Internet of Things laws in Canada, the U.S., U.K. and EU

Edona Vila

Welcome everyone and thank you for joining us in our emerging webinar series with today’s discussion focussed on the developing IoT law across jurisdictions. For today’s discussion we’re joined by two product liability and product safety lawyers, Rachel Raphael of Crowell & Moring to provide the U.S. perspective and Katie Chandler of Taylor Wessing to provide the U.K. and EU perspectives. I’d like to introduce both panelists formally but I see, or you see, also, on your screen, you’ll have their contact information as well. My name is Edona Vila, and I’m a partner in the Toronto office at BLG, focussing on product liability and product safety generally, although most of the time I’m a litigator in relation to product disputes.

But in terms of our panelists today, I did want to say a few words, so you get to know them a little better. Rachel is a Partner at Crowell & Moring where she’s a member of the firm’s Mass Tort Product and Consumer Litigation and Product Risk Management groups. Rachel advises clients on a range of consumer products’ issues with focus on product safety and regulatory compliance. Rachel’s practice focuses on a broad spectrum of complex commercial, consumer and retail litigation, including defending class actions and multi-district litigation.

Now I’d like to introduce you, Katie. Katie is a Partner, as I said, at Taylor Wessing. She’s based out in London, U.K. She leads the Product Liability and Product Safety team in the U.K. at Taylor Wessing. She’s a litigator with broad experience in the technology, life sciences, automotive, consumer and retail, and food and drink sectors. Katie regularly works with clients in the technology sector with a focus on emerging technology such as automated vehicles. That’s one connected asset that we have in common, Katie; 3D printing and Internet of Things, that’s very apropos for today’s discussion.

So just to provide a bit a roadmap of our discussion today, we’ll canvass two segments. In the first segment, we’ll discuss a little bit the current state of IoT law across jurisdictions in the U.S., U.K., EU and Canada and for the second segment, we’ll focus on compliance issues, compliance challenges and best practices for businesses deploying IoT solutions across borders.

So without further ado, we’ll start off with our first segment on the current state of IoT law. We’ll engage in a level setting, if you will. So perhaps Rachel, we’ll start off with you, our neighbours to the south, who are the recipient of much of the Canadian smoke issues right now with the wildfires (laughing). Switching gears in terms of the current state of IoT laws, what’s brewing in your jurisdiction?

Rachel Raphael

Sure. So, in the US there are not many policies at the Federal or State level that are focussing on regulation of IoT devices more generally. There are some states that have adopted IoT specific security laws. One of the first adopters of those, frankly not surprising, is California. California’s IoT law was enacted at the beginning of 2020 and imposed a security requirement for manufacturers’ of connected devices. Requires those devices to be equipped with certain security features, all tailored to the nature and function of the device and the information it collects. And there are also several industry standards out there that provide guidance. You have ASTM, the standard guide for ensuring the safety of connected consumer products which provides guidelines for different things like remote updates or software and firmware, configuration risk and certain cybersecurity controls. You also have an organization called Underwriters’ Laboratories here in the US that have an IoT security rating. So it’s an evaluation process that rates certain smart products on common attack methodology with various levels of security ratings.

So, you know, despite the kind of relative lack of regulation, there are some industry actors as well as some states that kind of set the floor when it comes to the standard of care here.

Edona Vila

Very helpful. Moving across the Atlantic, we’ll go to Katie with sort of the state of play in the U.K. and EU in respect of IoT law generally and specific regulation or legislation around IoT.

Katie Chandler

Sure, so, I mean at the moment, it does still derive from EU law predominantly and post Brexit, you know, there have been some changes and there are some new laws coming which will separate the sort of U.K. regime from the EU regime. But, for the purposes of this, I’ll sort of broadly talk about them as, you know, a marriage, still a marriage. This really, it’s a hodgepodge of laws and regulations that come from the sort of general umbrella legislation for data protection. So many of the safe processing activities involved in IoT will fall within the space of the general data protection regulation and you know, IoT devices can process personal data, so you know, IoT providers have to ensure that they are complying with those requirements under the GDPR. Cybersecurity is obviously another key feature and there’s a whole raft of legislation and EU legislation and that which then is commenced in the U.K. to, you know, try and regulate the cybersecurity risks in relation to IoT products outside the Security Act. Ummm we’ve got the NIS2 Directive which sets out particular cybersecurity standards and obligations on instant reporting and other particular obligations on digital service providers and then we’ve got some proposals coming down the pipe for the Cyber Resilience Act which is on the horizon and it’s aiming to focus security on hardware and software and particularly the software with digital elements. So we are talking about smart home devices as well. Not entirely clear at the moment when that will come into force but, you know, we’re probably looking at the next couple of years.

And then on the sort of product safety side, there has been a very recent development which is the introduction of the new proposed General Product Safety Directive. Now, this is European legislation. Post Brexit it won’t be directly applicable in the U.K., but basically it’s a re-work of the General Product Safety Regulations which are currently in force to bring it up to date with the digital age and advancements in technology and to expressly refer to and cover those products where a physical product meets a software and connected element to it. The text of the new General Product Safety Directive was approved only a couple of weeks ago and it is now admitted into EU law and will be applicable by the end of next year. And just sort of at a very high level and I know we’ve got lots to discuss today, it covers those products that are not caught by sector specific products. And so you’ve got medical devices that fall under the European Legislation of the Medical Devices Regulation, you’ve got toys that fall under the Toy Safety Regulation, cosmetics, other products. The General Product Safety Regulations and now the new General Product Safety Directive is a sort of over-arching protection in respect of the general consumer product. But why it’s interesting, is it has now, you know, sort of grapple with some sort of framework around the safety of IoT products. The Medical Devices Regulation has done that as well and the updates to that in 2021 were to make it clear that any conformity assessment and marketing authorization for a sort of digital health product that was incorporating IoT, was going to fall within that regime and, but as I say, some of the other legislation hasn’t quite caught up.

But just really briefly, what the General Product Safety Directive is now expressly providing for is, you know, interconnected products. So where there is a product that is interconnected to other items and then, you know, it falls under this regime and it also seeks to expand aspects of how you assess the general safety of that product. So you would look at the warnings, the labels, the instructions for use. But now this new legislation is specifically including the effects on other products where it’s reasonably foreseeable that it will be used in other products. So again this is going to the interconnection point, the effect that other products might have on that product where it’s you know, being used or, you know, including sort of, the effect of non-embedded items, what’s the effect of cybersecurity features and potential malicious third party risks, what’s required to protect the product and it’s safety, if there are evolving learning and predictive functionalities, so this is of relevance, to it’s AI system. And really importantly, what’s the state of the art and technology that is sort of applicable for the opinion in terms of understanding the safety of that product. So a real shift and move towards getting it up to date. And I’ll just say very briefly, it’s not going to apply in the U.K. because of Brexit. But our product safety, our product of safety standards is conducting its own assessment and review of the current regime because the general understanding and view is that these existing laws are very old and that this particular legislation is 20 years old. We’ve got product liability legislation that is 35 years old. Doesn’t necessarily cover IoTs.

Edona Vila

That’s very interesting and a perfect segway into my next question and just briefly for those tuning in and certainly from a Canadian perspective, we don’t have IoT specific legislation yet. Very much of us are of a piece meal approach of regulating IoT solutions across Canada, but we do have an interesting development when it comes to AI specific legislation that dissipated to also cause some amendments to our consumer product legislative framework when it does it come into force. It’s not anticipated to come into force any time soon. Any time soon being this year, it’s just making its way through our federal system right now. I think its just passed second reading and so it will be interesting to see in terms how we move in our jurisdiction, but certainly our AI regulatory framework is anticipated to impact those IoT solutions that are AI empowered, and have those AI features through them. In terms of positioning it seems like we are positioned at least for the proposed AI regulatory scheme, somewhere in between where the EU is and where some U.S. States are. very much how Canada moves in this space, so perhaps not completely surprising. So just tagging along in terms of the next piece, Katie you touched on this, so maybe I’ll switch gears with U.S. perspective with Rachel, but is there a gap, Rachel, in the current regulatory framework in the U.S. in regulating IoT and if so, how is it being addressed?

Rachel Raphael

Sure and I’ll say, you know that I’m obviously speaking given my background from the interconnective products’ product safety lense, when I talk about this and that kind of informed my prior answer which you know, was the point that like Canada I think it’s really been left up to the States thus far and it’s a bit of a patch work. So given the lack of some kind of uniform regulation there are some gaps to fill. I do think that IoT products and the risk associated with those products are certainly on the radar of many U.S. regulatory agencies and that includes the Consumer Product Safety Commission and the Federal Trade Commission, the National Highway Traffic Safety Administration and the FTC in the U.S. remains, kind of the nation’s lead  data security and private enforcer at the federal level, and its view of those issues has significant ramifications for the companies that make, distribute and sell internet connective products but companies are kind of largely left to cobble together much of the guidance by looking at what States have done and looking at you know, past enforcement actions for example. I think we are slowly working towards something that is considered universally acceptable and that’s where kind of filling in the gap fits in. Very recently in April, guidance was published by the Cybersecurity and Infrastructure Security Agency along with FBI, NSA and other cybersecurity authorities around the world that are a step in that direction. This guidance is called shifting the balance of cybersecurity risk and it’s the first of its kind. It outlines several core principles to guide software manufacturers when they are building software security into their design processes prior to developing, configuring and shipping their products. I think historically it’s often been kind of thought on as an add on or an after thought and the idea of this guidance is to make integral, kind of an each stage of the development process. And there are a couple of core principles that I will just mention briefly. The first is kind of taking ownership of the security outcome. So you know, security should be the baseline, is the idea, and products should automatically enable the most important security controls that are needed to protect, you know the product, the information that they collect, etc. from kind of malicious cyber actors. Another principle has to do with embracing transparency and accountability and also building the right organizational structure even from the executive level on down, that prioritizes software security as a critical element of product development. And then as mentioned kind of the theme of the guide codes that this new guidance sets out is integrating security as early as possible into that design process for IoT connected products.

Edona Vila

Thanks Rachel, and Katie I know you touched briefly on this but what are you seeing in terms of gaps in your jurisdictions. I appreciate you covering the EU perspective as well, and whether it is … are you seeing sort of a more siloed approached to regulating different types of connected assets in terms of what’s, what’s currently circling?

Katie Chandler

So EU is pretty, well it’s moving pretty fast, I would say and the U.K. is slower. In terms of the gap, there is, I’m just leaving data protection aside and potentially cybersecurity there’s quite a lot coming down the pipe on that. But like the liability framework is where there has been real gap and the uncertainty that comes with whether or not they can see the safety laws as they currently stood applies to IoTs and you know what sort of liability regime would they fall within, because of course, the question of liability are complex. You know there’s the risk of third-party involvement, who can hack and access the IoT and cause a problem which might lead to harm. There’s the design defects and design security flaws that Rachel was just discussing and there’s also potentially what the customer and user might do that might lead to any sorts of damage and or any sort of failure and of course you know the updates that the software developers provide of course. So all of these sort of questions of liability really haven’t been dealt with and whilst the general product safety directive that I mentioned goes some way to addressing the sort of safety regime, the liability regime is still very much unclear and the product liability directive which is the EU legislation and is implemented in or locally among the member states and in the U.K. is implemented under the Consumer Protection Act and does not necessarily, as it currently stands and it’s five years old, cover IoTs because the IoTs are, they are not mutable tangible goods, so you’ve got IoTs that are ecosystems, that you know have got a lot of range of elements and you know some embedded into hardware, some not. So the big question around software and what the software falls within the existing product liability regime, has been one that has been debated heavily. But just very briefly, being conscious time, what has happened in the EU is that they are taking this very centralized approach to the liability framework for IoTs, for AI integrated systems and looking ahead for whatever the future may hold in relation to advanced technologies. They have currently going through the European parliament is the AI Act and I won’t talk about that in detail today because we are focusing on IoTs, but there’s the AI Act, there’s the AI liability and directive which is being proposed which is the first of its kind and then there is a entirely new draft of the Product Liability Directive. That will not apply to the U.K. post-Brexit but it’s very important for any company who is placing products in the EU market, its currently going through the European parliament for debate, and there might be some changes, but the general mood is that it will probably stay as proposed in the draft, by and large … there might be some amendments, but that could come into place as soon as sort of the next 18 months to 2 years, but getting the crux of why that’s important is that that’s a strict liability regime so a consumer who suffers harm from a product, doesn’t have to establish faults or negligence on the parts of the manufacturer or, now in the new case, in the new draft, the software developer or other third party that has been involved in the design of the product, and they just need to establish that it was defective and some key changes that the new PLD by way of update, are bringing in, will put IoTs and tech and companies firmly into the scope of that strict liability regime. Digital products are going to be, you know now in scope by way of widened definition of product, so software will be caught and it’s defined and includes embedded or standalone, it includes AI systems, digital manufacturing, like 3D printing, digital services such as navigation services in autonomous vehicles for example. So that’s going to be proposed because the definition of products is going to be widened to some real extent. The expanding definition of what damage is covered is really relevant as well because at the moment, you’re liable if your defective product causes death or personal injury. The proposed amendments are suggesting that that should be widened to include losses that arise after the loss or corruption of data. Personal injury could also include some sort of psychological health, some sort of impact that it might have had on your mental health, and that sort of brings into debate some interesting questions around children’s products, for example, where you’ve got a connected toy device of some sort or something where there is some element of loss of data that also causes some sort of physical health impact. And there’s a massive question mark as to whether or not that’s going to cross over with the GDPR and what really is this regime going to look like, which route is this regime is going to take. And then finally there’s a new definition of “defectiveness” which is going to firmly bring in an assessment of whether complex systems like IoT devices were safe as a consumer was entitled to expect. It’s an objective sort of safety test at the moment but it’s really challenging in the context of IoT’s because the consumers do not know much about the software behind the IoT’s. It’s really difficult to decide whether there are devices functioning properly and these can sometimes act autonomously, make it really hard to describe what sort of level of safety is that should be expected. And then because of all these difficulties with trying to establish for the consumer to bring their claim, because we’re talking about complex products, they are suggesting a radical change, and this is quite significant for European clients and European companies because they don’t have the regime of disclosure and discovery like we do in the U.K. and the U.S. There’s going to be an obligation on manufacturers to give disclosure of some documents around the solutions and potentially trade secrets, confidential information that they will have to be protected for in some way, but the legislation is currently drafted. It’s not at all clear on that, but this is, in a way it’s a really important questions about the party data, other sort of potential data that’s embedded in the IoT, so that is a real change and that’s really sort of caused a lot of debate from stakeholders, so it’s a bit of watch this space on that, but the liability framework which is being developed by the EU and the European Commission is really sort of moving at some pace so everybody who have products that they market in the EU market should be well aware of those.

Edona Vila

That’s fascinating in terms of comparing different jurisdictions because for our next segment, we’d really like to focus on really these compliance challenges for certainly companies that have products that pass borders and in this particular regulatory framework and developing liability frameworks, what’s your… we’ll go to Rachel first. Rachel, what are the top sort of, maybe I wonder if you can combine both sort of the challenges but also the best practices in terms of how to best solve for those challenges for companies that operate across various borders?

Rachel Raphael

Of course, of course. So I guess being consistent with what I’ve spoken about today. You know, the biggest challenge for companies really is where to look. Right? We have some developing standards out there related to IoT products, its the one I’ve just described but there are, really the lack of anything that’s considered universally acceptable, is I think the biggest challenge and it leaves companies guessing a little bit as to the best path forward and it presents a unique risk, particularly, in my mind, as a litigator, for product liability base claims that are probably next on the list. For those that are premised on some violation of a duty or the inability to satisfy some standard of care, not knowing what that standard of care is, presents some really unique problems for companies. And we’re seeing some real indications coming out of some of our sources of guidance like the recent FTC enforcement, that agencies are serious about putting the onus on the actor who’s in the best possible position to ensure the safety of these devices. And kind of in the same spirit as the recent guidance that I mentioned earlier, these themes of transparency and accountability and structuring your organization around prioritizing security in your products. You have the FTC holding executives of companies, kind of individually and personally responsible for failure to implement certain security practices. Requiring them to comply with certain obligations whether they stay at that company where there was that data breach or not. One helpful example, is not in a IoT specific context, but in October, FTC took action against an online alcohol marketplace called Drizly and its CEO for violations of the FTC Act that prohibits unfair deceptive practices because the allegation was that the company was making false statements about certain practices when it actually had inadequate security that has led to prior data breaches. And what was really unique about this recent enforcement action was that Mr. Rellas, the CEO, is being named personally, and it alleged that he was responsible because he was the one who could have implemented or delegated the responsibility to implement security practices and he failed to do so. He didn’t hire anyone at a senior level to kind of implement these steps. And so the FTC proposed in its order, the order would require not just the company to implement and maintain security programs but actually for Mr. Rellas personally to do that, and these obligations would travel with him even if he left Drizly which I thought was really interesting. So it’s clear that this is a priority and the idea being of who’s best situated, that’s who should bear the brunt of the liability and the obligation to kind of bring products into this next generation and secure them. Again, the vulnerability that we now face in this evolving environment, and I’ll just say really briefly because I know we’re really short on time, but in terms of best practices to solve these challenges, I think there are a number of ways that companies can try and stay one step ahead in what really is kind of a constantly evolving environment, both in terms of the technologies and the products that are being developed, and in terms of the regulatory landscape. But it has to do with, first it’s your compliance and litigation readiness effort, it’s enhancing compliance programs to account for kind of evolving product liability. There really is a potential for more product liability lawsuits. We haven’t seen a lot of that in the US, and everyone from the in house legal team to the folks who design the products need to know from a design perspective what the potential failure modes are to products and be able to show that the company went through those issues prior to launching. And the legal department also needs to stay in the loop about product design and maintenance decisions because it’s working together that the company, kind of more holistically can try and ensure that safety and liability issues are understood and then if possible, dealt with. I think adapting written information security policies that incorporate IoT products are incredibly important. Taking advantage of the technology, everyone from the legal team to your engineer should understand exactly how these products collect and disseminate data. Be prepared. Have an internet response plan that spells out exactly what folks should do and train your employees as to how to carry that out. Keep learning. So companies should be playing devil’s advocate, putting themselves in the bad actor’s shoes. Who would be interested in that? What would they be looking for? And just better understand the risks that you face. And also learn from experience of others, your peers. Maybe take a little pleasure at others’ misery but try and keep up, right, with other breaches that are publicized and learn from what went wrong there, even if you haven’t … if you’ve been lucky so far. It’s frankly only a matter of time in some circumstances.

Edona Vila

Thanks Rachel, because that summarizes what I would say from a Canadian perspective. Katie, any parting thoughts in 30 seconds or less?

Katie Chandler

Yeah, I would really agree with all of that and it’s also highly relevant to EU and U.K. as well. Yes, its just I think simply … I mean warnings and IFU’s and just thinking about your labelling and all of that, it’s just the difficulty is obviously in making sure that it’s consistent to meet regulations and standards across the different jurisdictions if you are a global product, fine and your product is being placed in different jurisdictions. There are different levels and as you’ve seen the EU has got some quite stringent regulation now that may affect some of your IFU’s and instructions and warnings.

Edona Vila

Thank you both of you. I really enjoyed our discussion today. I think we could go longer. Thank you to everyone joining us today and the BLG crew for facilitating this third webinar series. For those of you that have missed the AI and the Metaverse webinars, let us know, we’ll make sure you get the recordings. And sorry we didn’t have time to address questions but if you have any, feel free to reach out. Thank you all, have a great day.

Katie Chandler

Bye.

Edona Vila

Bye-bye.