Connected devices that can track our behaviour and surroundings – often collectively referred to as "The Internet of Things" – have the potential to make our lives more convenient and efficient, and even improve our health. But when those things are tracking us, they are also collecting a great deal of information about our location, shopping habits and other extremely personal details.
As the market for such connected devices grows, the Office of the Privacy Commissioner (OPC) of Canada announced Monday that it is joining a global study of their privacy implications.
The Global Privacy Enforcement Network – which is a joint effort among privacy organizations in many countries including the United States, the United Kingdom, members of the European Union, China, and others – is co-ordinating a worldwide "privacy sweep," examining connected devices. Canada's contribution, which will take place this week, will look at health devices such as sleep monitors and fitness trackers. The results will be announced in the fall.
"The Internet of Things" is a buzzed-about phrase that actually covers a wide range of technologies, including Internet-connected cars; "smart" TVs that connect to the Internet and sometimes include voice and gesture recognition; exercise trackers; home security systems; smart meters that monitor energy use in homes; and safety devices to allow elderly or disabled people to contact a caregiver if help is needed, provide medication reminders, and detect falls or other mishaps.
It can also refer to connected devices that have a distinct marketing purpose and are used in retail environments, such as systems that detect a mobile device with its WiFi turned on – even if the WiFi is not used to connect to a network – to track that device's repeat visits to a store and time spent there, among other information. Beacons that communicate with devices when their Bluetooth is turned on can perform similar tasks, and for those who have downloaded a retailer's mobile application, stores can communicate offers and deals to shoppers in real time.
A recent report by the OPC cited a number of predictions, including a Cisco Systems forecast that by 2020, the Internet of Things would represent a $15-billion market, comprising 50 billion connected devices; and a McKinsey Global Institute report that sales of sensors have grown by 70 per cent each year since 2010.
"However, all of these devices come with a privacy cost which may not be immediately apparent to those who choose to use them," the report stated. "As individuals will have their daily activities and behaviours measured, recorded and analyzed, there is a pressing need for developers and policy makers to turn their minds to informing consumers and citizens as to who collects what kind of personal information, how it is then stored, used and disclosed to whom and for what purposes."
The OPC will study how companies that make connected devices handle sensitive personal information related to a person's health. It will do this by using such products to check on how they collect information and whether that collection coincides with what companies say about their privacy policies. Researchers will also look at privacy information on manufacturers' websites and will be in touch with retailers, manufacturers and others who control that personal data to ask questions about how it is handled.
This is not the first time the OPC has taken part in a global sweep such as this. Last year, another worldwide study revealed that websites and mobile applications targeted to children often do not adequately protect those kids' privacy.
Canada's privacy watchdog has also conducted investigations into how technology has changed the way advertisers collect personal data about their customers. Last year, it looked at online targeted ads and found that a small number were delivering specific ads to people based on sensitive information – such as health or financial information. It also found that a program to allow consumers to opt out of such targeted advertising was inconsistent and not always user-friendly.
Now with the rise of connected devices, there are new implications for privacy.
"Given the sensitivity of the information, it is imperative that the companies behind such devices are transparent about what they collect, how the information will be used, and with whom the data will be shared," Privacy Commissioner Daniel Therrien said in a statement on Monday.