June 18, 2019

June 17, 2019

Subscribe to Latest Legal News and Analysis

California’s Unique Internet of Things Cybersecurity Law

California is the first state to pass a cybersecurity law addressing “smart” devices and Internet of Things (IoT) technology, impacting virtually anything connected to the internet, including smart home devices (e.g., WeMo Smart Plugs, August's Smart Lock, NEST thermostats, etc.) and connected appliances. SB-327 takes effect January 1, 2020.

The new law specifies the security obligations of “manufacturers” of connected devices. A manufacturer includes the person who manufactures, or contracts with another person to manufacture, connected devices sold or offered for sale in California. The law will therefore apply to manufacturers outside of California if their products are sold in California.

Under the new law, a covered manufacturer of a connected device must equip the device with a “reasonable security feature” that is:

  • Appropriate to the device’s nature and function;
  • Appropriate to the information the device may collect, contain or transmit; and
  • Designed to protect the device and any of its information from unauthorized access, destruction, use, modification or disclosure.

The phrase “security feature” includes any feature designed to provide security for the device. “Unauthorized access, destruction, use, modification or disclosure” is defined to include access, destruction, use, modification or disclosure that is not authorized by the consumer. If a device has the ability to authenticate outside a local area network, the security feature is deemed to be reasonable if either:

  • The preprogrammed password is unique to each device; or
  • The security feature requires a user to generate a new means of authentication before access is granted to the device for the first time.

Although the law is sweeping in scope, there are some safeguards and exemptions. For example, there is no private right of action under the statutes, activities regulated by HIPAA are exempt, and manufacturers are not responsible for choices made by the owner/consumer or for the impact of non-affiliated software or apps. In light of the breadth of the law and the specific nature of the exemptions, manufacturers whose connected devices are or will be sold in California should assess which of their products will be subject to the new law and ensure that “reasonable security features” are in place.

©2019 Drinker Biddle & Reath LLP. All Rights Reserved

TRENDING LEGAL ANALYSIS


About this Author

Dan Brown, insurance lawyer, Drinker Biddle
Partner

Dan Brown represents insurance companies, agents and brokers, and others in all aspects of the admitted, exempt, and surplus lines insurance markets in the United States. This includes advising alien or foreign insurers on how to comply with various state laws in placing business; advising insures on exempt and specialty lines such as marine, aviation, and transportation risks; advising producers on licensing, placement and premium tax issues; and advising insureds on coverage and placement issues. Dan advises participants in the London market on how to...

(415) 591-7585
Thomas M. Dawson, Insurance, Attorney, Drinker Biddle
Partner

Thomas M. Dawson* represents U.S. and non-U.S. insurers on regulatory, licensing and corporate matters. He is co-chair of the firm's Insurance Regulatory and Transactional Team within the Corporate and Securities Practice Group.

Tom advises industry participants on a wide variety of regulatory and transactional matters, including cybersecurity compliance, insurtech ventures and Holding Company Act filings. He has assisted clients form, acquire and invest in U.S. insurers, reinsurers and intermediaries. He counsels non-insurers on advertising, licensing and marketing generally, and provides regulatory compliance advice to service contract issuers and other specialty product providers.

Tom has guided non-U.S. re/insurers in the London market, Europe, Bermuda and in Asia for more than 25 years, helping them obtain and maintain surplus lines and reinsurer approvals as well as monitoring state and federal legislation.

*Tom’s practice is limited to advising clients on U.S. law, and he is not admitted to practice as a solicitor in England and Wales.

212-248-3160