Aliza Hassine Blog Post – ILI Student Blog

Aliza Hassine

Information Privacy Law

Professor Ira Rubinstein

February 28, 2017

The Impact of the “The Internet of Things” on Consumer Privacy Policy

For the past decade, numerous technology companies have developed products that have ushered in the era of “the internet of things.” “The internet of things” (“IoT”) is the concept of “connecting any device with an on and off switch to the Internet and/or to each other.” On a simple scale, IoT allows for the transfer of information between personal electronic devices and the like. However, the goal behind IoT is that it will eventually extend beyond the personal and reach mass networks. The implications of the expansion of IoT has most recently been seen with Amazon’s Echo device.

At the end of 2016, the Arkansas police department issued a warrant for Amazon to hand over information from an Echo device for purposes of a murder investigation. Amazon refused and formally responded to the request last week. In their response, Amazon stated that they had already provided information regarding the suspect’s purchase history and any further information would be in direct violation of consumer privacy rights. This case is far from being resolved and has sparked much debate regarding IoT and the current state of consumer privacy law.

The Amazon Echo is an internet-connected home assistant device that is able to sync with licensed third party products. It is always on and is “continuously recording local audio sounds.” The audio files are then stored in the cloud on servers where they are analyzed for purposes of improving the product. The Echo is always learning and updating in order to better function for its individual user. The recent Arkansas murder investigation and the warrant issued by the police has led many to question the potential privacy risks associated with “always-on” in-home devices such as the Echo, as they amass a tremendous amount of personal user information. The primary fear associated with data collection in-home products is that government agencies may argue that they do not need warrants to access this kind of data, thereby, threatening already established constitutional protections regarding the home.

In-home devices and always-on technological products present issues for the protections against unreasonable searches and seizures under the Fourth Amendment. While the Supreme Court has emphasized the protections associated with the sanctity of the home, it has not yet determined whether the home encompasses the smart home. Complicating matters further is the third-party doctrine, which holds that any information provided to third parties receives little to no protection under the Fourth Amendment. This extends to information given to a company “confidentially and on the assumption that it will be used only for limited purposes.” In some cases, Congress has chosen to protect third-party collected information through the Wiretap Act or Stored Communications Act, however, a warrant may circumvent those protections. As previously stated, a warrant was presented by the Arkansas police department, but Amazon has still refused to hand over the information.

Amazon recently stated that they are refusing to turn over the requested information because of the overbreadth warrant; “Amazon objects to overbroad or otherwise inappropriate demands as a matter of course.” Amazon is taking the stance that its users’ privacy is primary and should be protected to the fullest extent possible. However, it is unclear whether Amazon is itself violating potential consumer privacy concerns by continuously collecting user data. Users need to become aware and take advantage of tools that give them control over how and where their communications are kept. While the consumer agrees to the privacy policy set forth by Amazon, the consumer is unable to limit the amount of information the Echo absorbs and does not have complete access to the information stored by the product. “Always-on” devices are listening to consumers in their most private spaces and questions persist whether it is reasonable to expect consumers to monitor their every word in front of their home electronics. Where do we, as a society, draw the line? What is the new standard for a reasonable expectation of privacy in the home?

Products like the Amazon Echo are continuing to advance and are resulting in more legal questions than answers. Consumer privacy protections are critical in a society that is constantly changing and pertinent policy is necessary in order to better protect consumers and diverse stakeholders. Consumers need to be provided with all of the information necessary when dealing with products that are innately designed to invade their personal space. The FTC and the DOJ need to tackle the questions and concerns of those whose personal interactions in their homes may be subject to routine surveillance as a result of their engagement with technology. Congress needs to lay out strong and precise standards for when the government can access data from these devices. The third-party doctrine needs to be reconciled with technological innovation and the Fourth Amendment needs to be understood to encompass the smart home. Consumers need to have complete access to all of their audio recordings and should have the ability to turn off always-on devices. Lastly, the draft Consumer Privacy Bill of Rights Act of 2015 should ultimately be enacted by Congress.

While it is important to recognize the benefits associated with always-on technologies, it is equally important to protect consumer privacy and ensure trust in all technological products. The case between Amazon and the Arkansas police department clearly has immense privacy implications for IoT and consumers. Hopefully, the case will bring some legal clarity and finality to the IoT space, answer questions regarding data ownership, and define the scope of consumer privacy policy.

Sources: