Course 9 - Internet of Things Security | Episode 2: UK Legislation, Data Privacy (GDPR), and Liability for Drones and Autonomous Vehicles | CyberCode Academy

In this lesson, you’ll learn about:

The rationale for applying legal frameworks to IoT
Privacy, security, liability, contractual, and criminal concerns in IoT
Existing UK laws relevant to IoT security
European Union regulations, particularly GDPR
Emerging regulatory responses to new IoT technologies, such as drones and autonomous vehicles

1. Why Law Applies to the IoT

Privacy Concerns: Legal frameworks address collection, storage, and usage of personal data from connected devices, like smart fridges.
Physical and Cyber Security: Laws cover malicious acts or mistakes causing harm to systems or individuals, including unauthorized access, firmware tampering, and communication interference.
Liability and Blame: Legal provisions determine accountability when IoT-related incidents occur.
Agreements and Contracts: Laws govern contracts between companies and end-users regarding shared data access and services.
Data Use in Criminal Investigations: Legal frameworks define how aggregated device data can be used as evidence in criminal cases.

2. Relevant UK Laws

Computer Misuse Act (CMA): Covers unauthorized access and impairment of computers and smart devices. Jurisdiction applies if a crime affects a UK system, regardless of the perpetrator’s nationality.
Communications Networks and Services Act: Protects communication systems from interference, including network sniffing.
Regulation of Investigatory Powers Act (RIPA): Governs lawful interception of communications and monitors authorized interference by law enforcement.

3. European Union Regulations

General Data Protection Regulation (GDPR):
- Requires companies to implement sufficient security measures for IoT data.
- Non-compliance can result in fines up to 4% of global turnover or millions of pounds.

4. Regulatory Responses to Emerging IoT Technologies

Drones (UAVs):
- UK proposes registration and mandatory safety testing due to safety concerns.
- Contrast with US court ruling that FAA lacked authority over “toy drones.”
Autonomous Vehicles:
- UK government published Eight Principles for Automated Vehicles.
- The Automated and Autonomous Vehicles Bill addresses liability and insurance issues for self-driving cars, clarifying responsibilities of designers, manufacturers, and users.

5. Key Takeaways

Existing IT and cybercrime laws partially cover IoT systems.
Cyber-physical IoT systems introduce unique challenges requiring new principles, bills, and regulatory actions.
Law plays a crucial role in protecting privacy, ensuring security, and assigning liability in the rapidly expanding IoT ecosystem.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 9 - Internet of Things Security | Episode 2: UK Legislation, Data Privacy (GDPR), and Liability for Drones and Autonomous Vehicles