June 1, 2020

June 01, 2020

Subscribe to Latest Legal News and Analysis

May 30, 2020

Subscribe to Latest Legal News and Analysis

May 29, 2020

Subscribe to Latest Legal News and Analysis

California’s Unique Internet of Things Cybersecurity Law

California is the first state to pass a cybersecurity law addressing “smart” devices and Internet of Things (IoT) technology, impacting virtually anything connected to the internet, including smart home devices (e.g., WeMo Smart Plugs, August's Smart Lock, NEST thermostats, etc.) and connected appliances. SB-327 takes effect January 1, 2020.

The new law specifies the security obligations of “manufacturers” of connected devices. A manufacturer includes the person who manufactures, or contracts with another person to manufacture, connected devices sold or offered for sale in California. The law will therefore apply to manufacturers outside of California if their products are sold in California.

Under the new law, a covered manufacturer of a connected device must equip the device with a “reasonable security feature” that is:

  • Appropriate to the device’s nature and function;
  • Appropriate to the information the device may collect, contain or transmit; and
  • Designed to protect the device and any of its information from unauthorized access, destruction, use, modification or disclosure.

The phrase “security feature” includes any feature designed to provide security for the device. “Unauthorized access, destruction, use, modification or disclosure” is defined to include access, destruction, use, modification or disclosure that is not authorized by the consumer. If a device has the ability to authenticate outside a local area network, the security feature is deemed to be reasonable if either:

  • The preprogrammed password is unique to each device; or
  • The security feature requires a user to generate a new means of authentication before access is granted to the device for the first time.

Although the law is sweeping in scope, there are some safeguards and exemptions. For example, there is no private right of action under the statutes, activities regulated by HIPAA are exempt, and manufacturers are not responsible for choices made by the owner/consumer or for the impact of non-affiliated software or apps. In light of the breadth of the law and the specific nature of the exemptions, manufacturers whose connected devices are or will be sold in California should assess which of their products will be subject to the new law and ensure that “reasonable security features” are in place.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.


About this Author

Dan Brown, insurance lawyer, Drinker Biddle

Dan Brown represents insurance companies, agents and brokers, and others in all aspects of the admitted, exempt, and surplus lines insurance markets in the United States. This includes advising alien or foreign insurers on how to comply with various state laws in placing business; advising insures on exempt and specialty lines such as marine, aviation, and transportation risks; advising producers on licensing, placement and premium tax issues; and advising insureds on coverage and placement issues. Dan advises participants in the London market on how to...

(415) 591-7585