Smart devices, call for smart privacy

The information economy is upon us. Data brokers buy and sell, scoop and aggregate personal information.

In 2012, the U.S. Federal Trade Commission pegged the value of personal information products offered by just nine U.S. data brokers at $426 Million USD, and that’s not including Facebook. Personal information is big business. Where does all that information come from? Mostly given away by consumers for free.

In the leadup to December’s gift-giving season, I published a “naughty list” of smart devices for consumers to be aware of, reminding Nova Scotians to read the company’s privacy policy before buying these items as gifts. But does the world of the “Internet of Things” involve only consumers and corporations? What happens when a government, at any level, is the consumer? And who is ultimately responsible if the risks associated with these devices eventually materialize?

Products such as household door locks, video surveillance, baby monitoring, mirrors, stoves and more are marketed to consumers as convenient and sell the virtues of remote access. The Internet of Things connects intimate aspects of daily life to an internet network. Although smart phones, smart kettles and smart baby monitors are in the realm of households and individuals can choose to opt out (for now), what of smart meters, smart cities and smart law enforcement practices that involve governments either as the consumer or the developer?

Importantly, connecting these devices to the internet poses two simultaneous risks.

First, the devices can potentially be accessed by others, depending on the security vulnerabilities present in the device, weak security passwords and malicious hacking potential. Secondly, the information that is collected by the device is often sent back to the company and potentially on to third parties.

Overall, these devices exist in a largely unregulated digital world. This gives the company free access to intimate personal information that has serious value in the information economy. Unaware consumers may be giving their personal information to profitdriven companies to do with as they please, sometimes as the result of participating in a government program involving one smart technology or another.

In recognition of Data Privacy Day, Jan. 28, an international effort to promote data and privacy safeguards, it’s time to really take stock. Maybe you received a smart gift. Maybe some level of government has launched a new service using smart technology. Have you read the privacy policy? Do you know what the device is capable of, how it could provide access to other devices on your network, and what information is being scooped, stored and shared?

Here are some questions to ask yourself about some of the common personal information- collecting products out there. Does that doll or toy record audio or video of your children while they play? Who has access to that recording and how long will it be kept? Before you send your DNA to that genealogy company, do you know if it will sell it to someone else or use it for another purpose? Before you walk past a smart park bench or throw away your garbage in a smart garbage bin, do you know what information it is recording and sending back to the parent company and why? Is your smart home hub or smart television recording your conversations? Are the passwords for your smart baby monitor, video surveillance system and smart kettle complex and secure or are you using the default passwords? Are governments doing enough to regulate what companies could do with your data? And when will it be too late for governments to take action to protect personal information?

Security expert Bruce Schneier warned, “...when the Internet actually starts killing people there will be a call to action.” But let’s make sure it doesn’t come to that – we don’t have to abandon our right to privacy or security to take part in modern innovative technology. We need to demand better from companies offering tech devices.

In the new information economy, people’s lives, identities, activities and choices are the prod- uct. Consumers need new skills and knowledge to take advantage of the best that technology has to offer without inadvertently becoming the profit object.

Governments have important roles to play as well, including modernizing existing privacy laws to keep up with the new information economy and associated risks, regulating corporations’ use and collection of personal information, and ensuring that any use of smart technology by government is used only for the best interest and with the full engagement of citizens.

Companies are not all equal when it comes to protection of privacy.

Being knowledgeable and demanding the protection of your data from companies is in your hands. Sometimes this means choosing the company that has a strong commitment to privacy demonstrated by a clear statement written in plain language.

Sometimes this means recognizing that a smart device might not be offering anything of real value; it’s a shiny new toy of distraction whose real purpose is to collect your personal information. And sometimes, this means asking the relevant level of government what it is doing to protect individuals from these privacy and security risks? Consumers have the power to make privacy the smart business choice for tech companies. It’s time to take control.

Catherine Tully is the Information and Privacy Commissioner for Nova Scotia.