Select committee: Digital, Culture, Media and Sport Committee
Recommendation 13
Tenth Report - Connected tech: smart or sinister?
Published 7 Aug 2023
Paragraph 108
Addressed to Department for Culture, Media and Sport
Digital, Culture, Media and Sport Committee Connected tech: smart or sinister? All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Recommendation (the committee's words)
Improving cybersecurity of consumer connected devices is an important and positive step, but the proliferation of connected tech in enterprise settings and the gap in the regime regarding network, storage and cloud security still present likely attack vectors that will continue to allow devices to be compromised. The Government should close the gaps for both consumer and enterprise connected tech in the product security regime by requiring that providers adopt network-level, storage and cloud-based security to the same standards as it requires for connected devices.
From: Digital, Culture, Media and Sport Committee, Tenth Report - Connected tech: smart or sinister? (HC 157), paragraph 108, 7 August 2023
Government response
The government responded to the whole report on 24 November 2023.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "partially accept[s] the majority" of the Committee's conclusions and recommendations, and where it has not accepted them it points to existing or planned actions.
- On the Age-Appropriate Design Code, it agrees, stating it "will ensure" forthcoming data protection reforms "do not undermine any aspect" of the code, with the ICO to update guidance once the Bill receives Royal Assent.
- On data protection reform and ICO governance, it does not agree, saying reforms are "compatible with maintaining free flow of personal data from Europe" and that the Statement of Strategic Priorities will be subject to parliamentary oversight.
- On privacy interfaces, it partially accepts, does not agree with being "overly prescriptive", and will engage interest groups "in the months ahead" on simpler and more granular cookie choices.
- On product security, it partially accepts, saying there is no current evidence it would be proportionate to mandate requirements beyond the initial three, but it "will not hesitate" to mandate more "if necessary".