Despite the technology's many benefits, "increased connectivity between devices and the Internet may create a number of security and privacy risks," the agency declared in a report largely based on a workshop it held with industry experts, consumer advocates and other panelists in 2013.
"In particular, some panelists noted that companies might use this data to make credit, insurance and employment decisions," the report added. "Others noted that perceived risks to privacy and security, even if not realized, could undermine the consumer confidence necessary for the technologies to meet their full potential and may result in less widespread adoption."
With the number of connected smart gadgets likely to grow from 25 billion today to 50 billion by 2020, according to the report, the Internet of Things is widely expected to provide innumerable benefits. That includes everything from making homes more energy-efficient and consumer appliances vastly more helpful to keeping patients in closer touch with doctors and automatically braking cars to avoid crashes.
Nevertheless, the report advised companies to take a number of steps to protect personal information. Those included building security into devices from the outset -- rather than as an afterthought -- training employees about the importance of security and continuously monitoring their devices for vulnerabilities.
In addition, the agency recommended that companies minimize how much data their devices gather and keep that information for only a short time.
"Thieves cannot steal data that has been deleted after serving its purpose; nor can thieves steal data that was not collected in the first place," the FTC said. In some recent cases, it added, "companies could have mitigated the harm associated with a data breach by disposing of customer information they no longer had a business need to keep."
The agency concluded that passing new laws to specifically govern the Internet of Things "would be premature" since the technology is still evolving. But the FTC reiterated its long-standing recommendation that Congress "enact strong, flexible and technology-neutral federal legislation to strengthen its existing data security enforcement tools, and to provide notification to consumers when there is a security breach."
While the agency currently has authority to police some aspects of smart devices, the report said, it "cannot mandate certain basic privacy protections -- such as privacy disclosures or consumer choice -- absent a specific showing of deception or unfairness" by device makers.
Although four of the agency's five commissioners voted to issue the staff-produced report, Commissioner Joshua Wright dissented, saying the FTC had insufficient evidence that smart devices needed new laws and that their data gathering should be limited.
The nonprofit Information Technology & Innovation Foundation, which is partly financed by such businesses as Google and Cisco Systems, also complained that the report "attempts to shoehorn old ideas on new technology by calling for broad-based privacy legislation."
But FTC Chairwoman Edith Ramirez cheered the report's findings.
"The only way for the Internet of Things to reach its full potential for innovation is with the trust of American consumers," she said in an accompanying press release. "We believe that by adopting the best practices we've laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized."
©2015 the San Jose Mercury News (San Jose, Calif.)
