Source: https://www.cpomagazine.com/data-protection/secure-the-refrigerator-broad-new-california-and-oregon-iot-security-laws-come-into-effect/
Timestamp: 2020-08-07 12:14:26
Document Index: 178385548

Matched Legal Cases: ['§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798']

Secure the Refrigerator: Broad New California and Oregon IoT Security Laws Come Into Effect - CPO Magazine
Secure the Refrigerator: Broad New California and Oregon IoT Security Laws Come Into Effect
Chris Lyon and Hywote Taye· March 24, 2020
On January 1, 2020, California’s landmark new Internet of Things (IoT) security law[i] took effect. The first of its kind in the United States, this law attempts to address growing concerns about protecting the security of everyday objects that connect to the Internet (otherwise known as the “Internet of Things”). As the number of Internet-connected devices expands seemingly endlessly, ranging across refrigerators, doorbells, alarm clocks, cars, vacuums, and so on, commentators have raised concerns about the security of these devices. In the U.S., California has taken the first step to address this concern legislatively, followed by Oregon, but it seems other states may not be far behind.
The new California IoT security law applies to anyone who manufactures, or contracts with others to manufacture on its behalf, connected devices that are sold or offered for sale in California.[ii] The California law defines “connected device” as “any device, or other physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address.”[iii]
Notably, this California law is not limited to consumer devices. The definition of “connected device” appears broad enough to cover even devices intended for industrial or other B2B purposes. This breadth appears to be intentional, as earlier drafts of the legislation would have limited the law to devices sold to consumers. Oregon’s IoT law, which was modeled after California’s and also came into effect in January, diverges in this respect, as it limits its definition of “connected devices” to devices that are “used primarily for personal, family or household purposes.”[iv]
It is also important to keep in mind that these California and Oregon laws are not limited to devices that collect or process personal information. Rather, their obligations apply broadly to any such devices that connect to the Internet, regardless of what kinds of information they may process.
Both of these laws exclude providers of electronic stores, marketplaces, or other means for purchasing or downloading software.[v] They also provide limited exceptions for entities regulated by the Health Insurance Portability and Accountability Act (HIPAA), with respect to activity regulated by HIPAA.[vi] Oregon’s law also has an exception for activity regulated by the Food and Drug Administration with respect to medical devices.[vii]
Both California and Oregon laws require that connected devices be equipped with “reasonable security features.”[viii] According to both, the “reasonable security features” should be appropriate for the nature and function of the device; appropriate for the information the device collects, contains, or transmits; and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.[ix] Both states specify that a reasonable security feature may consist of a means for authentication from outside a local area network that has the following features: the preprogrammed password is unique to each device manufactured, or the device contains a security feature that requires a user to create a new means of authentication before accessing it for the first time.[x] Beyond this, neither provide clear guidance as to what else could constitute a “reasonable security feature.”
Other states have been actively considering similar laws, including bills proposed in New York, and Virginia. Although California’s Consumer Privacy Act (CCPA) has absorbed the attention of many businesses, it will be important for covered manufacturers to pay sufficient attention to this separate trend of expanding IoT security laws as well.
New California and Oregon #IoT #security laws will apply to all Internet-connected devices that collect and process any kind of information. #respectdata Click to Tweet
[i] Cal. Civil Code § 1798.91.04 et seq.
[ii] Id. at § 1798.91.05(c).
[iii] Cal. Civil Code § 1798.91.05(b).
[iv] ORS 646.607.
[v] Cal. Civil Code § 1798.91.06(b); ORS 646.607.
[vi] Cal. Civil Code §§ 1798.91.06(h), 1798.91.06(d); ORS 646.607. California also excludes activity regulated by its own health privacy law. Cal. Civil Code § 1798.91.06(h).
[vii] ORS 646.607.
[viii] Cal. Civil Code § 1798.91.04(a); ORS 646.607.
[x] Cal. Civil Code § 1798.91.04(b).
Internet of ThingsIoT SecurityRegulationsU.S.
Partner at Morrison & Foerster
Chris helps companies develop privacy and data protection strategies for new products and services, as well as privacy compliance programs for their customer and employee data. A trusted advisor, Chris works collaboratively with her clients to develop practical approaches that leverage data while complying with evolving global privacy and data protection laws. Chris’ clients span various industries for which data are vital to operations or business models, including technology service providers, hardware and software companies, pharmaceutical and biotechnology companies, and consumer product manufacturers.
Hywote Taye practice focuses on developing privacy policies and programs and counseling cross-industry clients on data breach preparation and response. Ms. Taye also counsels clients on privacy and data security issues in mergers and acquisitions and other transactions as well as issues relating to email and telephone marketing requirements. She also advises on compliance issues relating to the California Consumer Privacy Act (CCPA) and other newly emerging state laws.