ICO issues warning over smart devices collecting personal data

The Information Commissioner’s Office (ICO) has announced a crackdown on connected devices, with plans for new rules and action to be taken against manufacturers who fail in their data security obligations.

The warning comes in response to a new report from Which? that conducted a detailed audit of connected devices, revealing that almost all required location data, despite this information not being key to the products’ functionality. The report revealed that some brands of speakers automatically share customer data with TikTok and Meta, to smart TVs that insist on knowing viewing habits.

The Which? report stated “Based on our testing, Chinese brand Ezviz’s devices, sold by major high-street retailers including Argos, had by far the most tracking firms active. These included Pangle (TikTok’s business marketing unit), Huawei, as well as Google and Meta.”

Every brand assessed by Which? used tracking services from Google, while Blink and Ring also connected to parent company Amazon. Google’s Nest product demands the user’s full name, email, date of birth and gender.

Andy Ward, VP International at Absolute Software, added: “Connected devices are the lifeblood of a modern workplace but are also a minefield when it comes to data security. The ability for malicious third parties to listen in, steal passwords and confidential information means that organisations should think first before implementing new devices that could present a major security risk.

“Key to this effort must be ensuring rigorous and regular cyber defences are in place, along with the ability to track, locate and freeze devices in the event of loss or theft.”

‘Myriad of security challenges’ 

ICO Chief Stephen Almond, Executive Director of Regulatory Risk said: “People should be able to enjoy the benefits of using their connected devices without having excessive amounts of their personal data gathered. This simply isn’t a price we expect to pay.

“To maintain trust in these products companies must be transparent about the data they collect and how they use it, and ensure that the data is not used or shared in ways that people would not expect.”

Cyber expert Oseloka Obiora, CTO of RiverSafe said: “It’s time to wake up and smell the coffee around the risks posed by smart devices, which bring with them both a data privacy and cyber risk. The rise of smart offices can create an exciting work environment, but open up a myriad of security challenges, from eavesdropping in the boardroom to offering a backdoor into the business for hackers to exploit. New devices should be approached with a level of caution, with data policies checked and confidential information properly protected at all times.

“The most effective defence against identity theft is personnel awareness. Strong and consistent cyber awareness programmes are crucial to minimising the opportunistic data privacy compromises,” he added.

Further reading: We spoke to Manish Mehta, Chief Product Officer of Ontic on why Cyber and physical security must validate their value in 2023

EBOOK: Lessons from IFSEC 2023 – Big Tech, Martyn’s Law and Drone Threats

Read IFSEC Insider’s exclusive IFSEC eBook and explore the key takeaways from the 2023 show!

Navigate the impact of Big Tech on access control, gain insights from Omdia’s analysts on video surveillance trends, and explore sessions covering topics like futureproofing CCTV networks, addressing the rising drone threat, and the crucial role of user proficiency in security technology.

There's also an exclusive interview with Figen Murray, the driver behind Martyn's Law legislation.

 

Get your copy today!