Select committee: Digital, Culture, Media and Sport Committee
Recommendation 11
Tenth Report - Connected tech: smart or sinister?
Published 7 Aug 2023
Paragraph 101
Addressed to Department for Culture, Media and Sport
Digital, Culture, Media and Sport Committee Connected tech: smart or sinister? All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Recommendation (the committee's words)
The introduction of the product security regime, which codifies three of the original thirteen guidelines set out in the Government’s internationally recognised 2018 Code of Practice for Consumer IoT Security, is an important first step in improving cybersecurity for connected devices. However, the remaining ten guidelines retain considerable support among stakeholders. We recommend that the Office for Product Safety and Standards (OPSS), as the national regulator, should produce an implementation plan so policymakers can measure the impact of the product security regime. The OPSS should continue to promote the guidelines not included in the Product Security and Telecommunications Infrastructure Act 2022 and the Government should commit to codifying these remaining guidelines in phases as the regime matures and industry adapts, in order to stay ahead of emerging cyber threats.
From: Digital, Culture, Media and Sport Committee, Tenth Report - Connected tech: smart or sinister? (HC 157), paragraph 101, 7 August 2023
Government response
The government responded to the whole report on 24 November 2023.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "partially accept[s] the majority" of the Committee's conclusions and recommendations, and where it has not accepted them it points to existing or planned actions.
- On the Age-Appropriate Design Code, it agrees, stating it "will ensure" forthcoming data protection reforms "do not undermine any aspect" of the code, with the ICO to update guidance once the Bill receives Royal Assent.
- On data protection reform and ICO governance, it does not agree, saying reforms are "compatible with maintaining free flow of personal data from Europe" and that the Statement of Strategic Priorities will be subject to parliamentary oversight.
- On privacy interfaces, it partially accepts, does not agree with being "overly prescriptive", and will engage interest groups "in the months ahead" on simpler and more granular cookie choices.
- On product security, it partially accepts, saying there is no current evidence it would be proportionate to mandate requirements beyond the initial three, but it "will not hesitate" to mandate more "if necessary".