Written evidence submitted by Electrical Safety First

Response to the Digital, Culture, Media and Sport

Select Committee Inquiry

Connected Technology – Smart or Sinister?

Electrical Safety First

Electrical Safety First is the UK charity committed to reducing deaths, injuries, and fires caused by electricity in the home. For further information, visit:  www.electricalsafetyfirst.org.uk/westminster.

1. What has been or will be the most important impacts of increasingly prevalent smart and connected technology in our lives, including in the home, in the workplace and in our towns and cities, and are they necessarily better than current systems?

From a safety perspective, smart technology presents several opportunities. Electrical Safety First has identified three areas where smart technology will present safety opportunities, namely:

1. The detection and prevention of incidents (such as fires/overheating/malfunction). This is because connected products are able to self-monitor and either alert, adjust or isolate to prevent fires and shock. Ultimately, this could lead to fewer deaths, injuries, and fires caused by products.
2. Improved registration and recalls. Smart products could help to solve issues around registration and could facilitate better response rates to a recall by alerting the consumer directly through the appliance or enabling the manufacturer to isolate/turn off the affected product remotely until the product has been fixed/replaced.
3. Helping the vulnerable. A smart home can make a huge difference to improving the safety and wellbeing of vulnerable people, such as those living with dementia. A home fitted with smart sensors and products could prevent electrical fires by switching off appliances and products that have been left on and present a safety risk being left unattended.

However, smart technology also presents several risks. For instance, where a product malfunctions and consumers are relying on self-monitoring functions, it is more likely that consumers will be placed at risk. This is because consumers may not be as alert to product safety concerns as they would be where the product was not self-monitoring.

In addition, smart technology must interoperate safely with other products in a smart home system. A failure to consider interoperability (and a failure at a legislative and regulatory level to ensure that connected products are adequately interoperable) risks undermining the safety of consumers’ homes.

Relatedly, it is essential that consumers are aware of the longevity of their connected devices and of any requirements in relation to updating, maintaining and repairing the product.

Lastly, there is a concern that poor product security risks undermining product safety, such as if a security attack results in a product operating when a consumer doesn’t want it to. For instance, where it defeats a safety feature, or where it changes how a product would normally operate or interact with another product. As such, it is crucial that the interconnected nature of safety and security is adequately accounted for – both in the Product Security and Telecommunications Bill (“the Bill”) and in other legislation, regulation, or standards.

2. Are there any groups in society who may particularly benefit from or be vulnerable to the increasing prevalence of smart technology, such as young or elderly people, people with disabilities and people likely to be digitally excluded?

Consumers - recalls

The Internet of Things (IoT) and connected technology represent an opportunity to increase traceability and improve recall effectiveness. For instance, the ability of the manufacturer to communicate with the end-user directly through notifications can improve the response to a recall alert.

At present, the success rate for electrical goods is worryingly low. Through allowing manufacturers to communicate with end-users via automatic notifications, there is the potential to significantly improve the recall success rate.

Whilst the Bill (under Clauses 24-25), includes provisions for the manufacturer to issue a notification where a security compliance failure arises, there is no provision that relates directly to safety[i]. Consideration should be given to including analogous requirements in relation to safety concerns within the Bill.

.              Vulnerable consumers

Whilst connected technology is still in its infancy, there is the opportunity for connected technology to serve an important role in protecting vulnerable consumers.

For instance, where a connected product has been left unattended for a period of time, the device could automatically switch off, if safe to do so. This would not only save energy, but with certain products, would reduce the safety risks that could arise in terms of fires. Given that, in England, 79% of electrical fires affecting the elderly were where the occupant lived alone[ii], the safety benefits that connected technology represents is significant. This is especially because 12 electrical fires every day affect the elderly[iii].

In addition, the use of assisted voice technology, such as Amazon’s Alexa or Google’s Nest presents safety opportunities for vulnerable consumers – for instance, through allowing those with mobility issues to remotely turn products on/off.

Relatedly, Electrical Safety First has developed an Alexa app that can help `inform consumers if their products have been recalled[iv]. Similar opportunities should be explored, particularly by manufacturers, retailers, and regulators – in relation to both security and safety.

3. How can we incentivise or encourage design that is safe, secure, environmentally- and user-friendly and human rights compliant?             

Information requirements

The Secretary of State, Rt Hon Nadine Dorries MP, at Second Reading of the Bill, confirmed that there will be an obligation to inform “consumers how long a product will receive security updates for at the point of sale”[v]. 

In order to ensure that the design of connected products is safe, sustainable and environmentally friendly, consideration should be given to an information requirement at the point of sale in relation to repairability and durability.

Additionally, just as the Bill will ensure that consumers receive security updates, consumers should be able to obtain reliable, useful, and accessible information regarding the anticipated lifespan and repairability of connected products they purchase. Consumers should also know for how long this information will be available – and a standardised approach to the provision of such information is preferable.

Skills requirement and skills network

The increasing focus on sustainability means that products are increasingly likely to be more repairable[vi]. As such, it is important that consumers have the information necessary to undertake repairs safely. In particular, it should be clear whether a repair can be safely undertaken by a consumer themselves or whether the repair needs to be undertaken by a qualified and competent person.

Relatedly, it is necessary to ensure that there is an established and recognised competent repair network. This will inevitability require the training or re-training of workers to match the increased demand for repairers.

In this vein, the establishment of a common standard in relation to individuals undertaking repair work in relation to connected products may be useful.

Parts for repair

As connected products do become more repairable, it is essential that consumers have access to affordable and safe replacement parts. Consumers should be provided with adequate information about replacement parts at the point of purchase – and these parts should be made readily available and affordable (particularly for branded products). If parts are disproportionately unaffordable, there is a risk that consumers will purchase substandard replacements (placing the consumer and brand reputation at risk) or that consumers will buy new products (undermining the wider sustainability agenda).

4. What are the key short- and long-term risks and threats, and how can we ensure the devices, systems and networks of individuals, businesses and organisations are digitally-literate and cyber secure?

Consumer education

As connected technology becomes more prevalent, it is vital that consumers understand how these products should be used. Focus should be given to consumer education and awareness campaigns in relation to:

• Connected technology and how to identify insecure products;
• Repairability of products and product lifecycles; and
• Product safety and how to identify unsafe products.

This is particularly in relation to awareness raising around existing and proposed legislation. For instance, ensuring that consumers are aware that products do not have default passwords, that there is the ability to report vulnerability breaches, and that consumers are entitled to receive security updates for a specified period.

Changes in safety advice

In addition, as connected technology becomes more advanced, it may become more common for white goods, such as washing machines or dishwashers, to be used overnight or whilst consumers are not home.

At present, the safety advice from Electrical Safety First[vii] and the Home Office[viii] is to avoid using appliances such as white goods overnight.

However, if white goods are sufficiently ‘smart’ it may be possible for these to be used overnight, provided that the product is able to self-monitor for any safety issues and automatically turn off where necessary.

This would then mean that white goods could be used safely at any time– providing an advantage to both consumers and energy suppliers, as white good usage can be tapered to prevent surges in demand.

But, for this to be safe, it is necessary to ensure that any self-monitoring is robust and effective. In particular, flaws in the ‘smartness’ of white goods – for instance, their ability to connect to other devices that alert consumers to any issues, risks undermining the success of this approach.

5. How will current geopolitical concerns influence domestic consumers, e.g. regarding standards of imported goods or in how we can deal with cyber threats?

Withdrawal from the European Union

The United Kingdom’s withdrawal from the European Union means that legislation in relation to product safety and security will diverge between the UK and the EU.

For instance, there is already a divergence in terms of product safety on online marketplaces. The European Commission’s Product Safety Pledge (PSP) is a voluntary commitment that online marketplaces can sign up to[ix] – and many, including eBay, Amazon, and Wish.com, have done so. The PSP requires the online marketplaces that have signed up to remove unsafe products from their platforms within 48 hours of being notified[x]. There is no analogous requirement in the United Kingdom.

In addition, the Regulation (EU) 2019/1020 of the European Parliament applies in the EU (but not the UK, despite the UK being a member of the EU during the period in which the Regulation was introduced)[xi]. These regulations place an obligation on online marketplaces to co-operate with market surveillance authorities to mitigate risks associated with products that are advertised, sold, or have been offered for sale on their platforms[xii].

More recently, the new EU Digital Services Act will place obligations on online marketplaces[xiii], including new obligations related to:

• Complaints and redress mechanism and out of court dispute settlement;
• Special obligations for marketplaces, e.g., vetting accreditations of third-party suppliers (“Know Your Business Customer”), compliance by design, random checks.
• User-facing transparency of online advertising[xiv].

Whilst the UK’s withdrawal from the European Union allows the UK regulatory autonomy, the divergence that the UK has seen in terms of product safety standards places UK consumers at risk. In particular, the UK has taken comparatively fewer steps to regulate online marketplaces, with the result being that UK consumers are now at more risk than their counterparts in the EU.

This divergence is also a concern in relation to the Protocol on Ireland/Northern Ireland.

Interoperability

In a similar vein, the EU announced that all consumer electronics would have to include a USB Type-C port[xv]. The motivation behind this was to reduce electrical and electronic waste caused by unused chargers but also to improve customer convenience. The UK, however, did not opt to follow suit.

This relates to a wider issue – that of interoperability. In order to ensure that consumer products are both smart and IoT-secure, consideration should be given to ensuring the interoperability of products. If products are not interoperable, this could undermine the functionality and safety of the product, and thereby place consumers at risk.

It is, therefore, essential that consideration is given to ensuring that connected products are interoperable.

Do existing frameworks, like data protection legislation and the Public Security and Telecommunications Infrastructure Bill, adequately address concerns with smart technology, and if not, how could they be changed?

Online marketplaces as actors in the supply chain

Under Clause 7 of the Bill, online marketplaces have no obligations to comply with the provisions under the Bill where they are facilitating third-party sales or providing fulfilment services[xvi].

Indeed, the list of ‘relevant persons’ listed in the Bill mirrors those in existing product safety legislation. Specifically, the Bill’s intention to place obligations on manufacturers, importers, and distributors reflects the actors recognised in the Consumer Protection Act 1987[xvii].

However, the Government has itself recognised, in its response to the Call for Evidence on Product Safety, that current product safety rules were designed to fit supply chains as they operated before the world of internet shopping[xviii].

In the realm of product safety, the Government has recognised that this can result in the situation where it is unclear where responsibility (or accountability) for product safety lies[xix]. This gap in the regulatory framework results in unsafe and non-compliant products frequently being listed on online marketplaces[xx].

By mirroring the actors recognised in product safety legislation, the Bill risks creating the same issues in relation to product security. Through not holding online marketplaces responsible under the Bill, the Bill creates an incentive for insecure connected technology to be listed on online marketplaces. 

As the Bill is a new piece of legislation, it should be addressing new methods of sale (including the rise of e-commerce and m-commerce). Not to do so risks undermining the effectiveness of the legislation.

This is particularly important given the number of consumers who shop on online marketplaces and the continued growth that these platforms have seen in recent years. Indeed, a consumer survey undertaken by Electrical Safety First shows that the most popular destination for purchasing connected technology is on online marketplaces, with 48% of consumers relying on these platforms[xxi]. This is nearly double the amount (25%) who said they purchased smart devices in-store from major high street retailers[xxii].

Based on this research, which shows consumers are most likely to purchase smart technology on online marketplaces, it is vital that online marketplaces be recognised as ‘relevant persons’ under Clause 7 of the Bill.

Data protection legislation

The protection of consumers’ data under the General Data Protection Regulations is important. However, data protection measures should not inhibit safety-based communications from manufacturers, importers, distributors, and online marketplaces. An exception in legislation and regulation should be considered to ensure that consumers can receive communications provided these are solely related to safety concerns.