Written evidence submitted by the Age Check Certification Services Limited
Julian Knight MP
DCMS Select Committee
House of Commons
22nd June 2022
Dear Mr. Knight,
Connected tech: smart or sinister? Call for evidence.
Thank you for the opportunity to contribute evidence to your Committee’s inquiry.
Age Check Certification Services Ltd operates the Internet of Toys Certification Scheme for connected toys – these are everything from dolls, cuddly toys, games and robots that see, hear and speak and share this data online with various platforms, often allowing for interaction with other users. This certification scheme was created with the support of grant funding from DCMS. It is now available and awaiting the enactment of laws requiring conformity with the standards on which it was built. The scheme is hosted online here: https://iotoys.org.uk/
We are a company based in Stockport and are funded as a social enterprise, including, since 2019, by the Northern Powerhouse Investment Fund, to grow a worldwide certification team, levelling up the UK economy by bringing High-Tech jobs and growth to the North of England.
We test that identity and age check systems work.
As an independent, UKAS accredited conformity assessment body, our role is to put the various types of age assurance systems and processes through standards-based assessment and provide certificates of conformity to those standards.
When we established the Age Check Certification Scheme in 2018, as a fully accredited certification scheme, through ISO 17065:2012 – the international standard for conformity assessment. Importantly, we also immediately recognised the importance of data privacy and security and the critical importance that our certification covered data protection. We were delighted to become the first ever scheme to have our criteria approved by the ICO in accordance with their tasks and powers under Articles 57(1)(n) and 58(3)(f) pursuant to Article 42(5) of the UK General Data Protection Regulation. Not only were we the first in the UK to achieve this, we’re also the first across the equivalent powers contained in EU GDPR.
When DCMS sought proposals to create certification schemes for connected devices, we saw the need for an integrated approach, combining the new European standard for those devices with the UK’s own child data protection regime, and were awarded a modest grant to create the Internet of Toys Certification Scheme.
It was a little ahead of its time. It quickly became clear that suppliers would not voluntarily incur the expense of certification until it was legally required – but the scheme stands ready for that day.
From a risk perspective, smart and connected technology will dramatically increase the scale of personal data created, shared, stored and exploited. When toys are involved, this inevitably going to include children’s data, for which specific legislative and regulatory protections have been created. The scope for harm to children from the advent of these devices placed in their hands is enormous. For example, they can allow children to communicate with strangers, by text, voice or video. They can enable surveillance. They can be hijacked to instruct children to do certain things, perhaps with the request coming from what the child sees as a cuddly friend. In fact, the more you consider the potential for harm, the more horrified any parent would become.
We developed the Internet of Toys Assurance Scheme for connected toys likely to be used by children aged under 18, and, critically, the associated online services that facilitate them.
It is operated as a Conformity Assessment Scheme accredited by the United Kingdom Accreditation Service (UKAS).
Uniquely, the Scheme combines the requirements of the latest European standard, ETSI EN 303 645 and the UK Code of Practice for the Internet of Things with the Age Appropriate Design Code (“AADC”) and GDPR Certification.
Integrating assurance against both codes ensures that connected devices likely to be used by children are secure, with particular emphasis on protecting the data rights of children and reducing the associated risk of online harms. Once the latest legislation is in force, this will be reflected in the scheme rules.
If necessary, the Scheme will further evolve to incorporate the demands of the forthcoming UK Online Harms Bill. In the development of our assurance scheme, we aligned the Scheme with broader UK conformity assessment of toys. This was to ensure a ‘one-stop shop’ assurance scheme for compliance with relevant legislation for connected toys, and potentially allow for use of “UKCA”, the successor to the CE mark in 2023, indicating that a device is comprehensively compliant.
We also created a self-certification option for lower risk connected toys, to ensure that price was not a prohibitive factor.
Give the scale of the task, only a co-regulation approach, advocated by the UK government’s Better Regulation Taskforce, can be effective.
This encourages the private sector to develop standards, and then to undertake audits and achieve certification against those standards which is, in turn, recognised by the regulator and the courts as effective due diligence by the manufacturers and distributors involved, mitigating penalties in case of transgressions.
This approach allows a regulator to focus limited resources on companies that do not engage with that process, and are therefore less likely to be compliant and are higher risk.
We worked closely with toy manufacturers and their representatives as we developed the certification scheme, and they were clear that they wished to avoid a need to certify their toys twice – once for the EU and again for the UK. We designed the scheme to address both needs.
They also voiced concerns that any new regulations would be followed by reputable suppliers, but ignored by those who sell through online markets and import directly to the consumer. Our scheme could be made a requirement by such online markets for any of their retailers that sell connected toys, with automated checks possible against the registry of certified suppliers.
I trust that this forms useful evidence for your inquiry. We have substantial additional materials, knowledge and insight into this issue, which we would be very happy to share with the Committee.
Please do get in touch if you require any further information or clarification of the contents of our response.
Age Check Certification Scheme Limited t/a
Internet of Toys Certification Scheme