Source: https://www.khlaw.com/California-Considers-Connected-Product-Security-and-Data-Collection-Notice-Requirements
Timestamp: 2019-04-25 04:43:43+00:00

Document:
California, the state that so often seems to strive to dictate policy for the whole country, is now considering a bill that would use reasonable-sounding goals to impose a heavy burden on connected product makers and sellers around the country. A state senator has proposed a bill to require the manufacturers of connected products to implement security measures and provide specific notices to consumers about information collection practices, among other objectives. The sponsor introduced the bill, S.B. 327, on February 13, 2017, styling it the "Teddy Bear and Toaster Act."
The bill itself is fairly simple, with only three sections. However, the requirements apply broadly to all connected products, meaning "any device, sensor, or other physical object that is capable of connecting to the Internet, directly or indirectly, or to another connected device." This language is so broad that it would apply to any device that is capable of connecting to the internet or to another device, including computers, toys, appliances, cell phones, and professional equipment. Even products such as Ethernet and USB cables potentially would be included, since they are, strictly speaking, "physical objects" that can connect to the internet or other connected devices and transmit information.
Manufacturers would be obligated to implement "reasonable security features" appropriate to the nature of the device and the information that it may collect, contain, or transmit. Devices would have to have an indication that they are collecting information, and would have to be designed to obtain consumer consent before "collect[ing] or transmit[ting] information beyond what is necessary ... to fulfill a consumer transaction or for the stated functionality of the connected device."
There are numerous standards and guidelines that businesses can and should consider in developing connected products, but reasonable security is a necessarily flexible concept that only makes sense in the context of the particular product, type of information, and potential risk it poses. The Federal Trade Commission (FTC) has pursued numerous enforcement actions against companies that failed to provide "reasonable" security. It, too, recognizes that the appropriate level of security will depend on specifics.
Requiring a visible indicator of data collection could force reengineering of devices where the nature of the device itself evidently involves personal information collection. For example, should a computer or cell phone blink when a user sends or receives an email? Although the bill lacks details on enforcement, in theory the bill could be enforceable by the state attorney general and local district attorneys through a parens patriae action. Individual consumer and class action lawsuits could even be permitted.
(COPPA) covers the online collection of data from children. The FTC has confirmed that it has jurisdiction over products or services that involve the collection of online information from children.
"establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children."
See 16 C.F.R. §312.3. These requirements are further detailed in other sections of the COPPA Rule, including §312.4 (notice); §312.5 (parental consent); §312.6 (right of parent to review personal information provided by a child); §312.7 (prohibition against conditioning a child's participation on collection of personal information); §312.8 (confidentiality, security and integrity of personal information collected from children); and §312.10 (data retention and deletion requirements).
Makers of connected products do need to consider privacy and security issues. However, this bill could discourage innovation, conflict with the federal children's privacy law, and increase litigation. Anyone making or selling connected products should pay close attention to the progress of this bill.
For more information on the implications of privacy and security legislation, or about the state of the connected product marketplace and the requirements of international, federal, and state authorities, contact Sheila A.Millar (+1 202.434.4143, millar@khlaw.com) or Tracy P. Marshall (+1 202.434.4234, marshall@khlaw.com).

References: §312
 §312
 §312
 §312
 §312
 §312
 §312