Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

Providers of ‘Internet of Things’ (IoT) devices recently woke up to the reality that, with one simple strike from the European Commission (EC), their products went from largely unregulated to being brought under full EU market control.



Providers of IoT Devices Have 2.5 Years to Implement Stricter Security and Privacy Requirements to Keep Access to the EU Market 

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

Providers of ‘Internet of Things’ (IoT) devices recently woke up to the reality that, with one simple strike from the European Commission (EC), their products went from largely unregulated to being brought under full EU market control.Using its delegated powers under existing EU regulations for radio equipment (therefore avoiding EU regulatory co-decision procedures), the EC brought IoT within scope, leaving IoT providers 2.5 years to adapt their products to comply with strict cybersecurity, privacy, and fraud prevention requirements in order to keep EU market access. EU market surveillance authorities will be able to take corrective action, order recalls, and withdraw products for non-compliance.   <h4>What is at stake?</h4>In 2017, headline news was that the ‘smart’ children’s doll My Friend Cayla, was so lacking in security that hackers could actually talk to children, record conversations, and determine their location. The German government recommended destroying the dolls (but preferably not in the presence of the children). Many similar hacks of smart devices have followed, including <a target="_blank" href="https://blog.checkpoint.com/2017/10/26/homehack-how-hackers-could-have-taken-control-of-lgs-iot-home-appliances/">smart washing machines</a> and <a target="_blank" href="https://www.cpomagazine.com/cyber-security/hacking-is-the-new-car-jacking-how-to-secure-vehicle-data/">remote car keys</a>, and the proliferation of IoT security vulnerabilities is <a target="_blank" href="https://www.itpro.co.uk/network-internet/internet-of-things-iot/360850/iot-devices-are-more-vulnerable-than-ever">well-documented</a>. Where radio equipment, including televisions, radios, and mobile phones are regulated, IoT devices fell out of scope. Instead of drafting new regulations, the EC took a clever shortcut, avoiding the EU regulatory co-decision procedure.In October 2021, the EC <a target="_blank" href="https://ec.europa.eu/growth/system/files/2021-10/C_2021_7672_F1_COMMISSION_DELEGATED_REGULATION_EN_V10_P1_1428769.PDF">adopted a delegated act</a> to the Radio Equipment Directive 2014/53/EU (RED), bringing IoT devices within its scope.The delegated act, which will be directly applicable in all Member States, will come into force after a two-month scrutiny period by the European Council and Parliament, which will then be followed by a thirty-month transition period. Accordingly, the new requirements will not affect products sold in the EU before this time. However, in the future, as a pre-condition for EU market access, manufacturers will need to design products which integrate minimum cybersecurity, privacy, and fraud prevention requirements.<h4>What is the existing framework?</h4>The RED established the regulatory framework for placing radio equipment on the EU market. It covers electrical and electronic equipment that can use the radio spectrum for communication and/or radio determination purposes, including, for example, televisions, radios, mobile phones, Wi-Fi, Bluetooth, and GPS products.It requires manufacturers, importers and distributors of radio equipment placed on the EU market to comply with essential design and manufacturing requirements for health and safety, electromagnetic compatibility, and in relation to the effective and efficient use of the radio spectrum. It also provides the basis for the further regulation governing network protection (Article 3(3)(d) RED), safeguards for the protection of privacy and personal data (Article 3(3)(e) RED), and fraud prevention (Article 3(3)(f) RED) set out below.<h4>What is the scope of the new requirements?</h4>The delegated act is applicable not only to the European industry, but to any manufacturer that intends to place a product on the EU market.In summary, the delegated act provides that Article 3(3)(d), (e), and (f) RED shall now apply to “internet-connected radio equipment” (as defined in Article 1 RED) which, subject to limited exclusions, must:(i) not harm the network or its functioning or misuse network resources, thereby causing an unacceptable degradation of service (Article 3(3)(d) RED);(ii) incorporate safeguards to ensure that the personal data and privacy of the users and subscribers are protected (Article 3(3)(e) RED); and(iii) support certain features ensuring protection from fraud (Article 3(3)(f) RED).In addition, with limited exceptions, whether internet-connected or not, (a) “wearable radio equipment”, (b) toys which are also radio equipment, and (c) radio equipment for childcare must also incorporate safeguards to ensure that the personal data and privacy of the users and subscribers are protected (Article 3(3)(e) RED).<h4>What is expected to be required of organisations in future?</h4>Although the delegated act does not set out technical measures to mitigate cybersecurity threats, it establishes essential requirements that must be followed in relation to the design and manufacture of certain radio equipment.Manufacturers will therefore have the flexibility to determine the specific technical solutions for the implementation of these objectives.  However, the EC is expected to launch a standardisation request to the European Standardisation Organisations to develop harmonised standards in support of the new requirements.The standards will be developed with industry participation and assessed by the EC against the essential requirements laid down by the legislation. Once established, these standards will provide a presumption of conformity with the delegated act. In any event, before placing their products on the EU market, manufacturers will have to assess conformity either by (a) performing a self-assessment (when a product has been designed in accordance with harmonised standards), or (b) relying on an independent third-party assessment body (regardless of whether or not a harmonised standard was used).We are grateful to Sakshi Rai, trainee solicitor, for her contribution.

Providers of IoT Devices Have 2.5 Years to Implement Stricter Security and Privacy Requirements to Keep Access to the EU Market