Select committee: Digital, Culture, Media and Sport Committee
Conclusion 12
Tenth Report - Connected tech: smart or sinister?
Published 7 Aug 2023
Paragraph 102
Addressed to Department for Culture, Media and Sport
Digital, Culture, Media and Sport Committee Connected tech: smart or sinister? All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
As the guidelines set out in the 2018 Code of Practice for Consumer IoT Security imply, cybersecurity and data protection are mutually reinforcing. Without cybersecurity, data cannot be meaningfully protected, while data protection can manage the risk and impact of cyberattack. The Information Commissioner’s Office, either bilaterally or through the Digital Regulation Co-operation Forum, which helps co-ordinate regulation of digital platforms and services, should work with the Office for Product Safety and Standards as it promotes the guidelines pertaining to data protection and data security in the 2018 Code of Practice.
From: Digital, Culture, Media and Sport Committee, Tenth Report - Connected tech: smart or sinister? (HC 157), paragraph 102, 7 August 2023
Government response
The government responded to the whole report on 24 November 2023.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "partially accept[s] the majority" of the Committee's conclusions and recommendations, and where it has not accepted them it points to existing or planned actions.
- On the Age-Appropriate Design Code, it agrees, stating it "will ensure" forthcoming data protection reforms "do not undermine any aspect" of the code, with the ICO to update guidance once the Bill receives Royal Assent.
- On data protection reform and ICO governance, it does not agree, saying reforms are "compatible with maintaining free flow of personal data from Europe" and that the Statement of Strategic Priorities will be subject to parliamentary oversight.
- On privacy interfaces, it partially accepts, does not agree with being "overly prescriptive", and will engage interest groups "in the months ahead" on simpler and more granular cookie choices.
- On product security, it partially accepts, saying there is no current evidence it would be proportionate to mandate requirements beyond the initial three, but it "will not hesitate" to mandate more "if necessary".