

and lessons learned from these

regulations

Justification

Leveraging the experience and

knowledge gained from implementing

existing privacy regulations can help

create a more effective and efficient

IoT privacy framework

Provides a foundation for a

harmonized approach to privacy in the

IoT sector, reducing confusion and

fragmentation for both consumers and

businesses
 

 

 

 

 

 

 

 

 

 

Recommendation #3 (details)

Implementation considerations

Conduct a thorough analysis of the CCPA,

GDPR, and other privacy regulations to

identify best practices, potential

improvements, and lessons learned

Ensure that the IoT privacy framework is

adaptable and scalable to accommodate

the rapidly evolving nature of IoT

technology and the data privacy

landscape

Implementation barriers

Achieving consensus among

stakeholders on the most effective

elements and practices to incorporate

into the IoT privacy framework

Overcoming potential resistance from

industry participants who may perceive

new regulations as burdensome or

restrictive

Ensuring compatibility with existing

privacy regulations at the state and

international level
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #3 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

Department of Commerce (DoC)

National Institute of Standards and

Technology (NIST)

Federal Communications Commission

(FCC)

Federal considerations

The need for a balance between protecting

consumers' data privacy and fostering

innovation in the IoT sector

The importance of providing resources,

guidance, and support to businesses for

the adoption and implementation of the

IoT privacy framework

Regularly reviewing and updating the IoT

privacy framework to ensure it remains

relevant and effective in addressing

emerging data privacy challenges and

technological advancements
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #4

Create a National Privacy Framework for Innovation and Data Protection

Recommendation

Develop a National Privacy

Framework for Innovation and Data

Protection specifically tailored to

the unique challenges posed by IoT

devices

Ensure that the framework balances

the need for data privacy and

security with fostering innovation in

the IoT sector

Justification

Provides a consistent, unified

approach to data privacy and security

in the IoT sector, reducing confusion

and fragmentation for both consumers

and businesses

Encourages innovation by providing

clear guidelines and expectations for

IoT device manufacturers, fostering a

competitive and growth-oriented

environment
 

 

 

 

 

 

 

 

 

 

Recommendation #4 (details)

Implementation considerations

Incorporate lessons learned from existing

privacy regulations, such as the CCPA and

GDPR, to create a more effective and

efficient framework

Ensure that the framework is adaptable

and scalable to accommodate the rapidly

evolving nature of IoT technology and the

data privacy landscape

Implementation barriers

Achieving consensus among

stakeholders on the most effective

elements and practices to incorporate

into the National Privacy Framework

Overcoming potential resistance from

industry participants who may perceive

new regulations as burdensome or

restrictive

Ensuring compatibility with existing

privacy regulations at the state and

international level
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #4 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

National Institute of Standards and

Technology (NIST)

Department of Commerce (DoC)

Federal Communications Commission

(FCC)

Federal considerations

The need for a balance between protecting

consumers' data privacy and fostering

innovation in the IoT sector

The importance of providing resources,

guidance, and support to businesses for

the adoption and implementation of the

National Privacy Framework

Regularly reviewing and updating the

National Privacy Framework to ensure it

remains relevant and effective in

addressing emerging data privacy

challenges and technological

advancements
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #5

Implementing US Federal Privacy Regulation

Recommendation

Develop and implement a

comprehensive US Federal Privacy

Regulation that addresses data

privacy concerns for IoT devices and

services

Create a unified legal framework

that supersedes state-level

regulations, providing clarity and

consistency for both consumers and

businesses

Justification

Streamlines and harmonizes data

privacy regulations across the nation,

reducing fragmentation and confusion

Ensures that IoT device manufacturers

adhere to a consistent set of privacy

standards, enhancing consumer trust

and protection

Facilitates innovation by providing

clear guidelines and expectations for

IoT businesses, fostering a competitive

and growth-oriented environment
 

 

 

Recommendation #5 (details)

Implementation considerations

Use information gathered from

stakeholders, including IoT device

manufacturers, privacy experts, and

consumer advocacy groups, on the

development of the Federal Privacy

Regulation

Consider state-level regulations to ensure

a unified federal regulation

Regularly review and update the Federal

Privacy Regulation to address emerging

data privacy challenges and technological

advancements

Implementation barriers

Overcoming potential resistance from

industry participants who may perceive new

regulations as burdensome or restrictive

Achieving consensus among stakeholders

and state-level regulators on the most

effective elements and practices to

incorporate into the Federal Privacy

Regulation

Ensuring compatibility with existing

international privacy regulations, such as the

GDPR, for businesses operating in global

markets
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #5 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

National Institute of Standards and

Technology (NIST)

Department of Commerce (DoC)

Federal Communications Commission

(FCC)

Federal considerations

The need for a balance between protecting

consumers' data privacy and fostering

innovation in the IoT sector

The importance of providing resources,

guidance, and support to businesses for

the adoption and implementation of the

Federal Privacy Regulation

Collaborating with international partners

to ensure global alignment and

interoperability of privacy regulations,

fostering global trust and cooperation in

IoT data privacy and security
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #6

Privacy Label Creation for IoT

Recommendation

Develop and implement a privacy

label system for IoT devices, similar

to nutrition labels on food products

(similar to the White House initiative

for cybersecurity labeling)

Display essential privacy

information in an easily

understandable format for

consumers, enhancing transparency

and trust

Justification

Empowers consumers to make informed

decisions about IoT devices based on

their privacy features and practices

Encourages IoT device manufacturers to

prioritize privacy, fostering competition

and innovation in privacy-enhancing

technologies

Enhances overall cybersecurity and

data protection by promoting greater

consumer awareness of privacy

practices
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #6 (details)

Implementation considerations

Consider input from privacy experts,

industry stakeholders, and consumer

advocacy groups to develop the

privacy label system, including content

and design

Develop guidelines and standards for

privacy labels, including required

information, format, and placement on

packaging or product information

Encourage or require IoT device

manufacturers to adopt privacy labels

and provide resources to help them

comply with the new requirements

Implementation barriers

Ensuring broad adoption and

compliance with the privacy label

system across different industries and

sectors

Overcoming resistance from IoT

device manufacturers who may

perceive privacy labels as

burdensome, costly, or restrictive

Balancing the need for comprehensive

privacy information with simplicity

and ease of understanding for

consumers
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation #6 (details)

Possible participating federal

agencies

Federal Trade Commission (FTC)

National Institute of Standards and

Technology (NIST)

Department of Commerce (DoC)

Federal Communications Commission

(FCC)

Federal considerations

The potential impact on market

competition and innovation if privacy

labels are perceived as overly restrictive or

burdensome

The need to educate consumers about the

importance of privacy labels and how to

use them effectively when making

purchasing decisions

Regularly reviewing and updating the

privacy label system to ensure it remains

relevant and effective as IoT technology

evolves and new data privacy concerns

emerge
 

 

Additional Recommendations to explore

Training (consumer & workforce)

International Agreements
QUESTIONS