IEEE Technology and Society Magazine - December 2021 - 105

take responsibility if they misuse or compromise
personal information [41]. And, a vast majority of
people think: 1) their personal data are less secure
now; 2) the risks of data collection outweigh the
benefits; and 3) it is virtually impossible to avoid
being tracked daily [41].
In this sense, Toronto is not unique: people are
demanding privacy, and advocates will fight against
companies and governments to secure their personal
information. Consequently, one way in which
the public is already making a stand is by pushing
for data privacy legislation, which can pose a unique
problem for the IoT.
Proposed legislation
Like many emerging technologies, the IoT is subject
to the " pacing problem, " whereby technology is
advancing much faster than applicable legislative
and regulatory institutions can keep up [42]. Consequently,
there is very little legislation or regulation
directly addressing the IoT. This lag in traditional
regulation is a necessary limitation, because premature
regulation that is poorly aligned with a rapidly
developing technology impedes beneficial innovation
[43].
The concern here is that if privacy and security
risks are not addressed, states and the federal government
will begin to pass legislation that will be
damaging to emerging technologies; developers will
have to overcome stifling innovation and increasing
hurdles, to achieve technological advancement [44].
Despite these consequences, the public, companies,
and government officials are beginning to join forces
in calling for stricter and clearer regulations in an
effort to limit unbounded private data collection.
For example, in July 2019, Microsoft became the first
tech giant to align with civil liberties advocates in
calling for federal regulations on facial recognition
[45], and widespread concern about the lack of
security and privacy controls in many IoT devices,
including in vehicles and smart cities, is driving the
push for more regulation of the IoT [46].
Legislative proposals are beginning to affect the
IoT directly. Most recently, the U.S. House of Representatives
unanimously passed the bipartisan Internet
of Things Cybersecurity Improvement Act of 2020
[47]. The Act is intended to create security standards
for the government purchase and use of all IoT
devices with the intent to create market pressure that
would improve IoT security standards more broadly
December 2021
[47]. The Smart IoT Act, introduced to the House in
2018, calls for a survey of the IoT industry, including
guidelines, standards, and efforts by federal agencies
to improve device connectivity [48]. And, the Cyber
Shield Act introduced in the House in 2019 would
establish a permanent advisory committee of cybersecurity
experts from academia, industry, and other
stakeholders to create cybersecurity benchmarks for
connected devices [48]. Additionally, California is
on the forefront of privacy regulation, requiring IoT
devices sold in the state to have security features that
protect the device and the data on it, in the first IoT
security-specific law to be enacted [48]-[50].
More legislation would threaten to impede
these technologies prematurely and permanently,
thereby limiting the reach and effectiveness of the
IoT. Without the development and implementation
of effective new governance processes through
soft law, the IoT could face a huge regulatory roadblock.
These three examples-that is, pushback
against facial recognition devices, concerns over
smart cities, and increasingly restrictive legislative
proposals-suggest that IoT technology, and the
litany of potential benefits that come with it, could
be unduly restricted if there are not more proactive
measures taken to protect IoT data security and
privacy. Importantly, " the adoption of IoT solutions
... depend[s] on organizations' capabilities to offer
systems that ensure adequate security levels while
guaranteeing sufficient user privacy, " [51] and soft
law offers the most promising solutions at this time
to make this a reality.
Soft law proposals
Soft law is " a variety of nonbinding norms and
techniques, " which include " instruments or arrangements
that create substantive expectations that are
not directly enforceable, unlike 'hard law' requirements
such as treaties and statutes " [52], [53].
Though not legally binding, soft law instruments are
informal governance mechanisms that can apply
equally to states, private firms, and nongovernmental
organizations and that are relatively easy to modify
in response to shifting norms and circumstances,
making them especially suitable to govern the IoT
[52]. These soft law measures are particularly salient
for a fast-moving technology such as the IoT, which
outpaces traditional regulatory approaches [19].
Yet, to be useful, soft law approaches must be both
effective in addressing privacy and security concerns
105
IEEE Technology and Society Magazine - December 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2021
