Connected tech: smart or sinister?

Data rights are an important tool for empowering data subjects and balancing data processing against users’ rights and freedoms. However, there are many barriers to individuals being able to exercise these rights when using or interacting with connected tech, ranging from product design to digital literacy and resources. Users must be given clear information about, and a fair chance to understand, the basis on which their data is used, the implications for their digital rights, the benefits and risks, and how to consent, object and how to exercise these rights.

The Government should introduce appropriate measures to standardise privacy interfaces for connected devices as a first step, which will help users learn how to control connected devices in their homes and exercise data rights. Privacy interfaces should be appropriately accessible, intuitive and flexible enough so users of a reasonable level of digital literacy and privacy expectations can use them, without requiring them to go through complex dashboards with long lists of terms and conditions and settings. Interfaces should also provide information on how devices are connecting to other devices and networks, to provide transparency about data flows.

The Government should clarify the obligations in the Online Safety Bill for voice assistants, connected devices (like smart speakers) and other emerging technologies that can surface harmful content, to ensure that those that integrate search services in particular fall in-scope of the duties. It should also set out in its response to this report how the online safety regime will categorise voice assistants and connected devices that integrate internet search so that they do not service harmful content like hate speech and other harms.

The use of connected tech in schools and by children in homes raises concerns, including the harvesting and third-party use of children’s data and their lack of control over what technology is used and when. The Government and ICO were quick to dismiss our concerns about this issue. We urge the ICO to take a more proactive approach in engaging with manufacturers of connected toys and education technology. It should ensure that all products include: terms and conditions that are age-appropriate; privacy settings that are intuitive for children and help them exercise data rights; and fully explain the benefits and risks of data processing. Industry should be supported in this through comprehensive guidance, independent research and user- testing.

The Government should commit to ensuring that the Age-Appropriate Design Code is strengthened rather than undermined by data protection reform and to laying the revised code as soon as is practicable.

Though smart cities provide a range of opportunities, such as more efficient management of resources, there are also additional risks to confidence in privacy and data protection, making it harder for individuals to exercise data rights. The Government should review how it can incentivise and actively pilot the creation of data institutions, in partnership with local government and other local stakeholders, Connected tech: smart or sinister? 67 in smart cities to address issues of data protection and ensure that citizens can have greater control over, and directly participate in the benefits from, the use of their data.

The monitoring of employees in smart workplaces should be done only in consultation with, and with the consent of, those being monitored. The Government should commission research to improve the evidence base regarding the deployment of automated and data collection systems at work. It should also clarify whether proposals for the regulation of AI will extend to the Health and Safety Executive (HSE) and detail in its response to this report how HSE can be supported in fulfilling this remit.

The Information Commissioner’s Office should develop its existing draft guidance on “Employment practices: monitoring at work” into a principles-based code for designers and operators of workplace connected tech.

The Government has not yet made a compelling case for reform of data protection. While we understand that some companies do not share data outside the UK, we are concerned that differing expectations between those companies and companies that do share data outside the UK may give the impression of “lesser” protections for processing personal data in the UK overall. This could be perceived as undermining our existing data adequacy arrangements and ultimately harm companies that share data between the UK and other jurisdictions. To maintain the UK’s reputation as a world-class technology hub, the Government should keep its data reforms under review so as not to undermine its existing data adequacy agreements.

We agree that reforming the governance and accountability structures of the Information Commissioner’s Office will be a positive step. We have previously recommended against executive overreach in the case of Ofcom and the Online Safety Bill; these concerns apply with respect to the Information Commissioner’s Office and the Data Protection and Digital Information (No. 2) Bill. Powers to veto codes of practice and to set strategic priorities without parliamentary oversight should not be adopted. (Paragraph 78) Product security

The introduction of the product security regime, which codifies three of the original thirteen guidelines set out in the Government’s internationally recognised 2018 Code of Practice for Consumer IoT Security, is an important first step in improving cybersecurity for connected devices. However, the remaining ten guidelines retain considerable support among stakeholders. We recommend that the Office for Product Safety and Standards (OPSS), as the national regulator, should produce an implementation plan so policymakers can measure the impact of the product security regime. The OPSS should continue to promote the guidelines not included in the Product Security and Telecommunications Infrastructure Act 2022 and the Government should commit to codifying these remaining guidelines in phases as the regime matures and industry adapts, in order to stay ahead of emerging cyber threats. (Paragraph 101) 68 Connected tech: smart or sinister?

As the guidelines set out in the 2018 Code of Practice for Consumer IoT Security imply, cybersecurity and data protection are mutually reinforcing. Without cybersecurity, data cannot be meaningfully protected, while data protection can manage the risk and impact of cyberattack. The Information Commissioner’s Office, either bilaterally or through the Digital Regulation Co-operation Forum, which helps co-ordinate regulation of digital platforms and services, should work with the Office for Product Safety and Standards as it promotes the guidelines pertaining to data protection and data security in the 2018 Code of Practice.

Improving cybersecurity of consumer connected devices is an important and positive step, but the proliferation of connected tech in enterprise settings and the gap in the regime regarding network, storage and cloud security still present likely attack vectors that will continue to allow devices to be compromised. The Government should close the gaps for both consumer and enterprise connected tech in the product security regime by requiring that providers adopt network-level, storage and cloud-based security to the same standards as it requires for connected devices.

We are concerned about the ongoing skills shortage, as recognised in both the Government and industry’s regular reporting on cybersecurity skills in the labour market, and believe that the shortage will be exacerbated further as the product safety regime comes into force. We support industry’s calls for the Government to do more to address this issue. The Government should also take steps to support the availability of free courses across the country, encourage more professionals to become cybersecurity educators, improve the provision of core professional skills among the existing workforce and incentivise industry to improve hiring practices and retention rates.

We are particularly concerned that, despite the shortage of cyber skills in the UK, there are stubborn and significant disparities in the cyber workforce based on gender and race and ethnicity. The Government should reflect on the significant disparities in gender and race/ethnicity in the cyber workforce and take steps to improve these divides, such as by introducing additional schemes and funding to widen the talent pool, improving the culture of and attitudes to the cyber profession both in education and work, and considering how to provide professional support for people during their career.

The creation of the Department for Science, Innovation and Technology is an opportunity to ensure a comprehensive, joined up approach to cyber policy. We recommend that responsibilities for cyber policy is co-ordinated by the dedicated Department for Science, Innovation and Technology and that government ensures collaboration between the Department and other cyber-focused teams distributed across Whitehall. Ministers in the Department for Science, Innovation and Technology should be ultimately responsible and accountable for developing and delivering cyber policy except for national security measures.

As the prevalence of connected technology grows, so too will the demand for the National Cyber Security Centre’s services. The Government should ensure that the National Cyber Security Centre has the capacity to meet demands for its services. It should explicitly consider and address capacity issues as part of its regular reporting Connected tech: smart or sinister? 69 on cybersecurity skills in the UK. (Paragraph 121) Technology-facilitated abuse

The Government must make tackling technology-facilitated abuse, or “tech abuse”, a priority. There is little evidence to suggest that our law enforcement and criminal justice system has been equipped to deal with the problems caused by tech abuse now, let alone as connected devices become even more prevalent in future. While there is no “silver bullet” for dealing with tech abuse, the Government can do more to tackle it.

The Government’s response to tech abuse should involve upskilling law enforcement to improve the criminal justice response and increasing law enforcement’s and victims’ and survivors’ awareness of specialist services tackling violence against women and girls. The Government should also reflect on how official crime data on tech abuse can be improved to expand the evidence base for specialists, academics and policymakers in order to develop a more comprehensive, co-ordinated response.

We want to see words from cross-sector stakeholders on tech abuse now leading to positive actions. The Office for Product Safety and Standards should, at the earliest opportunity, convene a “tech abuse working group” with stakeholders, bringing industry together with researchers, specialist support services and public services. This group should be more than just a talking shop, and draw on research to produce guidance and a code of practice that establishes best practice for manufacturers, vendors and law enforcement. The working group should report publicly through the OPSS on its progress at regular intervals. (Paragraph 138) 70 Connected tech: smart or sinister?

We welcome the Government’s sensible proposals for regulating AI, including taking a sectoral approach underpinned by six cross-sector principles. However, there are outstanding weaknesses with this approach that the Government should clarify, including ensuring that sector regulators who do not currently regulate in the tech sector will build up technical expertise and are working in a joined-up manner.

The Government should set out a plan to provide upskilling and resourcing for non- digital sector regulators to ensure they can meet the needs of the new cross-sector regulatory regime for AI.

The Government has announced that it intends to take on a central support role to buttress the regime for AI regulation and provide cross-sector cohesion. The Government should establish a discrete AI regulation co-ordination unit within Whitehall to ensure coherent working and enable robust stakeholder engagement. This unit should publish regular reports to enable Parliament to fully consider the progress of the regime’s introduction and implementation.

We are pleased that the Government has been listening to stakeholders on text and data mining intellectual property for commercial benefit and we are encouraged that Ministers are looking again at this. The current framework, which provides an exemption for text and data mining for non-commercial research purposes and otherwise allows creators to licence their work for any further purpose, provides an appropriate balance between innovation and creator rights.

We recommend that the Government does not pursue plans for a broad text and data mining exemption to copyright. Instead, the Government should proactively support small AI developers in particular, who may find difficulties in acquiring licences, by reviewing how licensing schemes can be introduced for technical material and how mutually-beneficial arrangements can be struck with rights management organisations and creative industries trade bodies. The Government should support the continuance of a strong copyright regime in the UK and be clear that licences are required to use copyrighted content in AI. In line with our previous work, this Committee also believes that the Government should act to ensure that creators are well rewarded in the copyright regime.

The Government must work to regain the trust of the creative industries following its abortive attempt to introduce a broad text and data mining exemption. The Government should consider how creatives can ensure transparency and, if necessary, recourse and redress if they suspect that AI developers are wrongfully using their works in AI development.

The Government’s initial handing of the text and data mining exemption to copyright for AI development, though eventually correct, shows a clear lack of understanding of the needs of the UK’s creative industries. All branches of Government need to better understand the impact of AI, and technology more broadly, on the creative Connected tech: AI and creative technology 35 industries and be able to defend their interests consistently. We will continue to look on the Government’s progress with interest. The Government should provide a substantive update on its direction in managing the impact of AI on the creative industries and any discussions on these matters by the end of 2023. (Paragraph 33) Creative technology

While institutions are understandably investing in products such as the metaverse and generative AI, this should not be to the exclusion of novel and emerging technologies, which are enabling artists to innovate and attract audiences. In order to encourage a rich and diverse cultural and creative technology ecosystem, the Government and its arm’s-length bodies should ensure support for the creative industries encourages artists to push the boundaries of creativity and technology and is not limited to following the narrow interests of the tech sector. Cultural institutions should be encouraged and supported by the Government to invest in, present and preserve the results of creative technology.

As we have repeatedly raised, the tech sector and creative industries are experiencing long-standing skills and personnel shortages that have capped the potential for growth. The Government’s forthcoming Cultural Education Plan should explicitly discuss how educators can combine digital skills provision with creative and cultural education to nurture the next generation of digital artists, visual effects professionals and innovators in creative technology to address long-running skills shortages in the sector.

The Government’s Cultural Education Plan Expert Advisory Panel has only recently been appointed, almost a year after the appointment of its chair and well over six months after Government said it would appoint its members. We have serious misgivings about the Government’s insistence that it will publish the Plan in 2023 as promised, which we believe will now either be rushed or late. Neither of these outcomes will serve the needs and interests of our creative industries. The Government must urgently clarify the scope and timescale for the Cultural Education Plan, to ensure it will deliver on its aims for the creative industries.

The rapid growth of generative artificial intelligence and the impact this is already having on the ability of artists to protect their moral rights means that urgent action is necessary. The Government should improve protections for creatives to prevent misuse of their likeness and performances by emerging technologies such as generative AI. At minimum, this should involve bringing forward ratification of the Beijing Treaty on Audiovisual Performances by the time it responds to this report. (Paragraph 61) 36 Connected tech: AI and creative technology