Nethui 2020: Privacy & The Internet of Things (Erika Pearson & Esther Jaspers)

• [Erika] Tena koutou, tena koutou, tena koutou katoa - We’re presenting the findings from our research into domestic IoT, funded by a Privacy Good Research grant from the office of the Privacy Commission. Domestic IoT refers to any home-based device that is connected to the internet and uses that connection to perform automated tasks, such as smart speakers, IoT toothbrushes, automated lighting, and even children’s toys. - [Esther] About 70% of new Zealanders have concerns about their privacy in relation to IoT devices, but these concerns have not stopped one in every 10 New Zealand households from adopting some form of domestic IoT. We wanted to explore what privacy concerns New Zealanders have for domestic IoT, what drove uptake and what deterred people from a smart device in their home. We first conducted a survey of a representative sample of 930 new Zealanders, 397 people indicated they owned one or more IoT devices at home.

00:55 - There were some significant differences between IoT users and non-users. User were younger, more frequently male, more highly educated and at higher incomes compared to non-users. We followed a survey with in-depth interviews with 12 users of domestic IoT devices who generally described themselves as tech-savvy or early adopters. - [Erika] Our survey indicated that key drivers of uptake are perceived usefulness of the device, perceived ease of use, and perceived social pressure to adopt the technology. As in everyone has these devices, why not me? The priority of these drivers between users and non-users also skewed by age.

01:34 - We did note that privacy protecting behaviours tend to be reported more from older people and from women. However, users and non-users generally reported about the same amount of privacy. And talking to users, key issues included the reputation of the device and the manufacturer more generally, as ethical, reliable, and trustworthy, familiarity with and commitment to a particular operating ecosystem and the general usefulness of the device. While many bought one out of curiosity, if it didn’t serve a purpose, it was unplugged. Users reported a range of concerns alongside the benefits of the device, such as how their data was being reused whether third parties now or in the future, could mine that data for fresh insight and who owned what data for what purpose.

02:26 - Users also reported being concerned about their data being on sold to sell them stuff surveillance by the state was nowhere near as significant a concern, but several respondents noted that this might change in the future. - [Esther] We also identified some emerging issues. Firstly, there was a growing question as to whether privacy would soon become a privilege to be paid for. This was tied to a concern around scope creep, as it became technically feasible to connect more types of devices to networks. There was also a concern that domestic IoT might be used for punitive surveillance in the home, especially as those norms around the use of live mics and cameras at home, continue to shift towards ideas of disclosure.

03:08 - For many users, previous privacy concerns have faded with continuous successful use. However, there were still doubts as to how long a user’s right to privacy might be respected, especially as data is stored and reanalyzed to provide new services. For many privacy fatigue was already setting in and it didn’t see a need to take additional steps to preserve privacy. - [Erika] The adoption of IoT devices is driven and maintained by functionality. They have to continue to be beneficial to the user, but that benefit does come with a trade-off.

03:39 - Use of IoT is based in process of negotiation and trust, and these are understood in relation to trust in the providers and how well they are known, and on prior experiences users have with other internet-based services such as social media. But privacy fatigue is setting in and that may feel concepts of privacy as a privilege or that privacy is dead. And while many of our users were satisfied with their own level of privacy management, they express concern for late adopters and those who for whatever reason might not feel as empowered to negotiate these trade-offs. Privacy is hot in a data driven world and domesticating data-driven devices raises fresh concerns for the benefits to users. - [Esther] Overall, we need to more clearly understand the privacy impacts of third-party use that may not be clear at the point of disclosure.

04:29 - We need to pay more attention to enabling ongoing control of personal data in the trade-off for functionality. And finally, specific focus needs to be paid to groups such as the elderly, children, those who require IoT for accessibility or who may be subject to punitive or surveillance IoT and their privacy needs. - [Erika] Thank you for watching, Kia ora. .