ACM and AT to investigate security and information aspects in connection with smart devices

When purchasing smart devices, consumers must be informed properly about security aspects and must be provided correct information. This concerns devices that transmit and receive data and signals over a home network, such as smart smoke detectors, smart TVs, and smart thermostats. More and more such devices are introduced on the market. With their investigation, the Netherlands Authority for Consumers and Markets (ACM) and Radiocommunications Agency Netherlands (AT) will assess compliance with the rules among market participants, and are preparing themselves for new, upcoming rules, so that everyone will be able to continue to use such devices securely.

Anyone purchasing a smart device should receive a product that can be used properly and securely during its entire lifespan, including in typical combinations with other devices. That is why the new rules explicitly stipulate that smart devices must be digitally secure, and that sellers must offer functionality and security updates for the devices’ software, and that they must inform consumers when such updates become available. In addition, sellers must explain what the consequences are if such updates are not installed. They will have to do so for at least the period that was agreed upon at the time of the purchase, and, depending on the device in question, that period can be even longer. Sanctions can be imposed on sellers if they violate these rules.

Well-informed purchase decisions

“In order to be able to make well-informed purchase decisions, it is important to be able to compare smart devices, and to understand properly what they do. That is why we will also examine whether consumers get the right information”, says Cateautje Hijmans van den Bergh, Member of the Board of ACM. “Any individual that has bought a smart device must be able to be confident that the device actually does what can be expected from it and what had been agreed upon at the time of purchase. That is why we also investigate the extent to which providers of smart devices ensure this.”

Investigation

ACM and AT investigators will purchase various smart devices in both brick-and-mortar stores as well as online stores. When making those purchases, they will take note of what information they receive about, among other aspects, digital security, update policies, functionalities, compatibility with other devices, and software interoperability. They will subsequently assess the devices’ digital security, and they will follow the devices for a certain period of time in order to see how the manufacturer and supplier deal with updates.

European rules

As more and more smart devices are introduced, the European Commission has amended and expanded the rules. For example, it introduced the Digital Content Directive, and it has replaced the old Consumer Sales Directive with the Sale of Goods Directive. Furthermore, the Price Indication Directive, the Unfair Commercial Practices Directive, and the Consumer Rights Directive continue to remain in force, all three of which have been brought up to date with the Enforcement and Modernization Directive. ACM enforces compliance with these rules.

In addition, the Radio Equipment Directive has been amended. This directive contains requirements that devices that communicate wirelessly already need to meet, such as health-related requirements, and requirements related to electrical safety and uninterrupted use. From mid-2024, cyber-security requirements will be added for devices that can be connected to the internet through, for example, 4G or 5G, Wi-Fi, Bluetooth or Zigbee. In the Netherlands, AT is the regulator charged with oversight over these areas, and is able to impose sanctions if violations have been committed, and can even have devices withdrawn from the market.

The investigation’s results are expected to be published in early summer 2022.