Legal Dynamics In A Connected World

In the age of the Internet of Things (IoT), laws will have to be forward-looking to adapt to fast evolving technology...

The Internet of Things [IoT] and 'Big Data' are the most discussed technological developments in present times.

IoT can be understood as a network of networks, which seeks to seamlessly connect the physical and virtual worlds through a unique system of identification codes, chips, sensors and other technology powered by the internet. In the IoT world, all gadgets, objects, animals, appliances and machines could be connected to the internet through multiple device platforms, thereby making objects, machines and devices 'smart' i.e. devices that are capable of interaction not only with other 'smart' devices connected to it but also humans, thus narrowing the gap between the physical and virtual worlds. Imagine a 'smart' alarm clock, programmed to our phone's calendar that senses that an early breakfast meeting has been cancelled and reprogrammes itself to wake us up, an hour later!! Imagine a 'smart' coffee machine that will connect to our refrigerators to pull ingredients and make us our favourite coffee!!

Imagine driving a car with the aid of technology and no driver!! The Internet of Things makes all this possible. With the IoT we are looking at a whole new digitised world in times to come. Though, for most of us today, IoT is still a myth, the current projections by Cisco estimate the number of connected devices to touch 50 billion by 2020 making IoT a very near reality.

Analysts at the McKinsey Global Institute predict that IoT is expected to create an economic impact of $2.7 trillion to $6.2 trillion by 20251. Therefore, it comes as a surprise that till date there is no dedicated legislation to regulate the functioning of the new trillion Dollar economy that could impact the health, safety and lives of billions of people.

As the number of connected devices powered by IoT technology increases, there will be a massive increase in the data generated from such devices. This will give rise to the concept of 'Big Data'. According to the Oxford English Dictionary, 'Big Data' refers to "Extremely large data sets that may be analysed computationally to reveal patterns, trends, and associations, especially relating to human behaviour and interactions:"2

These two intimately connected concepts are set to transform many areas of our daily lives and business. Governments and Enterprises will be faced with the challenge of managing enormous volumes of complex, structured and unstructured data. As technological development permeates further in our society, there are bound to be legal and regulatory issues.

In this paper, we aim to touch upon the issues associated with a hyper connected future:

Standardisation

It has become critical to have an international framework of standards within which IoT devices and applications can securely exchange data over wired and wireless networks. There is a need for uniformity in various standards in an IoT environment. One such umbrella organisation working in the area of developing standards for IoT and M2M (Machine to Machine) platforms is OneM2M, a partnership with eight international standard bodies, including TDSI (Telecommunications Standards Development Society, India).3 India should strive to forge more partnerships with other international organisations working in developing standards to look into issues of the IoT architecture such as: communication, security solutions, quality of devices used, mapping, uniform protocol amongst others.4

Privacy and Data Protection

Privacy is of paramount concern in the IoT world.

IoT technology makes it possible to place chips inside a device or an individual's body to transmit and record personal information related to health, preferences, location, habits etc. into remotely placed servers creating a platform for potential misuse.

Businesses are also at a huge risk with instances of data theft and hacking on the rise. As the technology for transmitting, receiving, storing, retaining data in the Cloud develops, there is a critical need for Cloud computing standards, Service Level Agreements (SLAs), Certifications, stronger contract laws and related Data Protection regulations.

The government has rightly proposed 'Cloud lockers' and 'Cloud godowns' to address these issues. We are hopeful that in times to come, the government will explore solutions that will address the issues of privacy, security and liability associated with the concept of Cloud computing.

The world of IoT could also be very intrusive. Therefore, it becomes important to protect an individual's right to opt in or opt out of the IoT network. It becomes even more important to educate the customer about the risks of IoT like; potential cyber-attacks, misuse and leak of sensitive information etc. to enable the customer to make an informed decision.

Liability

Since IoT creates a connected environment to make things 'smart' it is bound to increase our dependency on machines as the interactions between humans and machines increase phenomenally. The pertinent question that arises here is who will be responsible in case the machine/IoT devices fail? The answer, is not as simple as shifting the burden to the manufacturer unless defined under the contractual terms. With the rise in IoT, there will be an inevitable blurring between what is public and private. For example, Indian Government's Digital India plan, contemplates citizens to have a private space in a Public Cloud. This private space is where a person may store private and sensitive information. In such a case if the server fails, who will bear the liability for the information leak? Will it be the government? The operator? Or the manufacturer? Some countries in the US have already adopted legislations for driverless cars powered by IoT; the US state of Nevada is one example. A driverless car is a car that can react to the environment for example traffic, fuel, weather etc. based on IoT and Robotics. However, the question that arises here is what happens if the car meets with an accident? Who bares the liability? Will it be the government or the software company who operates the transportation, the manufacturer or the insurance company? IoT regulations would need to define liability in unambiguous terms for the various verticals involved in its working.

Ownership in the network of networks

Another legal question that arises here would be; who would 'own' or be the safe-keeper of such large volumes of data that has been stored, processed, monitored, transmitted and received? Though India has adopted regulations that define the liability of various internet players, e.g. Liability of internet intermediaries under the Information Technology Act, 2000, the same is not sufficient in this context as IoT involves a larger number of participants' e.g. the manufacturer of devices, the internet intermediary, the software developer, the operating company etc. Regulations will be required to define the responsibilities and liabilities of each of these participants in the IoT world. The Federal Trade Commission (FTC or the Commission) in its Report on the 'Internet of Things - Privacy and Security in a Connected World', published on January 2015 recommended the concept of 'Data minimization' to guard against 'data thieves' and prevent potential misuse of data. 'Data minimization' is a concept that limits the collection and retention of data by companies from participants to minimise the risk associated with the collection and retention of data5. Regulations of such nature may be explored by Indian legislators as well.

Changing nature of crime

In the past few years, the world has witnessed a rise in the unlawful activities taking place in the digital space and measures to counter cyber crime have been one of the top priorities of the international community. In the recent report released by the US National Intelligence on the Worldwide Threat Assessment6, 'Cybercrime' topped the list of potential threats calling for attention from the international community. With the advent of the IoT, there will be a change in the nature of offences and related consequences. Miscreants will not only target the identity of the individual by hacking into personal email accounts, bank accounts etc. but will also target the connected devices or machine to eventually retrieve information. As a result, the scope of our internet regulations should be wide enough to address the changing nature of crime in the digital space.

Management of bandwidth

With IoT, there will be an enormous amount of traffic from multiple sources requiring additional amounts of bandwidth, high internet speed, congestion free and efficient networks. The government should hence, create a framework that addresses issues such as scarcity of spectrum, pricing of spectrum, minimum Quality of Service (QoS), transparency, traffic management and commercial arrangements while fully supporting net neutrality and customer needs.

The Internet of Things calls for an exciting yet challenging era. There is no better time than now to develop legislations to regulate this technological revolution. India has a Draft Policy on the Internet of Things, as well as an M2M (Machine to Machine) Roadmap. While this effort is highly appreciated it is important that the laws framed eventually, are forward looking and adaptive so as to meet the legal dynamics in a connected world.

1 http://www.mckinsey.com/insights/high_tech_telecoms_internet/the_internet_of_things_sizing_up_the_opportunity;
2 Online edition of the Oxford English Dictionary;
3 http://www.telecompaper.com/news/onem2m-welcomes-globalplatform-tsdsi-a s-partners--1080785;
4 http://www.onem2m.org/news-events/news /53-the-rise-of-the-machines-world-s-first-global-standards-for-m2m-deployment;
5 'The Internet of Things-Privacy & Security in a Connected World', FTC Staff Report, January 2015;
6 'Statement for the Record Worldwide Threat Assessment of the US Intelligence Community Senate Armed Services Committee', February 26, 2015

Disclaimer - The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official position of the Firm.