The Internet of Things (IoT): legal challenges

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

IoT devices: regulation that lags behind technology

The watch on your wrist knows when you sleep, what your blood pressure is, and where you are. The home camera knows when you are in and when you are not. The smart speaker listens to conversations. These are IoT devices: any physical device connected to the internet that collects, processes and transmits data. In Israel, millions of them are already working in homes, offices and factories.

The problem: growth is ahead of regulation. Israel has no legislation specific to IoT. The existing laws (privacy protection, consumer protection, tort law) apply, but how they are interpreted for smart devices has not yet been settled. These gray areas are what will reach the courts in the coming years.

Four legal questions that still have no clear answer

Liability for security problems: if an IoT device suffered an unauthorized data leak, who is liable? The manufacturer? The cloud service company? The homeowner who did not update the firmware?

Data protection: IoT devices collect sensitive personal data: information on sleep habits, access to the home, health. The law requires that this data be kept at a suitable level of security.

Consumer rights: you bought an IoT device that does not work as promised. What are your rights? The Consumer Protection Law, 5741-1981, applies, but enforcement against a foreign manufacturer is complicated.

Negligence in tort: if an IoT device causes damage, such as a software fault that caused physical damage, who can be sued?

Cybersecurity and IoT

Cyberattacks: IoT devices are a common target for attacks: unauthorized entry into the home, theft of information, and even disabling medical devices. A manufacturer’s negligence on security can be a tort.

Security updates: even without a dedicated statutory provision, stopping security updates can be taken into account in the question of the manufacturer’s negligence. A device that its manufacturer has stopped supporting but that is still connected to the network is a legal risk. On the side of whoever operates the systems, there is an explicit provision. The controller of a database must make sure that the database systems are regularly updated. The controller must not use systems whose security aspects the manufacturer does not support, unless a suitable security solution is in place (regulation 13(c) of the Data Security Regulations). “Database systems” are systems used by the database that are important for data security (regulation 1).

Encryption: regulation 14(b) of the Protection of Privacy Regulations (Data Security), 5777-2017, requires information from a database to be sent over a public network or the internet using accepted encryption methods. The regulations do not set numerical “encryption levels”.

The principle of least privilege: not every employee in the company needs access to all the data collected. Restricting access is both a legal duty (regulation 8 of the Data Security Regulations: managing access authorizations) and a risk management tool.

Laws and regulation in Israel

Protection of Privacy Law, 5741-1981: a person who collects personal information through an IoT device in order to process it in a database must, among other things, give a notice under section 11. They may use the information only for the purpose for which it was given (section 2(9)).

Protection of Privacy Regulations (Data Security), 5777-2017: they set three security levels (basic, medium, high), and reduced duties for a database managed by an individual (regulation 21), according to the type of information, the number of people in the database and the number of authorized users. Holders of databases, including businesses that use IoT, must meet the relevant level.

The European GDPR: if the manufacturer offers the device or service to people in the European Union, or monitors their behavior there, the GDPR applies (Article 3(2)), with fines of up to EUR 20 million or 4% of worldwide turnover, whichever is higher (Article 83(5)).

Ministry of Communications: in Israel, the Ministry of Communications can impose compliance requirements on IoT devices connected to communications networks. Connecting to a cellular network, for example, requires specific approvals.

Liability in tort claims

If an IoT device causes damage, who is liable? The central legal question:

• Manufacturer: if the device had a design or software defect, the manufacturer can be liable under the tort of negligence. If bodily injury was caused, it can be liable even without fault under the Defective Products (Liability) Law, 5740-1980 (חוק האחריות למוצרים פגומים, התש״ם-1980) (sections 2–3), which does not apply to damage to property or to purely financial loss.
• Cloud service provider: if the cloud service that manages the device failed, the service provider could be exposed to a claim.
• Device owner: if the owner of the device did not install known security fixes, or used the device contrary to the instructions, they could bear partial liability for the damage caused.

Privacy policy and IoT

A person who collects personal information through an IoT device must give a notice under section 11 of the Protection of Privacy Law: whether providing the information is mandatory or voluntary, the purpose of the collection, the identity of the controller, to whom the information will be passed, and the right of access and the right to correction. In practice, a privacy policy usually also sets out:

• Which data are collected, and when
• Where the data are stored (Israel? Europe? The US?), and on what basis transferring the information abroad is allowed
• Who can access the data
• How long the data are kept
• How you can ask to correct or delete the data (in Israel, section 14; a broader right to erasure exists under the GDPR, Article 17)

This policy should be accessible and understandable. The right of access itself is given in Hebrew, Arabic or English (section 13(b)). A click on “turn on”, with no explanation of what is collected and why, can hardly meet the requirement of “informed consent” (section 3).

Practical recommendations

For manufacturers:

• The principle of Privacy by Design: build privacy protection into every stage of development, not as an add-on after the fact
• Provide security updates throughout the life of the product. An end to updates must be announced in advance
• Be transparent about which data are collected and why
• Consider product liability insurance: the IoT market is attracting more and more claims

For consumers:

• Choose devices from manufacturers with a good reputation and a clear security policy
• Read the privacy policy before buying, especially the clauses on sharing data with third parties
• Update the firmware when security updates are available
• Use strong passwords and 2FA on every device that supports it

Frequently asked questions

An IoT device caused damage. Who is liable?

The manufacturer can be liable under the tort of negligence if the device had a design or software defect. If bodily injury was caused, it can be liable even without fault under the Defective Products (Liability) Law, 5740-1980 (sections 2–3), which does not apply to damage to property or to purely financial loss. The cloud service provider could be exposed to a claim if the service failed, and a device owner who did not install known security fixes could bear partial liability.

The device’s servers are abroad. Does the Israeli Protection of Privacy Law apply?

Yes. A person who manages a database in Israel is subject to the Law even when the server is abroad. Transferring the information from the database to a server abroad is subject to the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה), התשס״א-2001) (regulations 1–3).

The manufacturer stopped sending security updates. What does that mean legally?

Even without a dedicated statutory provision, stopping security updates can be taken into account in the question of the manufacturer’s negligence. On the side of whoever operates the systems, there is an explicit provision. The controller of a database must make sure that the database systems are regularly updated. The controller must not use systems whose security aspects the manufacturer does not support, unless a suitable security solution is in place (regulation 13(c) of the Data Security Regulations).

Does the GDPR apply to an Israeli IoT manufacturer?

Yes, if the manufacturer offers the device or service to people in the European Union, or monitors their behavior there (Article 3(2) of the GDPR). Fines under it reach up to EUR 20 million or 4% of worldwide turnover, whichever is higher (Article 83(5)).

Is pressing “turn on” on a device consent to the collection of data?

Not necessarily. A click on “turn on”, with no explanation of what is collected and why, can hardly meet the requirement of “informed consent” (section 3 of the Protection of Privacy Law). A person who collects personal information through the device must also give a notice under section 11: the purpose of the collection, the identity of the controller, to whom the information will be passed, and the right of access and the right to correction.