# **Endorsements**

*'Internet of Things and the Law* is an impressive work on several levels. It exposes inadequate consumer safeguards in the current "contractual quagmire" and complex, overlapping regulatory regimes governing the IOT. Noto La Diega masterfully analyzes the relevant privacy, intellectual property, telecommunications, competition, and internet laws as he explicates their implications and proposes reforms. But like an artist sweeping away an intricate mandala after he has completed it, Noto La Diega boldly recognizes the limits of law and proposes a utopian horizon for IOT governance based on a deep engagement with studies in political economy and social theory. This book not only advances our understanding of IOT policy but also serves as a model for future work in the law and political economy of technology policy.'

> *Professor Frank Pasquale, Brooklyn Law School, author of the bestseller* The Black Box Society

 '*Internet of Things and the Law: Legal Strategies for Consumer-Centric Smart Technologies* is a thorough exposition of the regulation of the Internet of Things which starts by expertly defining 'the Things' and the regulatory puzzles around them. Keeping the consumer front and centre, the book engages with a broad range of issues starting with 'Netflix Law, GeoBlocking and the personal/nonpersonal data binary. A strong case is made for a non-binary approach to regulation and for legal approaches, including contract law, consumer law, privacy law and intellectual property law, that mitigate the imbalances and vulnerabilities consumers are exposed to. Ultimately, Nota La Diega argues that the Commons for a Collectivised and Open IoT will take society beyond the limitations of these legal approaches. This is a timely and brilliant addition to scholarship that should inform forward-thinking regulatory approaches.'

> *Professor Caroline**B Ncube Professor and SARChI Research Chair in Intellectual Property, Innovation and Development, University of Cape Town* **,**

 'A wonderfully informative and deeply reflective study of the Internet of Things from a socio-legal perspective, presented to us by one of the leading experts in the field. Dr Guido Noto La Diega convincingly argues for an open IoT and points to some hopeful signs. The book should be read especially by those interested in how European law might effectively regulate an Internet dominated by 'Things' and how people acting collectively can harness their power to reshape the future.'

> *Professor Megan Richardson, Professor of Law, University of Melbourne, and Chief Investigator in the ARC Centre of Excellence for Automated Decision-Making and Society*

 'The only comprehensive and thorough legal analysis of IoT available as yet, which beautifully combines technological savvy with an admirable love for polemics'

> *Professor Marco Ricolfi, Co-Director of the Nexa Centre for Internet & Society; Professor of Commercial Law, Università degli Studi di Torino; Equity Partner at Weigmann Studio Legale*

# **Internet of Things and the Law**

*Internet of Things and the Law: Legal Strategies for Consumer-Centric Smart Technologies* is the most comprehensive and up-to-date analysis of the legal issues in the Internet of Things (IoT). For decades, the decreasing importance of tangible wealth and power – and the increasing significance of their disembodied counterparts – has been the subject of much legal research. For some time now, legal scholars have grappled with how laws drafted for tangible property and predigital 'offline' technologies can cope with dematerialisation, digitalisation, and the internet. As dematerialisation continues, this book aims to illuminate the opposite movement: rematerialisation, namely, the return of data, knowledge, and power within a physical 'smart' world. This development frames the book's central question: can the law steer rematerialisation in a human-centric and socially just direction? To answer it, the book focuses on the IoT, the sociotechnological phenomenon that is primarily responsible for this shift. After a thorough analysis of how existing laws can be interpreted to empower IoT end users, Noto La Diega leaves us with the fundamental question of what happens when the law fails us and concludes with a call for collective resistance against 'smart' capitalism.

**Dr Guido Noto La Diega** (he/they) is an award-winning Scotland-based Sicily-born academic with a passion for law and technology. They are Associate Professor of Intellectual Property and Privacy Law at the University of Stirling, Faculty of Arts and Humanities. At Stirling, Noto La Diega leads the Royal Society of Edinburgh Research Network SCOTLIN (Scottish Law and Innovation Network); is Deputy Chair of the Faculty's Equality, Diversity, and Inclusion Committee; and carries out research at the Centre for Research into Information, Surveillance, and Privacy (CRISP). Currently, they are leading the AHRC-DfG-funded international research project 'From Smart Technologies to Smart Consumer Laws: Comparative Perspectives from Germany and the United Kingdom', in partnership with the universities of Osnabrück, Warwick, and Bonn. Outside of Stirling, Noto La Diega is Member of the European Commission's Expert Group on AI and Data in Education and Training, Fellow of the Nexa Center for Internet and Society, Research Associate at the UCL Centre for Blockchain Technologies, and Co-Convenor of the Open Section of the Society of Legal Scholars, the oldest and largest society of law academics in the UK and the Republic of Ireland. Noto La Diega's main expertise is in Internet of Things, artificial intelligence, cloud computing, robotics, and blockchain. Their work is animated by the conviction that the law should be pivotal to human-centric, and socially just sustainable technologies.

# **Routledge Research in the Law of Emerging Technologies**

 **Biometrics, Surveillance and the Law**  Societies of Restricted Access, Discipline and Control  *Sara M. Smyth*

 **Artificial Intelligence, Healthcare, and the Law**

 Regulating Automation in Personal Care  *Eduard Fosch-Villaronga*

# **Health Data Privacy under the GDPR**

Big Data Challenges and Regulatory Responses  *Edited by Maria Tzanou*

# **Regulating Artificial Intelligence**

 Binary Ethics and the Law  *Dominika Ewa Harasimiuk and Tomasz Braun*

# **Cryptocurrencies and Regulatory Challenge**

 *Allan C. Hutchinson*

 **Regulating Artificial Intelligence in Industry**

 *Edited by Damian M. Bielicki*

## **The Law of Global Digitality**

 *Edited by Matthias C. Kettemann, Alexander Peukert and Indra Spiecker gen. Döhmann*

 **Internet of Things and the Law**

 Legal Strategies for Consumer-Centric Smart Technologies  *Guido Noto La Diega*

# **Internet of Things and the Law**

 Legal Strategies for Consumer-Centric Smart Technologies

 **Guido Noto La Diega**

The author wishes to thank the University of Stirling for generously supporting the publication of this book in open access.

 First published 2023 by Routledge 4 Park Square, Milton Park, Abingdon, Oxon OX14 4RN

 and by Routledge 605 Third Avenue, New York, NY 10158

*Routledge is an imprint of the Taylor & Francis Group, an informa business*

© 2023 Guido Noto La Diega

 The right of Guido Noto La Diega to be identified as author of this work has been asserted in accordance with sections 77 and 78 of the Copyright, Designs and Patents Act 1988.

The Open Access version of this book, available at www.taylorfrancis.com, has been made available under a Creative Commons Attribution (CC-BY) 4.0 International license. Funded by University of Stirling.

*Trademark notice* : Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe.

*British Library Cataloguing-in-Publication Data* A catalogue record for this book is available from the British Library

 ISBN: 978-1-138-60479-7 (hbk) ISBN: 978-1-032-30579-0 (pbk) ISBN: 978-0-429-46837-7 (ebk)

DOI: 10.4324/9780429468377

*To James: will you marry me?*

# **Contents**

*2.6 Interim Conclusion 115*

x *Contents*

# **3 The Internet of Contracts: The Tension between Consumer Contract Laws and IoT Imbalance** 117

# **4 The Internet of Vulnerabilities: Tackling Human and Product Vulnerabilities through Noncontractual Consumer Laws** 184

# **5 The Internet of Loos, the General Data Protection Regulation, and Digital Dispossession under Surveillance Capitalism** 235

# **6 The Internet of Things (You Don't Own) under Bourgeois Law: An Integrated Tactic to Rebalance Intellectual Property** 275

# **Conclusion: When the Law Fails Us: The Commons for a Collectivised and Open IoT** 341

*Index* 360

# **Introduction**

*[T]he establishment of the political state and the dissolution of civil society into independent individuals – whose relations with one another depend on law* . . . *is accomplished by one and the same act*.

Marx, *On the Jewish Question*

 For decades, the decreasing importance of tangible wealth and power – and the increasing significance of their intangible counterparts – has been the subject of much legal analysis.1 This evolution predates the digital economy (bonds, shares, etc.), but it is in the context of the current pervasive digitalisation that intellectual property (IP) has risen to the role of a prevalent form of wealth, which – combined with contractual and technological measures – allows for the control of key immaterial resources, such as software, algorithms, and even data itself. For some time now, legal scholars have grappled with how laws drafted for tangible property and predigital 'offline' technologies cope with dematerialisation, digitalisation, and the internet.2 This debate is far from reaching a definitive conclusion, as the frenzy surrounding non-fungible tokens (NFTs) is showing.3

1 See e.g. Alexander Peukert, *Güterzuordnung als Rechtsprinzip* (Mohr Siebeck 2008); Jan Jacob, *Ausschließlichkeitsrechte an immateriellen Gütern: eine kantische Rechtfertigung des Urheberrechts* (Mohr Siebeck 2010). More modestly, this was also the subject of Guido Noto La Diega, 'Il paradigma proprietario e l'appropriazione dell'immateriale' (PhD thesis, Università degli Studi di Palermo 2014).

 2 See M Scott Boone, 'Ubiquitous Computing, Virtual Worlds, and the Displacement of Property Rights' (2008) 4 ISJLP 91. On the challenges of cloud computing to right to property see Guido Noto La Diega, 'Il Cloud Computing. Alla Ricerca Del Diritto Perduto Nel Web 3.0' (2014) 2 Europa e diritto privato 577. More broadly on issues of 'new' property without control see Aaron Perzanowski and Jason M Schultz, *The End of Ownership: Personal Property in the Digital Economy*(The MIT Press 2016). The crucial issue of how traditional principles about jurisdiction apply online see Julia Hörnle, *Internet Jurisdiction: Law and Practice* (OUP 2021).

3 Joshua Fairfield, 'Tokenized: The Law of Non-Fungible Tokens and Unique Digital Property' (2022) 97(4) Indiana Law Journal 1261; Ifeanyi E Okonkwo, 'NFT, Copyright; and Intellectual Property Commercialisation' (2021) 29(4) IJLIT 296.

### 2 *Introduction*

As the dematerialisation continues, this book aims to illuminate the opposite development: rematerialisation,4 namely, the return of data, knowledge, and intangible power – that we tend to conceive as disembodied and displaced in cyberspace – to the physical world. This move begs the question whether the law steers rematerialisation in a human-centric and socially just direction. To answer it, I will focus on the sociotechnological phenomenon that is primarily responsible for this shift: the Internet of Things (IoT). 5

With smart devices (in this book referred to as 'Things') outnumbering human beings and with European spending in smart technologies exceeding EUR200 billion in 2021,6 the IoT is now past the hype. This sociotechnological reality promises to considerably improve our lives through a network of sensors and actuators deployed in the most disparate sectors, from healthcare through agriculture to transport and entertainment. In an IoT world, every Thing is connected to the internet, communicates automatically with other Things, transforms every aspect of our lives into computable information, and uses this information to act on the physical reality and produce often unforeseeable changes in the 'real' world. Some incidents attracted some publicity, e.g. hackers screaming at children through unsecured baby monitors,7 killer connected cars,8 and the transformation of hundreds of Things into remotely controlled bots to bring down a domain registration

service provider. 9 One can only imagine what would happen if malicious players exploited the 'smartness' of Things to remotely control a petrol station, a pacemaker, or an army of drones. The higher the degree of a Thing's autonomy, the higher the risks. For example, in March 2021 the UN Security Council revealed that for the first time a lethal autonomous weapon system had attacked a human target without being told to. 10 Alongside security and privacy, the IoT poses a threat to other fundamental values, from self-determination through dignity to freedom of expression and equality.

While there is growing interest for the IoT, 11 existing analyses tend to focus on individual issues – mainly privacy, 12 cybersecurity, 13 and competition law. 14 More comprehensive studies are US-centric,15 targeted at practitioners, 16 or no longer current, considering the speed of technological evolution and legal change.17 Some contributions have also explored the IoT alongside artificial intelligence (AI) and other technologies of the 'Fourth Industrial Revolution.'18 Against this

of Driverless Cars: Establishing a Framework for the Upcoming Technology' (2018) 54 Idaho Law Review 591.

 9 'The State of DDoS Weapons' ( *A10*, 2020) < www.a10networks.com/resources/reports/state-ddosweapons/>.

10 UN Security Council, 'Letter Dated 8 March 2021 from the Panel of Experts on Libya Established Pursuant to Resolution 1973 (2011) Addressed to the President of the Security Council' (S/2021/229).

 11 In terms of nonlegal literature, key references are Jeremy Rifkin, *The Zero Marginal Cost Society: The Internet of Things, the Collaborative Commons, and the Eclipse of Capitalism* (Palgrave Macmillan 2015); Philip N Howard, *Pax Technica: How the Internet of Things May Set Us Free or Lock Us Up* (YUP 2015); Bruce Schneier, *Click Here to Kill Everybody* (Norton 2018).

12 See e.g. Rolf H Weber, 'Internet of Things – New Security and Privacy Challenges' (2010) 26 Computer Law & Security Review 23; Aurelia Tamò-Larrieux, *Designing for Privacy and Its Legal Framework: Data Protection by Design and Default for the Internet of Things* (Springer 2018); Jatinder Singh and others, 'Accountability in the IoT: Systems, Law, and Ways Forward' (2018) 51 Computer 54; Nóra Ni Loideain, 'A Port in the Data-Sharing Storm: The GDPR and the Internet of Things' (2019) 4 Journal of Cyber Policy 178.

13 See e.g. J Singh and others, 'Twenty Security Considerations for Cloud-Supported Internet of Things' (2016) 3 IEEE Internet of Things Journal 269; David Lindsay and Evana Wright, 'Regulating Security for the Consumer Internet of Things (IoT)' (2020) 3 REDC 541.

14 See e.g. Marco Ricolfi, 'IoT and the Ages of Antitrust' (Nexa Center for Internet & Society 2017) Working paper nr 4/2017; Rupprecht Podszun, 'Standard Essential Patents and Antitrust Law in the Age of Standardisation and the Internet of Things: Shifting Paradigms' (2019) 50 IIC 720.

15 Joshua AT Fairfield, *Owned: Property, Privacy, and the New Digital Serfdom* (CUP 2017); Brett M Frischmann and Evan Selinger, *Re-Engineering Humanity* (CUP 2018); Shoshana Zuboff, *The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power* (PublicAffairs 2019); Cynthia H Cwik and others (eds), *The Internet of Things: Legal Issues, Policy, and Practical Strategies* (ABA 2019).

16 Cwik and others (n 15); Thaddeus Hoffmeister, *Internet of Things and the Law* (Practising Law Institute 2020).

17 Rolf H Weber and Romana Weber, *Internet of Things. Legal Perspectives* (Springer Berlin Heidelberg 2010).

18 Mireille Hildebrandt, *Smart Technologies and the End(s) of Law: Novel Entanglements of Law and Technology* (Elgar 2015); Frischmann and Selinger (n 15); Eduardo Magrani, *Laws and Ethics of Internet of Things and Artificial Intelligence* (Lambert 2019); Sebastian Lohsse, Reiner Schulze

## 4 *Introduction*

backdrop, *Internet of Things and the Law* differs to existing works as it is an updated comprehensive reflection on the IoT from a European sociolegal perspective and targeted at academics and law students. While this is first and foremost a research monograph, I believe that it can be of use to students as well. Indeed, nowadays it has become impossible to understand internet governance and information technology law without a thorough comprehension of the IoT. First, the IoT is a rapidly expanding area of the web, as suggested inter alia by the fact that IoT patents grow nearly seven times faster than other technologies. 19 Second, in recent years a deluge of laws (including standards and soft laws) has been introduced to regulate the IoT, directly or indirectly: these range from the Regulation on the Free Flow of Non-Personal Data to the UK's Code of Practice for Consumer IoT Security. Therefore, ignoring these laws would provide only a partial understanding of how the internet is governed.

This book builds on those contributions that have regarded the new extractive practices of the IoT as illustrative of the current stage of development of capitalism. Most famously, Shoshana Zuboff in her *Surveillance Capitalism* shed light on a new form of power generated by big data, an unprecedented threat to democratic values as it exiles persons from their own behaviour by creating new markets of behavioural prediction and modification.20 Zuboff creates a parallel with the industrial capitalism studied by Marx, but she posits that whereas the old capitalism fed on labour, IoT-powered capitalism 'feeds on every aspect of every human's experience.' 21 In fact, there is uninterrupted continuity between the old and the new capitalism, and the point of the IoT is to appropriate the previously uncapturable, thus transforming every aspect of human experience into labour. Indeed, it is now accepted that data is the main commodity, and we, as IoT users, can be regarded as data producers. By appropriating this commodity and controlling the means of production, surveillance capitalists treat us as industrial capitalists treat their workers – except now we are no longer aware of being workers.

IoT power, and the way big tech uses it, cannot be comprehended without looking also at those subjected to it. Humans use Things and are increasingly used – and transformed – by Things. This is where another major recent contribution to contemporary scholarship, *Re-engineering Humanity* by Brett Frischmann and Evan Selinger, steps is. The authors focus on how these companies use new technologies, including the IoT – rebranded 'smart techno-social environment' – to change those subjected to power: us. The IoT risks erasing the ' *freedom to be off*, to be free from systemic, environmentally architected human engineering.'22 Building on this analysis, it is vital to understand how to de-engineer humanity.

and Dirk Staudenmayer (eds), *Liability for Artificial Intelligence and the Internet of Things: Münster Colloquia on EU Law and the Digital Economy IV* (Hart 2019).

19 Intellectual Property Office, 'Eight Great Technologies. The Internet of Things. A Patent Overview' (2014) UKIPO 6.

20 Zuboff (n 15) 8.

21 ibid 16.

22 Frischmann and Selinger (n 15) 124.

To this end, alongside understanding power and its subjects, one needs to closely scrutinise how the law mediates the relationship. In this sense, an unavoidable reference is to the germinal book *Between Truth and Power* by Julie E. Cohen, who focuses on how the law is changing in the networked information age. Law is closely intertwined with code (or design) and political economy: 'through their capacities to authorize, channel, and modulate information flows and behaviour patterns, code and law *mediate* between truth and power.' 23 This approach builds on a tradition that goes back to Lawrence Lessig's *Code*, 24 which famously regarded code – the binary code that shapes the internet – as a new form of regulation. More recently, Roger Brownsword and Karen Yeung observed that we need to reimagine legal rules as one element of a larger regulatory environment of which technological management is also part.25 While building on these three streams of literature, this book further advances knowledge by understanding power, humans, law, and technology as inextricably connected and each capable of affecting and being affected by the others.

The impact of the IoT on the law is not limited to the rethinking of the concept of law to include techno-regulation. The IoT disrupts many of the dichotomies upon which the law was built, most notably good-service, hardware-software, tangible-intangible, consumer-trader, consumer-worker, human-machine, securitycybersecurity, online-offline. As noted by Mireille Hildebrandt, smart environments engender novel types of regulation, which usher in the 'onli*f*e' world: the IoT is not simply a technological infrastructure; it is 'a transformative life world, situated beyond the increasingly artificial distinction between online and offline.' 26 The IoT's smartness means that Things will be executing their own programs and negotiating with each other to achieve their own goals. This makes it imperative to 'address [smart] environments or their constitutive elements as agents that we need to hold responsible for the harm they cause, for their *lack of fairness*.'27 More generally, the fact that the IoT is troubling the binary categories that underpin the law calls for a rigorous legal analysis to critically assess whether the law can be 'queered'. By 'queering' the law, I mean the overcoming of the the aforementioned binaries through interpretation, legal design, or law reform. A queer approach requires also that the power dynamics hidden behind the 'smart' world be brought to life, which in turn means asking oneself whether traditional legal changes adequately curb the power of IoT capitalists or a more radical upheaval would be desirable.

Rematerialisation, the internal dynamics within the power-humans-law triad, the regulatory function of IoT code, and the tension between a non-binary

23 Julie E Cohen, *Between Truth and Power: The Legal Constructions of Informational Capitalism*  (OUP 2019) 13.

24 Lawrence Lessig, *Code* (Version 2.0, Basic Books 2006).

25 Roger Brownsword and Karen Yeung (eds), *Regulating Technologies: Legal Futures, Regulatory Frames and Technological Fixes* (Hart 2008); Roger Brownsword, *Law, Technology and Society: Re-Imagining the Regulatory Environment* (Routledge 2019); Karen Yeung and Martin Lodge (eds), *Algorithmic Regulation* (OUP 2019).

26 Hildebrandt (n 18) 8.

27 ibid 27.

## 6 *Introduction*

sociotechnological phenomenon and dichotomic regulatory mechanisms are only some of the reasons that made me embark on this writing journey. A final, crucial factor played a role. Internet studies have long explored the challenges and opportunities of the collection and use of information. The EU General Data Protection Regulation (GDPR)28 and prominent surveillance scandals have led to an abundance of research on data management, data science, and data ethics. These laudable endeavours have mostly focused on 'incoming data,' namely, on the transformation of real-world information into strings of code. However, to study the IoT means to account not only for how machines sense the world but also for how they act on it. As will be seen in the next chapter, being equipped with actuators is a core feature of Things. An example is provided by the automated border control systems that decide whether to open the door based on the matching of the passport's biometric data and facial recognition data. More trivial illustrations include a turning on of the lights based on location data, or a smart sprinkler watering the plants based on weather data. Zooming out, one starts to see how this constant two-directional flow – real world being transformed into computable information, information being used to change the real world – shows how the IoT is, at once, a global network of surveillance and a global infrastructure for the collective organisation of IoT users-cum-data producers-cum-workers. With the IoT, the factory becomes distributed and every aspect of one's life is commodified and rendered reprogrammable. Similar to industrial capitalists collectively organising labour in the factory, IoT big tech extracts value from our data by organising our digital labour at a systemic level.

This leads to the explanation of why I have adopted a methodology that can be loosely regarded as Marxist. At a higher level, as technological artefacts have politics29 – the most popular Things' politics being clearly neoliberal – and given that the IoT has been convincingly framed as the epitome of the current stage of capitalism,30 it makes only sense to adopt a Marxist lens. Indeed, Marxism remains the most compelling and comprehensive critical approach to capitalism, and Marx was the first to argue that technology is the primary influence on human social relations and organisational structure. 31 I would also put forward that a Marxist legal research method demands a sociolegal 'law in action' approach. As Roscoe Pound put it, lawyers need not to regard the law as 'the beginning of wisdom and the eternal jural order;'32 rather, we should 'look the facts of human conduct in the face (and) cease to assume that jurisprudence is self-sufficient.' 33 While Pound was mainly preoccupied with the relationship between common law and legislation, 'law in action' is nowadays construed as a nonnormative

33 ibid 35–36.

28 Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L 119/1.

29 Langdon Winner, 'Do Artifacts Have Politics?' (1980) 109 Daedalus 121.

30 Cohen (n 23).

31 For a nuanced analysis of technological determinism and Marxism, see Bruce Bimber, 'Karl Marx and the Three Faces of Technological Determinism' (1990) 20 Social Studies of Science 333.

32 Roscoe Pound, 'Law in Books and Law in Action' (1910) 44 Am L Rev 12, 35.

understanding of the many forms the law can take and operate in the real world. This is in line with the Marxist refusal of 'legal fetishism,' a common attitude whereby the law is depicted as a 'unique phenomenon which constitutes a discrete focus of study.' 34 The view that the law is only 'one aspect of a variety of political and social arrangements concerned with the manipulation of power and the consolidation of modes of production of wealth'35 for me is no reason not to study the nature of legal phenomena. Rather, it is an incentive to reflect on how power and socio-economic factors shape the law and how the latter governs – or, one may say, is governed by – emerging technologies, which in turn have become personalised regulatory tools in the hands of private rule-makers: the 'smart' platforms. To understand this new law in action, I have adopted a multipronged methodology, including semistructured interviews, subject access requests, text analysis of contracts, and autoethnography, as elucidated at the beginning of each chapter.

My approach can also be defined loosely as Marxist as it reconciles the historical materialist tenet that human behaviour is conditioned by external factors (mainly socio-economic ones) with the acknowledgement of the importance of conscious action in the transformation of societies. As the epigraph shows, the law had a crucial role in creating the state while dissolving – and depoliticising – civil society. 36 While the law imposed by the dominant classes is one of the factors that condition human behaviour, this does not mean that there is no room for organised action. In shedding light on how the IoT threatens humanity, and on the limitations of the law in dealing with it, this book intends to raise awareness – to heighten class consciousness, one would say in Marxist terms – about the risks of technologically driven capitalism, with the ultimate goal of a call to action to refute techno-legal solutionism and transform the IoT into an open and collective vision for a more just society.

With this in mind, I will endeavour to answer the following overarching question: how does the law mediate the power dynamics between IoT big tech and the end users, and can the law steer the development of the IoT in a human-centric and socially just direction?

\* \* \*

Like all knowledge, a book is a collective endeavour. I wish to thank Northumbria University for granting my sabbatical request, and the University of Stirling for a generous research allocation, and for funding the publication of Chapter 6 in open access. Thank you to the library and administrative staff at both universities for their outstanding professionalism. I am much obliged to Siobhán Poole, Sanjo Joseph Puthumana, Richard George and everyone at Routledge for believing in this project and being patient while I was missing all the deadlines partly due to deadly viruses, relocations, and job changes.

34 Hugh Collins, *Marxism and Law* (OUP 1984) 11.

35 ibid 13.

36 On the interdependence between the emergence of the autonomous state and the nonpolitical civil society in Marx, see Justin Rosenberg, *The Empire of Civil Society: A Critique of the Realist Theory of International Relations* (Verso 1994) 69.

### 8 *Introduction*

I owe a debt of gratitude to my *Maestro*, Luca Nivarra, and to all those who selflessly mentored me over these years, namely – in alphabetical order – Ray Arthur, Eva-Marina Bastian, Frances Burton, Enrico Camilleri, Lilian Edwards, Sue Farran, Martin Kretschmer, Dave McArdle, Christopher Millard, Lars Mosesson, Andrew Murray, Marina Nicolosi, Michele Perrino, Fabrizio Piraino, Jenny Preston, Chris Reed, Megan Richardson, Marco Ricolfi, Michael Stockdale, Alain Strowel, Elaine Sutherland, Ian Walden, Jason Whalley, Tony Ward, and Hong-Lin Yu. Thanks for leading by example!

In the years I have worked on this book, my students, PhD students, research assistants, supervisees and mentees have been a source of constant inspiration. Many of them have meanwhile become successful colleagues. It is impossible to name them all, but I wish to single out Rachel Allsopp, Valentina Borgese, Paolo Burdese, Luca Dell'Atti, Cameron Giles, Arletta Gorecka, Zoi Krokida, Zihao Li, Daria Onitiu, Alessia Palladino, Samantha Rasiah, David Sinclair, James Stacey, Pete Tiarks, and Giuseppe Zago. *Homines dum docent discunt*.

I wish to acknowledge the crucial role played by my research participants. An honourable mention goes to IoT leaders Alexandra Deschamps-Sonsino, Laura James, Joshua Montgomery, Peter Bihr, and Alasdair Davies. Thanks to you, I gained a better understanding of the IoT and of the importance of opening it up.

This book would not have been possible without the love and support of my family. Thank you, *madre* and *babbo*, for regarding my weirdness as uniqueness, for teaching me to embrace it and celebrate it. I wish to thank Dr James Crawford Bell, my amazing partner, who stood by me despite my erratic behaviour while working on this book, including waking up in the middle of the night to scribble confused ideas, most of which never made it into the final draft, fortunately. I could not have chosen a better (lockdown or otherwise) companion. Thank you for expressing your love through 'extensive notes.'

# **1 IoT Law**

# Obstacles and Alternatives in the Regulation of a Non-Binary Sociotechnological Phenomenon

 . *In the medieval guilds the master was prevented from becoming a capitalist by the guild regulations*

Marx, *Economic Manuscript of 1861–63*

# **1.1 Introduction**

 The IoT promises to improve our lives and realise the vision of a fully interconnected world, where we are constantly online, with easy access to a vast range of digital services and unprecedented new opportunities in every sector, from defence to healthcare. However, the IoT raises a number of issues that existing laws do not properly address for a number of reasons, most notably the reliance on outdated dichotomies (e.g. good-service) and principles (e.g. copyright's territoriality). These issues would require better and IoT-aware regulations to address questions of utmost importance, ranging from the problem of covert, ubiquitous surveillance to the liability for the harms produced by the unintended and automated interactions within and between IoT systems.

 , . When I started writing this book, I was reading Marx's *Economic Manuscript 1861–63* 1 from which the epigraph of this chapter is taken. The manuscript plays a 'very important' 2 role in the development of Marx's critique of political economy, a process that starts with the *London Notebooks of 1850–53*3 and ends with the *Capital* 4 Entitled by Marx *Zur Kritik der Politischen Ökonomie* (*A Contribution to the Critique of Political Economy* ) and consisting of 23 notebooks, the

DOI: 10.4324/9780429468377-2 This chapter has been made available under a CC-BY-4.0 license.

1 Karl Marx, 'Economic Manuscript of 1861–63. A Contribution to the Critique of Political Economy' in Karl Marx and Friedrich Engels (eds), *Collected Works* , vol 30 (Progress 1988).

2 Alex Callinicos, 'Marx's Unfinished But Magnificent Critique of Political Economy' (2018) 82 Science & Technology 139, 140.

3 These remain unpublished, but they are included in the Marx-Engels-Gesamtausgabe (MEGA) project and are set to be published in *MEGA* IV/7–11 according to Lucia Pradella, *Globalisation and the Critique of Political Economy: New Insights from Marx's Writings* (Routledge 2015) 6.

4 In this book, I will mainly refer to the Italian translation of *Capital* and in particular to Karl Marx, *Il Capitale (1867)*, vol 1 (Bruno Maffi tr, Aurelio Macchioro and Bruno Maffi, UTET 2008); Karl Marx, *Il Capitale (1885)* , vol 2 (Bruno Maffi ed, UTET 2009); Karl Marx, *Il capitale (1894)* , vol 3 (Bruno Maffi tr, Bruno Maffi, UTET 2009).

## 10 *IoT Law*

'path-breaking'5 manuscript can be regarded as the first systematic draft of all four volumes of *Capital*. 6 I was drawn to it for two reasons. First, the idea that the existence of regulations prevented feudal masters from becoming capitalists. If one compares it to the current regulation of the IoT, its piecemeal, outdated, and often unenforceable character reduces the ability to rein in IoT capitalism. Second, one of the key features of the *1861–63 Manuscript* is Marx's interest in the role of technology in the passage from manufacture to 'mechanical workshop' or industrial factory. 7 The difference between these stages lies in the technological revolution that, thanks to the passage from 'tool' to 'machine,' enabled the capitalist mode of production. The difference is pithily explained by Marx himself:

[O]nce the *tool is itself driven by a mechanism*, once the tool of the worker, his implement, of which the efficiency depends on his own skill, and which needs his labour as an intermediary in the working process, is converted into the tool of a mechanism, the machine has replaced the tool.8

The replacement of humans with machines in the handling of the tools is 'the material essence of the revolution of "mode of production."'9 The all-consuming labourer-machine relationship isolates the former, who confronts 'capital as an isolated individual, standing outside the social connection with his fellow workers;'10 the labourer confronts a thing, rather than the person of the capitalist. The machine is the labourer's ' *aggregate body, which exists outside him* . . . Human beings are merely the living accessories . . . of the unconscious but uniformly operating machinery.' 11 Under smart capitalism, this isolation and passivity of workers is worsened by the fact that the machine is no longer only the external body of the labourer when working in the factory: the machine is all around us, in our smart cities; reaches our most private spaces, in the smart home; and enters our own body under the guise of smart health. In a society where data is the most sought-after commodity, IoT users become round-theclock workers as they produce big data, thus generating value, whether they are aware of it or not.

Against this backdrop, this chapter will critically evaluate whether existing regulations do enough to protect us from the extractive practices of the IoT, whether they can rebalance our relationship vis-à-vis these ubiquitous 'smart' machines, whether they can prevent hyperconnectivity from making us feel like disconnected

7 Dussel (n 5) 169.

 machines. In doing so, it will tackle the book's overarching research question by answering the following subquestion: *what are the hurdles in the regulation of the IoT, and how is the EU rising to the challenge?*

# **PART 1 – IOT DEFINITION AND REGULATORY DIFFICULTIES**

#### **1.2 The IoT Today: Related Concepts, Definitions, and Core Features**

The core idea that underpins the 'Internet of Things' can be traced back to 1926, when Nikola Tesla imagined that devices simpler and more mobile than the traditional telephone would convert the Earth into a brain. One needs to wait until the seventies for the first 'Thing' to be developed. It was a Coke vending machine at the Carnegie Mellon Computer Science Department, and its microswitches enabled users to remotely double-check whether the machine was empty or full.12 Flash forward thirty years, Kevin Ashton coined the phrase 'Internet of Things' in a 1999 presentation for Procter & Gamble, where he linked the use of radio frequency identification (RFID) in that company's supply chain and the internet as a new, more reliable way for computers to collect data about the physical world with little, if any, human involvement. 13

Despite a not-so-recent history, there is no single commonly accepted definition of the IoT. 14 For the purpose of this book, and building on the Microsoft Cloud Computing Research Centre's approach 15 to the IoT, a 'Thing' is:

*An inextricable mixture of hardware, software, service, digital content, and data with (inter)connectivity, sensing, and actuating capabilities and interfacing the physical world*.

Although the IoT is an ever-changing and contested concept, this definition encompasses the main features that lawyers and regulators need to keep in mind:

a) *Physicality*. Whilst for decades innovation has been software-driven, with the IoT there is a return to the physical objects, now enhanced with computational

15 Noto La Diega and Walden (n 24).

12 Jay Patel, 'The Timeline of Things' (2015) 22 XRDS: Crossroads, The ACM Magazine for Students 13). Others claim that the first Thing was a 1991 camera-equipped coffee pot at the Trojan Lab at Cambridge University (Paul Ford, 'It's All Connected' [2013] United Hemispheres, as cited by Keith Marzullo, in Federal Trade Commission, 'Internet of Things: Privacy and Security in a Connected World' (2015) 15–16).

13 Kevin Ashton, 'That "Internet of Things" Thing' (2009) 22 RFID Journal 97.

14 Hugh Boyes and others, 'The Industrial Internet of Things (IIoT): An Analysis Framework' (2018) 101 Computers in Industry 1; Theo Lynn and others, 'The Internet of Things: Definitions, Key Concepts, and Reference Architectures' in Theo Lynn and others (eds), *The Cloud-to-Thing Continuum: Opportunities and Challenges in Cloud, Fog and Edge Computing* (Palgrave Macmillan 2020) 1.

# 12 *IoT Law*

power, connectivity, and sensing/actuating capabilities. If one overlooks the physical element, there is the risk of ignoring the issues that are specific to the IoT, which is increasingly enabled by – but should be kept distinct from – cloud computing, edge computing, AI, big data, and more recently, blockchain technologies.

liability issues will arise from the interaction between non-human actuators and human ones.

28 ibid 3.

## 14 *IoT Law*

claim that the internet had to be immune from the regulation of the offline. 33 This political option permeates the e-Commerce Directive,34 which grants online intermediaries some immunities for the illegal activities carried out by their users (so-called safe harbours).35 As an increasing number of traditionally offline intermediaries are embracing the IoT, thus becoming at least in principle eligible for the safe harbours, the scope of platform immunity could become much wider than originally foreseen.36

A feature that may not refer to all Things but that can have important legal repercussions is that most Things are made of several components (they are composite or compound). Even limiting the analysis to the hardware in itself, the Things' components have different manufacturers responsible for different aspects of any 'Thing of Things,' such as a smartphone, 37 'a composite, multi-purpose Thing, with component Things embedded in it including its touchscreen, microphone, and other sensors.'38 For example, should a plane equipped with 20,000 sensors be treated as a single Thing? 39 This creates huge issues of accountability, because it could be virtually impossible for a consumer to understand which component of the Thing caused harm and who is responsible for it. The manufacturer of the final Thing may try to use the composite and system-of-systems nature of the Thing to try to disclaim liability. 40 As a practical example of the legal ramifications of the Things' composite nature, one can think of wireless modules and the difficulties of complying with the relevant EU laws once these modules are no longer implemented only in laptops and mobile phones, but in any . . . Thing. Many manufactures of Things that embed third-party wireless modules which comply with the Radio Equipment Directive41 'assume that because these wireless modules are compliant as an independent unit, no further action is required, but this may not be the case.'42 Indeed, the integration of a wireless module into

a Thing 'changes the regulatory requirements,'43 as the host product as a whole must comply with this directive and the relevant standards,44 especially in terms of health and safety and electromagnetic compatibility. 45

Whereas to understand – and to regulate – the IoT it is important to agree on its core technical features, one should avoid exclusively technical conceptualisations.46 The IoT is a sociotechnological phenomenon for a twofold reason. First, in order to fully comprehend the IoT, one needs to focus on the interaction between the technology, human actors, and human processes. 47 In this vein, the European Commission High-Level Expert Group on Artificial Intelligence's *Ethics Guidelines for Trustworthy AI*48 deal with 'socio-technical systems' and accordingly put forward that technological trustworthiness not only concerns the AI system itself 'but requires a holistic and systemic approach, encompassing the trustworthiness of all actors and processes that are part of the system's socio-technical context.' 49 Second, especially now that the IoT is beyond the hype, it is clear that it is affecting society profoundly. This is related to its being an advanced form of technological management. Indeed, as noted by Brownsword,50 societal behaviour is increasingly managed by technological means. He underlined that technological management should not be allowed to run out of public control and called on tomorrow's jurists to 'rise to the challenge by helping their communities to grapple with the many questions raised by the accelerating transition from law (especially from the primary rules of law) to technological management.'51 With this book, I aspire to rise to that challenge.

#### **1.3 Two Reasons That It Is Difficult to Regulate**

There are several reasons that the IoT can be seen as a phenomenon too complex to regulate.52 The following subsections will focus on three of them that seem particularly important:

(i) The impossibility to agree on *one* IoT taxonomy as a consequence of the many and diverse application domains and enabling technologies;

43 ibid 14.

49 ibid 5.

These factors that render difficult to regulate the IoT will be explored in the next chapter in turn.

#### *1.3.1 A Kaleidoscope of Taxonomies: Sectoral Fragmentation and Enabling Technologies*

If the IoT were a homogenous phenomenon with clear boundaries, it would be relatively easy to regulate. However, the IoT is an amorphous mass that has applications in radically different domains, relies on a number of enabling technologies, pursues a diverse range of business objectives, and has several architectural requirements, platform types, and network topologies ( Figure 1.1 ).

For the purposes of this book, it is sufficient to focus on the first two complexities, starting off with the 'sectoral fragmentation,' i.e. the heterogeneity in IoT application domains. The regulation of other technologies is a relatively easy task when it is clear what the main sectors or applications are, as is the case, for example, with FinTech. 53 However, the IoT is used in manifold sectors, and each of them has different characteristics and raises different issues. The main IoT domains are transportation, e.g. driverless cars; domotics, popularly yet incorrectly dubbed 'smart home'; healthcare, e.g. implantable and ingestible Things; energy, e.g. smart grids; city development, i.e. so-called 'smart cities'; manufacturing, e.g. industrial robots; distribution, e.g. RFID tracking; retail, e.g. contactless payment systems; agriculture, e.g. irrigation systems; fitness, e.g. quantified-self Things; and leisure, e.g. augmented reality wearables. 54 Accordingly, it has been noted that whereas the IoT is being and will be shaped by the success of communications policy and regulation, as well as information policies, 'the IoT is likely to be applied in so many ways that policy and practice

53 However, the blockchain is increasingly multipurposed. See Michèle Finck, *Blockchain Regulation and Governance in Europe* (CUP 2018).

54 On some regulatory issues stemming from the IoT being a cross-technology and cross-application phenomenon, see H Song, GA Fink and S Jeschke, 'Overview of Security and Privacy in Cyber-Physical Systems' in *Security and Privacy in Cyber-Physical Systems: Foundations, Principles, and Applications* (IEEE 2017); Russ Banham, 'IoT Complexity' (2016) 63(6) Risk Management 38.

*Figure 1.1* Some taxonomies of the Internet of Things. The visualisation is mine; the source of the data is I Yaqoob and others, 'Internet of Things Architecture: Recent Advances, Taxonomy, Requirements, and Open Challenges' (2017) 24 IEEE Wireless Communications 10.

 will be reconfigured across nearly every sector of government, business and industry.' 55

Whilst the deployment of Things in all these sectors can improve our lives, 56 it nonetheless raises several issues that are specific to each sector, albeit partly overlapping. For example, privacy and security are likely to be relevant across the board, but with different issues, depending on whether the Thing is inside our body or in a field of daffodils. 57 Moreover, these sectors fall under the remit of different regulators that usually operate without any form of coordination. 58 To get a sense of the problem, one should observe the fragmented approaches of Ofcom, the UK's communications regulator, in dealing with issues of spectrum; 59 Ofgem, the energy regulator, with smart meters; 60 the Centre for Connected and Autonomous Vehicles (UK Department for Transport) with self-driving cars; 61 and the UK Civil Aviation Authority with drones. 62 This begs the question if a holistic regulation is at all possible or sectoral regulations are the way forward. The status quo seems to suggest that the latter is the only option, although it is highly unsatisfactory because the IoT sectors overlap and many Things can be deployed in several sectors (e.g. are robots to be regulated as manufacturing, domotics, healthcare, leisure?). At the end of this chapter, a third way to regulate the IoT – not properly holistic, not entirely sectoral – will be proposed.

The fragmentation of the IoT does not depend only on the Things being designed for deployment in several sectors. Things can be made and/or provided for certain purposes but may end up serving other potentially unforeseen purposes. This is a consequence of what I call 'repurposing,'63 i.e. a critical characteristic of IoT

55 Dutton (n 74) 4.

systems, dependent on their (inter)connectivity and system-of-systems dimension. 'Repurposing' can be understood as the phenomenon whereby an IoT system ends up being used for purposes other than those originally foreseen in two scenarios:

A sectoral approach to regulation presupposes a static and isolated view of Things as devices that can be used only for foreseeable purposes and that are not part of a system of Things or of a system of systems. This is not the case, and for example, a wristband designed for leisure and sport purposes can become a health device, depending on the context and the interactions with other Things.

The technical complexity is another reason of the difficulty to agree on a single IoT taxonomy. At a higher level, this means that despite the IoT being advertised as making things simple,64 the technologies involved are often unknown to the general public, which may now be familiar with the meaning of cloud computing but could still not understand what the meaning of RFID, Near-Field Communication (NFC),65 Low Energy Bluetooth (LEB), and ZigBee is. 66 Education is needed to raise awareness on, and therefore trust in, the IoT. Technical complexity also means that computer scientists and engineers are still struggling with some technical aspects, for instance, those related to hardware constraints (small interfaces, reduced energy autonomy, difficulties in encryption), multitenancy (every Thing can be controlled by several people in numerous – potentially conflicting – ways), and the importance of tracking data throughout the systemic flow, thus ensuring integrity and validity (e.g. information flow control,67 sticky policies,68 etc.). The

## 20 *IoT Law*

technical complexity of the IoT begs some foundational questions. Can regulation resolve the technical problems of the IoT? Is it wise to regulate a phenomenon that is too complex to be fully understood and that has not reached maturity yet? Should regulation prevent the deployment of Things whose underlying technologies are still in their early stages and thus vulnerable? Some solutions may be provided by the technology itself; others will require legal change. It seems increasingly clear that any strategy that relies either only on technological solutions or on legal solutions would be affected by reductionist regulatory trends that go by the name of techno-legal solutionism.69

Understanding the enabling technologies of the IoT is important for a proper regulation of the phenomenon. Among these, connectivity deserves separate attention because it is crucial for the existence itself of the IoT and it is linked to interoperability (or lack thereof); that is one of the main reasons that it is important, yet difficult, to regulate. Things that do not connect and are not interoperable lead to what we can call the Internet of Silos, which is due mainly to two factors. First, IoT data is often held in 'silos' that are 'difficult to integrate without time-consuming data discovery and licensing.'70 Second, IoT platforms can be vendor- and industry-specific, with few opportunities for smaller businesses to join.71 Things are heterogeneous, and for their connectivity to function, 'different networking and communication technologies are used,'72 such as softwaredefined networking,73 cellular, 74 low-range wireless area network,75 IPv6 over

69 cf Lina Dencik and Arne Hintz, 'Civil Society in an Age of Surveillance: Beyond Techno-Legal Solutionism?' ( *Civil Society Futures*, 26 April 2017) < https://civilsocietyfutures.org/ civil-society-in-an-age-of-surveillance-beyond-techno-legal-solutionism/>.

70 Brown (n 79) 14.

Low-Power Wireless Personal Area Networks, 76 Neul,77 and Sigfox.78 One of the reasons of this proliferation is that in the IoT, 'there is not a single solution for all the possible connectivity needs.'79

The Internet of Silos constitutes a threat to the functioning of the IoT – for example, if Amazon Echo cannot control noninteroperable lightbulbs. However, it goes beyond this, and it can affect the security of the IoT and, hence, user safety. Autonomous cars provide a useful case study, in that a lack of communication between the Things inside the vehicle can lead to high degree of vulnerability. If the radar system does not trigger the electronic stability control, the car may not be able to ensure user safety in high-risk situations.80 The lack of interoperability is often due to the adoption of proprietary systems (e.g. Apple) 81 and to the limited development of generally accepted standards.82 On the face of it, the former may be dealt with from an antitrust perspective, for example, arguing an abuse of dominant position83 by the owner of a standard essential patent (SEP), as

## 22 *IoT Law*

will be explored in Chapter 6 . As to the latter, in September 2018, ISO published the world's first standard reference architecture for the IoT. 84 This document describes the generic characteristics of IoT systems, 85 a conceptual model outlining the key concepts of the IoT, 86 a reference model,87 and a set of architecture views, i.e. functional, system, networking, and usage view. Thus, it guides those who develop IoT systems and 'aims to give a better understanding of IoT systems to the stakeholders of such systems, including device manufacturers, application developers, customers and users.'88 This standard is a positive development, and it may lead to the adoption of a common language in the IoT world, thus ultimately favouring interoperability and overcoming the Internet of Silos. However, four critiques can be moved to this laudable effort.

First, there is a fragmented approach to the 'law by design' question. By 'law by design' we mean the adoption of technical and organisational measures to comply with relevant laws, from the initial moments of the design of the product or service. An example of this approach is data protection by design principle that has been mandated by the GDPR.89 The new ISO standard imperfectly deals with the 'law by design' question. For example, the standard considers compliance as one of the characteristics of an IoT system, and it refers to 'a variety of laws, policies or regulations.'90 However, this standard regards as relevant for the IoT only the regulations that deal with interoperability, safety, radio frequencies, and consumer protection. Surprisingly, especially given the rise of the data protection by design principle, data protection laws are not considered in the compliance section. They are, conversely, separately dealt with as trustworthiness-related characteristics. Another drawback of the standard is that it refers to 'personally identifiable information' (PII), a typically American way to refer to personal data. 91 This is problematic because PII is 'any information that (a) can be used to establish a link between the information and the natural person to whom such information relates,

90 ISO and IEC (n 18) 25.

87 The overall structure of the architecture's elements is broken down into an entity-based reference model and a domain-based one. More information ibid 42–44.

88 ibid 10.

89 GDPR, art 25.

91 On the differences between the US and the EU approach to data protection and a proposal to bridge them, see Paul M Schwartz and Daniel J Solove, 'Reconciling Personal Information in the United States and European Union Essay' (2014) 102 California Law Review 877.

or (b) is or can be directly or indirectly linked to a natural person.'92 Conversely, in the EU, *personal data* is broader in that it refers to 'any information relating to an identified or identifiable natural person.'93 To determine whether a natural person is identifiable, in the EU, account must be taken of 'all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.' 94 This suggests that compliance with the standard may expose the IoT controller to a violation of EU data protection laws.

Second, it is important to keep in mind that often, despite the existence of standards, if the market is oligopolistic, there can be issues of lack of interoperability linked to proprietary software, network effects, and lock-in. 95 These could be partly resolved by tweaking the Software Directive96 in order to expressly allow the 'sharing of interface specifications obtained by decompilation.'97 However, this does not necessarily resolve the problems created by other intellectual property rights (e.g. trade secrets), as well as by technological protection measures and contracts.98

Third, even though in theory this standard is 'neutral,' as it is usable by anyone in any context, it owes much to previous standards that were developed for different applications and stakeholders,99 namely, smart grids, 100 transport,101 and cities;102 thus, the result is necessarily affected and not genuinely neutral. Finally, several entities keep working on IoT standardisation in an uncoordinated fashion. These include AIOTI – the European Alliance for Internet of Things Innovation;

## 24 *IoT Law*

IIC – the Industrial Internet Consortium; ISO/IEC JTC 1 – Working Group 10 on the Internet of Things; ITU-T – International Telecommunications Union Joint Coordination Activity on Internet of Things and Smart Cities and Communities; as well as W3C – the World Wide Web consortium and their Web of Things interest group.103

The difficulty to identify one IoT taxonomy, because of the sectoral fragmentation and the technological complexity, is not the only reason that regulating the IoT is a complicated matter. Indeed, the intricacy of the supply chain is a key factor to consider.

A second element contributes to explain the difficulties in regulating the IoT and in understanding how existing laws apply to it: the intrinsically transnational character of the Things.

#### *1.3.2 Where Are the Things? Regulation, Law, and Jurisdiction in Intrinsically Transnational Systems*

As Bauman put it, in modern times, '(*p)ower can move with the speed of the electronic signal* – and so the time required for the movement of its essential ingredients has been reduced to instantaneity. For all practical purposes, *power has become truly exterritorial*.'104 With the IoT, power becomes fluid in the sense that it is both territorial and extraterritorial at the same time.

To understand who should regulate the IoT, which laws apply, and which court has jurisdiction, one should geographically locate the Thing at issue. This is no easy task, given that we are talking about an inextricable mixture of hardware, software, service, and data. To respond to the question 'Where is the Thing?' it is useful to go back to the beginning of the internet, when the legitimacy of national laws to regulate cyberspace was first called into question. Being that the IoT is a species of the genus 'Internet,' it inherits the issues of the latter, 105 although they can be exacerbated, as is the case with the matter at hand.

When the internet was invented, it was perceived as a stateless space where any traditional law had to be avoided because it could have nipped in the bud a nascent industry; traditionally territorial legal categories, it was argued, could not apply to the internet.106 Those days are long gone; the internet has become centralised and controlled by few transnational corporations that are often more powerful than states, and the latter have reacted with a proliferation of attempts to regulate the internet, with national authorities endeavouring to enforce domestic law beyond

103 Henri Barthel et al., 'GS1 and the Internet of Things' (2016).

104 Zygmunt Bauman, *Liquid Modernity* (Polity Press; Blackwell 2000) 10–11. Emphasis added.

105 ITU (n 18).

106 See, e.g. the calls on the government to leave cyberspace alone and the claim that the former had no sovereignty online, in John Perry Barlow, 'Declaration of Independence for Cyberspace.' For a criticism of his rhetorical strategies, see Aimée Hope Morrison, 'An Impossible Future: John Perry Barlow's "Declaration of the Independence of Cyberspace"' (2009) 11 New Media & Society 53.

their territories.107 The change in the industry legitimates a change in regulatory attitudes, but it does not justify the current attempts that are often uncoordinated, not technologically aware, bordering on vexatious. Internet regulation brings to mind the pamphlet *Yet Another Effort, Frenchmen, before You Call Yourselves Republicans*, included by the Marquis de Sade in his 1795 book *Philosophy in the Bedroom*. 108 There, one can find a passionate attack on universal laws, regarded as absurd and necessarily exceptional: 'the punishment of a man for violating a law which he cannot observe is no more just than the punishment of a blind man for failing to differentiate colors.' 109 It is fair to say that the many laws of the internet are intricate – and their attempts to extraterritorial enforcement so contradictory – that many companies operating online cannot be reasonably expected to comply with all the cyberlaws, whose colours, to recall de Sade's metaphor, they cannot see. Expecting such compliance would often require that these companies infringe upon Aristotle's principle of noncontradiction. 110

The IoT contributes to overcoming the depiction of the internet as stateless and lawless inasmuch as that depiction was predicated on the dichotomy between online and offline. 111 The rationale that the internet is a separate world where separate (no) rules apply becomes untenable when all of us have become constituent parts of the infosphere,112 constantly online through our Things, 113 nodes of the internet infrastructure.114 This has been regarded as a positive shift with potential for increased solidarity, empathy, and democratisation of the internet. 115 However, risks of loss of autonomy, self-determination, and privacy should not be overlooked.

Whereas there are good reasons to regulate the IoT, it is difficult to identify which authority has legitimacy to regulate, what the applicable law is, and which courts have jurisdiction116 in a context where hardware, software, service, and data are inextricably mixed and simultaneously online and offline, with each component and subcomponent potentially being owned, controlled, or provided by several private and public entities located in different countries. The task to

## 26 *IoT Law*

resolve complex cross-border issues has been traditionally undertaken by private international law. 117 However, perhaps surprisingly, most states' private international laws do not provide for jurisdictional claims over any internet content that can be accessed in their respective territories, let alone the application of their own laws.118 For this reason, this section will focus on four attempts to regulate the IoT in a way that accounts for the Things' intrinsically transnational dimension. These attempts regard data protection, cross-border portability of online content, geoblocking, and free flow of nonpersonal data.

When the legal issues in the IoT started being investigated, it became clear that a problem of utmost importance concerned cross-border data flows, 'which occur when IoT devices collect data about people in one jurisdiction and transmit it to another jurisdiction with different data protection laws for processing.' 119 Whilst this problem is not specific to the IoT, it becomes more pressing with Things that generate 'big machine data'120 and are intrinsically cross-border due to their architecture and supply chain. For example, these Things can automatically connect to other Things 121 and transmit information across borders,122 which begs the question, to what extent can liability be placed on those who cannot predict the data flows?123 This has practical consequences also in light of the case law epitomised by *Dow Jones & Co. Inc. v. Gutnic*124 based on the presumption that online publication is targeted to all states on the fact that '[h]owever broad may be the reach of any particular means of communication, those who make information accessible by a particular method do so knowing of the reach that their informa-

tion may have.'125 Such foreseeability would seem to be less certain in a time of automated IoT communications.

 A well-known way to deal with the issue is the GDPR's very broad extraterritorial application clause.126 Whilst the GDPR's extraterritorial clause could be seen as an extreme way of dealing with the transnational nature of many sociotechnological phenomena, including the IoT, the following section will deal with three understudied and overall more moderate strategies, all of which fall under the so-called Digital Single Market (DSM).127 The idea dates back to 2005, when the European Commission launched i2010, a strategy aiming primarily to 'establish a European information space, i.e. a true single market for the digital economy.' 128 Only three years later, however, during the midterm review, the Commission identified new themes to consider for a longer-term agenda for the EU that included, for the first time expressly, 'the DSM.' 129 The latter became a goal of the EU in 2015, when the *DSM Strategy*130 was launched with the aim to create a single market where 'the free movement of goods, persons, services and capital is ensured and where individuals and businesses can seamlessly access and exercise online activities,' irrespective of nationality or residence, pursuant to fair competition, consumer protection, and data protection. The pillars of the DSM strategy are access, environment, economy, and society. First, the implementation promises to lead to better access for consumers and businesses to digital goods and services across Europe. For example, the new Payment Services Directive131 made sure that new providers of innovative payment services could compete on equal terms,132 while ensuring high levels of security through strong customer authentication.133 Second,

125 ibid.

## 28 *IoT Law*

 it aims to create the right conditions and a level playing field for digital networks and innovative services to flourish (e.g. the end of roaming charges). 134 Third, it wants to maximise the growth potential of the digital economy. 135 For example, since 2019 online marketplaces and search engines must disclose the main parameters they use to rank goods and services.136 Whilst the DSM strategy may greatly benefit IoT stakeholders, it seems vitiated by the reliance on the same dichotomies that the IoT disrupted. The idea itself of a separate 'digital' strategy, for example, reflects the outdated view of a divide between online and offline.

The strategy has led to 28 legislative interventions,137 the most (in)famous138 of which is the EU reform of copyright,139 introducing the so-called upload filter140 and a new publishers' right. 141 Whilst sharing the concerns that this reform risks being useless if not dangerous,142 the DSM Copyright Directive does not tackle any of the cross-border issues that are important for the IoT. Therefore, the focus of this section will be on three other DSM measures that are relevant from a crossborder and IoT perspective: the reforms of portability of online content services, geoblocking, and free flow of nonpersonal data.

In 2020, the DSM strategy was rebranded 'European Digital Strategy' and led, most famously, to the Digital Services Act and the Digital Markets Act. 143

#### *<IP_ADDRESS> Netflix Law: The Cross-Border Service Portability Regulation and the Indirect Reform of Copyright's Territoriality: Ubiquitous Access to Online Content Services for Ubiquitous Computing*

Whereas providers of traditional 'offline' services have been relying on the EU Treaties' freedoms since at least 1974, 144 until recently the same was not always true for online services.145

The resulting fragmentation of the audiovisual media market was – and to some extent still is – mainly due to the principle of territoriality of copyright, including broadcasting rights.146 Most Europeans access copyright content, such as films and music online, increasingly through Things other than computers.147 Therefore, the resulting discriminatory practices adversely affected IoT providers and consumers, since the whole point of buying (or renting) a Thing and not a traditional device is to access its 'smart' components, which often entail audiovisual content. This is reflected in the rise of the concept of complex multimedia product in European jurisprudence.148 If a consumer travels from one member state to another and, by doing so, can no longer use the Thing because the audiovisual content becomes unavailable, this would profoundly affect the Thing as a whole. Let us imagine that a consumer buys an Amazon Echo in the UK and then relocates to Italy to write a book about the IoT; if the consumer can no longer access Echo's services, they are left with an expensive Coke can–shaped speaker.

A reform of copyright's principle of territoriality would have been the ideal way to overcome some of these issues. Instead, in June 2017 the EU introduced the Cross-Border Service Portability Regulation.149 This recognised that the 'proliferation of portable devices such as laptops, tablets and smartphones are increasingly facilitating the use of online content services by providing access to

Prohibition on General Monitoring Obligations on the Way to the Digital Services Act: Between Article 15 of the E-Commerce Directive and Article 17 of the Directive on Copyright in the DSM' (*SSRN*, 22 October 2020) < https://papers.ssrn.com/abstract=3717022 >.

147 Kantar Public, *Flash Eurobarometer 477a. Report 'Accessing Content Online and Cross-Border Portability of Online Content Services'* (European Commission 2019).

148 More on this in Chapter 6.

149 The Cross-Border Service Portability Regulation is applicable as of 20 March 2018.

## 30 *IoT Law*

them regardless of the location of consumers.'150 Accordingly, it introduced the cross-border portability of online content services, by ensuring that subscribers to portable, paid-for151 online content services (e.g. Netflix and Spotify) 'which are lawfully provided in their Member State of residence can access and use those services when temporarily present in a Member State other than their Member State of residence.'152 Thus, the regulation overcame the main barrier to the free movement of audiovisual content throughout the EU, which stemmed from the fact that the 'rights for the transmission of content protected by copyright or related rights, such as audiovisual works, are often licensed on a territorial basis.'153 This hinders the DSM because the acquisition of a licence for relevant rights is not always possible, in particular when rights in content are licensed on an exclusive basis.154

From this book's perspective, this regulation is relevant for at least six reasons. First, although this regulation does not have a provision on the territorial scope of the jurisdiction, it can be inferred that it only applies to the companies with an establishment in a member state and providing online content services to consumers in the European Economic Area. 155 Hence, a moderate approach to jurisdiction without overreaching risks. Second, more generally, it acknowledges the importance of ensuring ubiquitous access to audiovisual contents, broadcasts, and other protected works in an IoT world. Third, allowing lawful users of audiovisual content and broadcasts to retain access to the relevant online services if temporarily abroad is an insufficient response to the problems connected to copyright's territoriality, which would have been better resolved in the context of a copyright reform. The territoriality of copyright laws is still an issue that, if not adequately resolved, will keep preventing the IoT from growing. 156 Indeed, a more organic and ideally international reform of copyright, including territoriality and subject matter, 157 is needed because we live in an age where copyright materials circulate through digital flows that cross border continuously; in such an age, some preinternet principles are no longer fit for their purpose.158 Fourth, this regulation for

the first time openly confesses the real purpose of consumer laws, that is, not protecting consumers as such. Consumers are protected only as a means to the actual end of realising a more competitive market.159 Indeed, the opening of the regulation is adamant in stating that the reasons for ensuring seamless access to online content services throughout the EU are 'the smooth functioning of the internal market and . . . the effective application of the principles of free movement of persons and services.'160 Fifth, the Cross-Border Service Portability Regulation, like the GDPR,161 recognises that private ordering by means of contracts (including copyright licences) can frustrate the public interest, be it the fundamental rights to privacy and data protection or, in this instance, the principle of free competition. Indeed, it provides that '[a]ny *contractual provisions* . . . which are contrary to this Regulation, including those which prohibit cross-border portability of online content services or limit such portability to a specific time period, shall be *unenforceable*.'162 This legal innovation explains Netflix's vaguely worded terms of use, whereby

You may view the Netflix content primarily within the country in which you have established your account and only in geographic locations where we offer our service and have licensed such content. The content that may be available to watch will vary by geographic location and will change from time to time.163

These terms must be interpreted as not allowing restrictions for intra-EEA travellers. The unenforceability of contractual circumventions echoes similar provisions whereby contracts that purport to circumvent copyright defences are null and void.164 These are becoming increasingly common, as illustrated by the copyright in the DSM Directive. Nor are they limited to copyright and business-toconsumer contracts in the audiovisual market. For example, as of July 2020, the

159 The idea that consumer laws have the chief (hidden) purpose of fostering 'perfect' competition has already been argued by many scholars. See Luca Nivarra, *Diritto Privato e Capitalismo: Regole Giuridiche e Paradigmi Di Mercato* (Editoriale Scientifica 2010) 97; Armando Plaia, 'Profili Evolutivi Della Tutela Contrattuale' [2018] Eur Dir Priv 69. See the latter also for some useful bibliographic references (ibid 71, fn 8).

160 Cross-Border Service Portability Regulation, recital 1.

161 cf Case C-210/16 *Unabhangiges Landeszentrum fur Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH* [2019] 1 WLR 119.

162 Cross-Border Service Portability Regulation, art 7. Italics added.

163 Netflix Terms of Use, as of 1 January 2021 < https://help.netflix.com/legal/termsofuse >.

164 See e.g. Directive 2009/24/EC of 23 April 2009 on the legal protection of computer programs ('Software Directive') [2009] OJ L 111/16, art 8; Directive 96/9/EC of 11 March 1996 on the legal protection of databases ('Database Directive') [1996] OJ L 77/20, art 15. Positively, in introducing exceptions for text and data mining for research purposes, cross-border teaching, and preservation of cultural heritage, the C-DSM Directive provided that '[a]ny contractual provision contrary to the(se) exceptions . . . shall be unenforceable' (art 7).

## 32 *IoT Law*

Platform to Business Regulation165 imposes fairer and transparent terms in the relationships between business users and providers of online intermediation services. Non-compliant terms and changes without notice are 'null and void, that is, deemed to have never existed, with effects *erga omnes* and *ex tunc*.'166 Although this prevalence of statutory provisions on contractual terms does not apply across the board, it is hoped that it will become a standard feature of the regulation of online relationships as it contributes to tackling a power imbalance that the IoT has nothing but exacerbated.

Finally, the Cross-Border Service Portability Regulation's scope relies on the divide between free and paid-for services.167 The rationale of the exclusion of providers of online content services that are provided without payment of money is that these companies could not afford the 'disproportionate costs' 168 of compliance, for example, to implement a mechanism to verify the member state of residence of the subscribers.169 This may sound naive to those who are aware that, with the advent of the business models that have replaced subscription fees with the harnessing of the users' personal data, the free/paid-for distinction no longer holds.170

Another measure that tackles the tension between transnationality of Things and territoriality of laws is the Geoblocking Regulation,171 which can be seen as complementing the right to service portability.

#### *<IP_ADDRESS> The EU Ban on Unjustified Geoblocking or the Illusion of Realising a DSM without Reforming Intellectual Property Laws*

Applicable as of 3 December 2018, the Geoblocking Regulation ensures that consumers can access goods and services online without worrying about discrimination or geographically based restrictions. Traders would adopt geoblocking and other discriminatory practices that denied or limited access to goods or services by customers wishing to engage in cross-border transactions. Geoblocking occurs when these customers have no or limited access to other member states' traders' online interfaces (e.g. unavailable websites and apps).172 For example, an Echo Show bought in the UK may not provide access to Amazon's shopping interface

165 Regulation (EU) 2019/1150 of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services (P2B Regulation) [2019] OJ L 186/57.

if the user carried the device to Italy. 173 'Other discriminatory practices,' in turn, occurs when, despite the absence of objective reasons, certain traders apply different general conditions of access to their goods and services with respect to such customers from other member states.174 Linking back to the IoT, this would be the case if Google Home used the GPS sensor to offer personalised pricing.

To tackle the more general underlying problem, the Geoblocking Regulation introduced four main provisions, i.e. the prohibition to:

Overall, if implemented and enforced adequately, the Geoblocking Regulation may benefit IoT stakeholders and consumers because it prevents fragmentation and overcomes the online-offline divide, in that it applies to both online and offline sales of goods and services, 'as well as cases where these two channels are integrated.'175 However, there are at least three reasons for criticism.

First, the regulation does not outlaw geoblocking and discriminatory practices as such, but only to the extent and in the event that they are not objectively justified. What an *objective justification* means is not entirely clear. Article 4 defines certain situations 'where there can be no justified reason,'176 but it does not define the concept of 'objective justification.' For instance, traders are never justified when they discriminate against customers that seek to receive services from a trader, other than electronically supplied services, in a physical location within the territory of a member state where the trader operates.177 Even in these scenarios where the discrimination is considered unjustified by the regulation, geoblocking or differential treatment may still be allowed where an EU or national legal requirement (in compliance with EU law) obliges the trader to block access to the goods or services offered. 178 If understanding which discriminatory practices are unjustified is difficult, having a grasp of what is 'objectively justified' is a Sisyphean task. The regulation does not say much apart from the fact that '[d]ifferent

173 It is worth noting that this regulation no longer applies to the UK as of 1 January 2021.

174 Cross-Border Service Portability Regulation, recital 1.

175 European Commission, *Questions & Answers on the Geo-Blocking Regulation in the Context of e-Commerce* (European Union 2018) 10.

176 ibid 7.

177 Geoblocking Regulation, art 4(1)(c).

178 European Commission, *Geo-Blocking Regulation in the Context of e-Commerce* (n 335) 8, that makes the example a French website subject to an order issued by the French courts that prevents access to its website because of litigation on the use of trademarks in France.

# 34 *IoT Law*

treatment . . . should be based only on objective and well justified reasons.'179 The European Commission's guidance 180 does not meaningfully elaborate on this point. It tells the reader that the general prohibition of discrimination on grounds of nationality181 is specified by the Services Directive,182 which allows differences in the conditions of access where those differences are directly justified by objective criteria. Examples of these are the lack of the required IPRs in a particular territory and the additional costs incurred because of the distance involved or the technical characteristics of the provision of the service.183 To understand what can be objectively justified, one can also consider EU antitrust case law on discrimination of consumers by nationality and/or residence.184 For example, in the *Deutsche Post AG* case,185 the world's largest courier company was held to be abusively imposing discriminatory pricing to letter mail coming from the UK as 'different tariffs . . . cannot be justified on the basis of objective economic factors [as they do not have] sufficient or reasonable relationship to real costs or to the real value of the service provided.'186 The lack of guidance affects that same legal certainty that the regulation wanted to improve.187 For example, it is difficult to foresee how Alibaba's Transaction Service Agreement will play out in European courts as much as it provides that

The types of Online Transactions and other benefits, features and functions of the Transaction Services available to a registered member may vary for different countries and regions. No warranty or representation is given that the same type and extent of transactions, benefits, features and functions will be available to all members.188

This agreement cannot be interpreted as giving the Chinese e-commerce giant discretion as to carry out discriminatory practices, including geoblocking: they have to be based on objective and well-justified reasons.

182 Art 20(2).

186 ibid [127], [167].

Second, with regards to the prohibition to apply different general conditions to the access to goods and services, the weak point is that the provision does not apply to 'services the main feature of which is the provision of access to and use of copyright protected works or other protected subject matter.' 189 The regulation is designed not to affect the rules applicable in the field of copyright and neighbouring rights.190 It follows that copyright and other intellectual property rights (IPRs) may also nullify the effect of other geoblocking-related prohibitions. For example, the provision that allows the block of the access to online interfaces and the redirection when 'necessary in order to ensure compliance with a legal requirement'191 may be interpreted as meaning that said block and redirection are permitted when they have the purpose of protecting copyright materials. Given the fact that many aspects of a Thing are covered by IPRs, 192 it is fair to say that copyright – including licences and technical protection measures – may be used to factually reintroduce discriminatory access conditions for Thing users based on their nationality, residence, or establishment, thus effectively sidestepping the prohibition of geoblocking and other discriminatory practices. If the Cross-Border Service Portability Regulation was open to criticism because it constituted an indirect and imperfect way to reform copyright's territoriality, the Geoblocking Regulation is worse in that it rests on the illusion that IP-enabled discriminatory practices can be resolved without dealing with IP in the first place. Along the same lines, the latter regulation excludes audiovisual services from the scope of the regulation.193 This means that IoT manufacturers could geoblock some of their services, thus affecting the 'smartness' of the Thing as a whole. In November 2020, the Commission reported on the evaluation of this regulation.194 This could have been the opportunity to extend it to copyright content and audiovisual services; this would have greatly benefitted IoT stakeholders and consumers. Instead, the Commission concluded that, despite the potential benefits for consumers, the inclusion of copyright-protected content needs to be further assessed,195 and it

will launch a stakeholder dialogue with the audiovisual sector in order to improve consumers' access to audiovisual content across the EU. 196

Third, the geographical scope of the Geoblocking Regulation is not entirely clear. A passage in one of the recitals 197 reads that the regulation aims to further clarify the Services Directive by defining certain situations where different treatment based on nationality, place of residence, or place of establishment cannot be justified. However, geoblocking 'can also arise as a consequence of actions by traders established in third countries, which fall outside the scope of that Directive.'198 This, coupled with the fact that – unlike the Cross-Border Service Portability Regulation199 – 'service' is defined by referring to Article 57 TFEU and not also to Article 56 (only the latter refers to an establishment in the EU), creates the risk that the regulation may be interpreted as applicable to all online provision of goods and services within the European Economic Area (EEA) regardless of the establishment. Only purely internal situations, where all the relevant elements of the transaction are confined within one single member state, would be out of the scope.200 Should this be the case – as suggested by the European Commission's 201 and industry guidance202 – this would be an instance of jurisdictional overreach similar to the GDPR. By contrast, the DSM measure that will be analysed in the next section constitutes a more moderate solution to IoT's transnationality.

#### *<IP_ADDRESS> The Free-Flow of Nonpersonal Data Regulation between the Ban on Data Localisation Laws and the Outdated Personal/ Nonpersonal Data Binary*

To realise the DSM, the Commission felt that ensuring service portability and geoblocking was not enough. There was the need to address the portability of data as such; without it, there was the risk that, practically, IoT users could not avail themselves of service portability because services may be, in principle, portable, but data would still be locked in. It has been noted that '[l]imited user access to raw IoT data reduce(d) ability to switch providers (and to understand privacy implications).'203 To overcome this issue, the EU adopted another DSM measure:

196 Annette Broocks and others, 'Geo-Blocking: A Literature Review and New Evidence in Online Audio-Visual Services' (2020) JRC Digital Economy WP 2020–01.

197 Geoblocking Regulation, recital 4.

198 ibid.

199 Art 2(5).

the Free Flow of Non-Personal Data Regulation, applicable as of 28 May 2019, introducing some IoT-relevant news. Unlike the GDPR, it does not apply to the processing of data of generic 'data subjects who are in the Union'; instead, it applies only to those who formally reside or have an establishment in the EU. Moreover, the 'offering of goods or services' does not trigger EU jurisdiction; only the provision of services of electronic processing of nonpersonal data does.

The main innovation is that nonpersonal data can now be stored and processed anywhere in the EU, and accordingly, '[d]ata localisation requirements shall be prohibited.' For example, laws such as the Danish Bookkeeping Act imposing the storage of financial data of Danish citizens in Denmark or other Nordic country may need to be amended. This is important because Things produce considerable amounts of nonpersonal data (so-called industrial data),204 and data localisation laws would prevent the availability of all those Things whose data constantly flows from one member state to another and where storage (including cloud storage) may well take place in a country other than the manufacturer's. For example, if one uses an Amazon Thing, e.g. Echo or Kindle, the '[i]nformation provided to Amazon may be processed in the cloud to improve [one's] experience and [Amazon's] products and services, and may be stored on servers outside the country in which [one] live[s].'205

Another provision of interest for IoT stakeholders aims to make it easier for professional users to switch cloud service providers. It was felt that whereas consumer law already smoothens switching in business-to-consumer transactions,206 there were not similar provisions for business-to-business relationships. Therefore, the Free Flow of Non-Personal Data Regulation entrusted the Commission with the task of facilitating the adoption of codes of conduct that consider best practices for facilitating the switching of service providers and the portability of data in a structured, commonly used, and machine-readable format.207 Outsourcing at least part of the processing to cloud providers is a common practice in the IoT (hence the 'Cloud of Things'), 208 and ensuring the possibility of switching providers and port data, especially in open standard formats, will be crucial for better-quality and interoperable Things. 209 The codes of conduct should mandate open standard formats, 'where required or requested by the service provider receiving the data.'210 Since openness is pivotal to interoperability and the latter

 204 As recognised by the Free Flow of Non-Personal Data, '(t)he expanding Internet of Things, artificial intelligence and machine learning, represent major sources of non-personal data, for example as a result of their deployment in automated industrial production processes' (recital 9).

## 38 *IoT Law*

is crucial for the IoT to avoid the 'Internet of Silos,' it can be argued that the IoT requires openness. Accordingly, the codes of conduct should recommend open standards at least when cloud services are provided in an IoT context.

Finally, the Free Flow of Non-Personal Data Regulation acknowledges that the IoT is 'raising novel legal issues surrounding questions of access to and reuse of data, liability, ethics and solidarity.' 211 Perhaps the regulation itself was not the best place to deal with these issues, but it is to be hoped that from their awareness specific initiatives will follow.

The combination of personal data portability, 212 service portability, 213 ban on unjustified geoblocking,214 ban on data localisation requirements,215 and the principle of exhaustion216 may be useful for the development of the IoT, increasing user control over the Thing, facilitating its circulation throughout the EU, removing obstacles to full interoperability, and preventing lock-in. Full portability – of data, service, and content – will become even more important in the future IoT, when an increasing number of Things will be implanted in our body. If some of the components of one's smart insulin pump are not portable, this would ultimately impact the free movement of persons.

The strategy of complementing the GDPR with a separate ad hoc regulation on nonpersonal data could be criticised because of two dichotomies that the IoT is disrupting: personal-nonpersonal and good-service. This regulation relies on the assumption that whilst personal data should be protected, nonpersonal data are a commodity that should be subject to the usual free market imperatives.217 This approach is predicated on the dichotomy between personal and nonpersonal data. The latter is untenable because anonymisation does not always prevent reidentification,218 and in the IoT, ostensibly nonpersonal and even raw data can be combined to identify individuals.219 And indeed, the guidance that the

211 Free Flow of Non-Personal Data Regulation, recital 1. Alongside the IoT, this recital refers to other emerging technologies, i.e. artificial intelligence, autonomous systems, and 5G.

212 GDPR, art 20.

213 Cross-Border Portability Regulation, art 3.

European Commission offered about the Free Flow of Non-Personal Data Regulation recognised that in an IoT world, most datasets are comprised of personal and nonpersonal data.220 It has been convincingly argued 221 that the notion itself of nonpersonal data is problematic not only because datasets are mixed and the concept of personal data is fluid but also because there is the risk of firms exploiting regulatory rivalry, and data has economic value irrespective of its legal classification. Hopefully, the awareness that the personal/nonpersonal data dichotomy should be overcome will permeate future regulations and not only nonbinding guidelines.

As to the second critique – of relying on the good-service dichotomy – this applies in varying degrees also to the GDPR and other DSM measures, with the exception of the Geoblocking Regulation, which is the most IoT-friendly, at least from this standpoint. Indeed, it applies to activities regarding both services and goods,222 the latter being defined as 'any tangible movable item.'223 Accordingly, Things' providers and providers of subcomponents are not allowed to fragment the DSM and reduce consumer control over their Things by means of unjustified geoblocking measures. From the point of view of the goods-services dichotomy, the second most IoT-friendly regulation is the GDPR, which applies to the offering of goods and services.224 However, there is no GDPR definition of *goods*; therefore, there is no certainty as to whether all Things will fall under this regulation, although it is likely that they will be regarded either as goods or as services or both. In third place, the Free Flow of Non-Personal Data Regulation only refers to services and does not mention goods.225 Nonetheless, it can be argued that this regulation applies also to goods, because it applies not only to the processing of nonpersonal data provided as a service but also to the processing 'carried out by a natural or legal person residing or having an establishment in the Union for its own needs.'226 This may be interpreted as encompassing also the provision of goods. Finally, the least IoT-friendly DSM regulation is the Cross-Border Portability Regulation, in that it refers only to services and excludes the online sale of goods.227 This is consistent with other recent acts of digital regulation, such as the

223 Geoblocking Regulation, art 2(15); this provision excludes from the definition of goods only 'items sold by way of execution or otherwise by authority of law.'

220 European Commission, 'Free Flow of Non-Personal Data' (n 377). As example of mixed dataset, the guidance refers to 'data related to the Internet of Things, where some of the data allow assumptions to be made about identifiable individuals (e.g. presence at a particular address and usage pattern' (ibid [2.2]).

221 Inge Graef, Raphael Gellert and Martin Husovec, 'Towards a Holistic Regulatory Approach for the European Data Economy: Why the Illusive Notion of Non-Personal Data Is Counterproductive to Data Innovation' [2018] TILEC Discussion Paper No 2018–029 < https://papers.ssrn.com/ sol3/papers.cfm?abstract\_id=3256189>.

222 Geoblocking Regulation, arts 1, 2, 4.

224 GDPR, art 3(2)(a).

Digital Content Directive228 and the new Sale of Goods Directive,229 that are built on the dichotomies between goods-services and hardware-software; they will be analysed in Chapter 3 .

In conclusion, the transnational nature of the IoT requires legal approaches that strike a balance between the need for cross-border enforcement and the avoidance of excessive compliance burdens. While the GDPR's extraterritoriality may be excessive, it seems to exemplify a trend in internet governance, as confirmed recently by the proposed Artificial Intelligence Act. 230 Some of the DSM measures appear to be more moderate. The new rules in matters of service portability, geoblocking, and free flow of nonpersonal data may benefit IoT stakeholders and consumers. However, they rely on a number of dichotomies, such as onlineoffline, personal-nonpersonal, goods-services, that the IoT has contributed to call into question. In this sense, they appear to be already obsolete.

#### **PART II – THE EU IOT STRATEGY AND A CALL FOR A NON-BINARY APPROACH TO IOT REGULATION**

#### **1.4 Some Regulatory and Policy Options for an Interconnected World**

The IoT's sectoral fragmentation, partially standardised complex technologies, relational black box, and transnational nature make it difficult for policy- and lawmakers to regulate it. In line with current regulatory theory, 231 in this book 'regulation' is construed in a broad sense: as a set of commands, as deliberate state influence, and as all forms of social or economic influence. The main focus will be on self-regulation, coregulation, and regulation.

There are several issues in the IoT that require better regulation. The main such issues232 are interoperability, 233 the so-called contractual quagmire in which IoT

228 Directive (EU) 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services ('Digital Content Directive') [2019] OJ L 136/1.

 users inadvertently find themselves,234 privacy, 235 security, 236 market dominance and inadequate competition around firms,237 insufficient spectrum and internet protocol (IP) addresses for devices,238 lack of leadership on industry standards,239 responsibility and liability for harm,240 as well as technical education, appropriate regulation, and trust in the security of these systems.241

Whilst there is consensus as to the importance of at least some of these issues for the IoT to develop in a socially just way, 242 not all the countries and all the stakeholders agree on whether or not new regulations should be introduced, whether self-regulation may suffice, whether a body with IoT-related regulating and lawmaking powers would be needed, and if so, at which level, if national, regional, or international.243

There is a historical divide between the US and the EU about whether and how to regulate the internet.244 It should come as no surprise that the same applies to the debate about the regulation of the IoT, although in recent years the EU seems to be increasingly fascinated by the North-American preference for nonbinding instruments that go by the name of 'soft laws.' For the purposes of this book, 'soft law' means '[r]ules of conduct which, in principle, have no legally binding force but which nevertheless may have practical effects.' 245 In this sense, the next section will deal with the soft laws on the IoT, as encompassing policy documents, self-regulation (e.g. industry codes of conduct), techno-regulation (code as law and law by design), and research funding.

#### *1.4.1 Of Market-Led Self-Regulation, Soft Laws, Code, and Other Unsatisfactory Ways (Not) to Regulate the IoT*

In November 2013, the US Federal Trade Commission (FTC) held a multistakeholder workshop on *The Internet of Things: Privacy and Security in a Connected*

# 42 *IoT Law*

*World*. 246 The main perceived risks were unauthorised access and misuse of personal information, the potential for consumer-interfacing Things to facilitate attacks on other systems, and personal safety. However, the FTC reiterated the evergreen American idea that legislation stifles innovation. 247 This mantra has been blindly espoused by the UK government, which launched the Plan for Digital Regulation in July 2021. There, the government is adamant that deregulation and self-regulation are the way forward to promote innovation as '[p]olicymakers must *back innovation wherever they can by removing unnecessary regulation* . . . and considering non-regulatory measures.'248 In some instances, overregulation may be seen as stifling innovation. However, if innovation is not regulated in a timely fashion, there is the real risk of 'cementing of socially undesirable outcomes when vested interests are left too long unchecked.'249 Indeed, the window of time left in which to consider the manifold challenges of the IoT 'and to articulate a meaningful response to them . . . is closing.'250 This does not seem to preoccupy the FTC that reaches the perhaps deterministic, albeit back then arguable, conclusion that 'IoT-specific legislation at this stage would be premature.' 251 The FTC nonetheless recommended that, in more sensitive areas, existing laws be strengthened. In particular, the FTC ambitiously called on Congress to enact 'strong, flexible, and technology-neutral federal legislation to strengthen its existing data security enforcement tools and to provide notification to consumers when there is a security breach.'252 One year later, speaking at an event hosted by the Center for Data Innovation,253 many representatives recognised that the US risks losing to China and other competitors if they do not update laws that had been passed before the time of videocassette recorders.254 However, the concern 'not to snuff any of this great innovation out' 255 by means of strict security and privacy

laws seemed to prevail. Regrettably, these concerns prevented any meaningful regulation of the IoT, and the US is still one of the few countries without comprehensive and modern privacy and security laws, let alone IoT-aware laws.

In line with its market-oriented tradition, the FTC seemed more favourable to self-regulating the IoT256 rather than 'hard' solutions. This line seems to be prevailing. Currently, 'the regulation of the IoT is mainly based on self-regulation through business standards,'257 such as GS1's 258 Electronic Product Code and the relevant standards,259 which rest on concepts that are common in traditional regulations, such as consumer notice and consumer education.

For once, the EU pioneered this approach and favoured a 'soft' approach. This will be illustrated by reference to:

First, a nonbinding way to indirectly regulate the IoT is through funding of research and innovation. Indeed, one can posit that shaping the research agenda can affect the stakeholders' behaviour as profoundly as actual regulations. 260 As noted by the US National Institute of Standards and Technology (NIST), the chief incentivising mode to regulate new technologies is the offer of research and development funding to help companies securely adopt new technologies.261

The first EU-coordinated effort to support IoT research was the European Research Cluster on the Internet of Things (IERC) 262 that groups EU-funded projects263 aimed at defining 'a common vision and the IoT technology and development research challenges at the European level in the view of global development.'264 Launched in 2010, IERC's vision is to support an open, vibrant, and innovative IoT ecosystem 'which brings together the research community with the private sector

261 Moore (n 138).

# 44 *IoT Law*

companies and the end-users.'265 One of the main outputs of this research has been the so-called cluster study. 266 The latter mapped IoT innovation clusters in the EU and identified four types of clusters: geographical, virtual, thematic, and institutionalised. The study recommended that the European Commission intervene in four strategic areas: the identification of IoT risks, the development of standards, the creation of EU-wide communities through support to technology development, transfer, and platforms, and finally, the development of IoT ecosystems. 267 So far, not much, if anything, seems to have followed from these recommendations in terms of actions and policies.

Another coordinated effort to regulate the IoT through research funding has been the IoT European Platform Initiative (IoT-EPI), which was launched in 2016 to promote open and accessible IoT platforms through projects funded by the Horizon 2020 Programme.268 In order to achieve a vibrant and sustainable IoT ecosystem, the Commission funded seven projects that were seen as maximising the opportunities for platform development, interoperability, and information sharing.269 Most notably, IoT-EPI comprises:

Like IERC, IoT-EPI confirms that private stakeholders are at the heart of the EU IoT strategy. Indeed, the initiative is marketed as having a partner network of

266 JIIP et al., 'Study on Mapping Internet of Things Innovation Clusters in Europe' (2019) European Commission.

265 'Research & Innovation in Internet of Things' ( *European Commission*, 28 April 2016) < https:// ec.europa.eu/digital-single-market/en/research-innovation-iot>.

267 ibid 4.

120 established companies and organisations, and the funding calls are open for 'SMEs, startups, companies,'271 and, last and least of all, research centres or universities. The influence of private, usually corporate, stakeholder in shaping the EU research agenda is akin to an informal – and rather opaque – form of coregulation of the IoT. More transparent coregulatory initiatives will be presented later in this chapter.

Second, in March 2015, the European Commission launched the Alliance for Internet of Things Innovation (AIOTI), to support the creation of 'an innovative and *industry driven* European Internet of Things ecosystem.' 272 This led to some noteworthy work about standardisation and policy, including the IoT LSP Standard Framework Concepts,273 the IoT High Level Architecture, 274 and the AIOTI Position on Cybersecurity Act. 275 The former constitutes the alliance's main effort, and it has the aim to present the global dynamics and landscapes of standard-developing organisations and open-source software initiatives with ultimate goal of:

Whilst AIOTI has become an important IoT stakeholder in its own right and may play a crucial role in the development of a European IoT ecosystem, its mission currently seems far from being accomplished. Indeed, its work may lay the foundations for future standardisation initiatives and other soft laws, but it has not led, in itself, to proper standards. Nonetheless, AIOTI has been carrying out praiseworthy work in identifying standardisation gaps, which include operational strategies, such as deployment and its scalability, software update, sustainability and green technologies, and usability. 277

Third, one year after the setting up of AIOTI, in the context of the Digitising European Industry initiative,278 the European Commission published its main IoT-focused soft law instrument: *Advancing the Internet of Things in Europe*. 279

271 'IoT European Platforms Initiative' (n 429).

This Commission Staff Working Document specify the EU's IoT vision as based on a single market for the IoT, a thriving IoT ecosystem, and a human-centred IoT approach. First, the idea of an IoT single market translates into the commitment to make sure that Things can connect seamlessly and on a plug-and-play basis anywhere in the EU and scale up across borders.280 Second, in order to achieve a thriving IoT ecosystem, open platforms used across vertical silos will help communities of developers to innovate and IoT deployments in selected lead markets will be supported.281 Third, the Commission expressed the belief that Things must 'respect *European values, empowering people along with machines*  and businesses, thanks to high standards for the protection of personal data and security, visible notably through a "Trusted IoT" label.' 282 This is problematic for four reasons:

(iv) The 'Trusted IoT' label, as a demonstration of compliance to the Network Information Security (NIS) Directive's requirements, 287 may be useful, although it must be kept in mind that labelling has often failed to achieve its objectives.288

Fourth, one of the clearest – and most concerning – recent trends in internet governance is the ethical turn, as shown by the increasing reliance on ethics charters and value-sensitive design to complement or even replace legislation and oversight.289 While most ethical initiatives are not binding and can be criticised for this reason as they can do little to change corporate behaviour, a recent trend in internet governance is the enshrining of ethics into binding instruments. This can be seen most clearly in the field of AI, where the proposed Artificial Intelligence Act is the result of the commitment by the European Commission president to put forward '*legislative proposals* for a coordinated European approach to the human and *ethical implications of AI*.'290 Published in April 2021, the proposed act can be regarded as the legislative codification of the *Ethics Guidelines for Trustworthy AI*. 291 The use of binding ethical instruments is open to criticism for many reasons. For the purposes of this section, suffice it to note that the unification of law and ethics is worrying from a historical perspective. Indeed, this unification served the Nazi jurists as a means of extending the authority and power of the state to the control of personal convictions.292 Nazi law was based on the higher law of a declared Germanic sense of justice, which ended up liberating the judge from the 'inflexible framework of the law.' 293 Ultimately, as Hans Kelsen argued in *General Theory of Law and State*, if only 'just' law is law, legal systems are all morally justified.294 Needless to say, the intentions underpinning the idea of legislating on ethical AI do not share anything with the intentions of Nazi lawmakers. Nonetheless, we should all be aware of the dangers of governing new technologies by transforming ethics into law.

Social Robots as a Threat to Human Distinctiveness' (2016) 8 International Journal of Social Robotics 287).

287 Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union ('NIS Directive') [2016] OJ L 194/1.

288 Camilla C Erskine and Lyndhurst Collins, 'Eco-Labelling: Success or Failure?' (1997) 17 Environmentalist 125.

289 Lilian Edwards (ed), *Law, Policy and the Internet* (Hart 2019) ii.

290 'EU Guidelines on Ethics in Artificial Intelligence: Context and Implementation' ( *European Parliament*, 19 September 2019) < www.europarl.europa.eu/thinktank/en/document. html?reference=EPRS\_BRI(2019)640163>.

291 High-Level Expert Group on Artificial Intelligence (n 104).

292 Herlinde Pauer-Stauder, 'Law and Morality under Evil Conditions' (2012) 3 Jurisprudence 367, 370.

293 Christopher Theel, 'The Moral Rigour of Immorality: The Special Criminal Courts of the SS' in Wolfgang Bialas and Lothar Fritze (eds), *Nazi Ideology and Ethics* (Cambridge Scholars 2014) 343.

294 Hans Kelsen, *General Theory of Law and State* (Anders Wedberg tr, HUP 1945) 5.

## 48 *IoT Law*

Most manifestations of the ethical turn in technology governance are not binding. Ethical charters and manifestos abound in the field of the IoT. For example, researchers at ThingsCon, 295 a collective that promotes development of responsible IoT, have mapped around thirty 'ethical IoT' initiatives, such as the Arduino IoT Manifesto, 296 the Everyware Principles,297 and the IoT Bill of Rights. 298 The use of ethics to "regulate" the IoT can be criticised for a number of reasons, 299 but for the purposes of this book, one need only focus on the fact that ethics has been weaponised 'in support of deregulation, self-regulation or hands-off governance.'300 In this sense, 'ethics washing' acts as an ideological rhetoric device that lacks the strength of law and brings confusion to the regulatory discourse rather than solutions. However, the condemnation of ethics washing has led to a form of 'ethics bashing,' that is, 'the trivialization of ethics and moral philosophy now understood as discrete tools or pre-formed social structures such as ethics boards, self-governance schemes or stakeholder groups.'301 If ethics is used to complement regulation and not as a substitute, and if it takes the form of evidence-based participatory best practice rather than vague charters drafted with opaque methods, there are reasons to be open to it. One such positive application is the Edinburgh Initiative, i.e. the work of an Action Group on Governance and Ethics in assessing the use of a new IoT infrastructure at the University of Edinburgh. 302 Participatory and involving diverse actors, this initiative was underpinned by the belief that ethical precepts can be translated into procedures, guidelines, training, reflection, and support, which in turn can be can be used to '*augment* . . . *the application of legal requirements*, for example, accountability and transparency by means of other instruments that may be more adaptable to rapidly changing technologies.'303 In this initiative, ethics was instantiated by:

301 ibid 211.

Initiatives such as this are praiseworthy, but one can doubt that they can easily be exported and applied to other IoT sectors for at least two reasons. First, universities have a strong incentive in listening to and engaging with its main stakeholders, its students, on whose satisfaction the financial sustainability of the institution depends. Chapter 2 will present a hierarchy of incentives that shows how IoT companies will not adopt fair data practices unless they have strong incentives, either in terms of public exposure or in terms of financial pressure. Second, universities have a tradition in research ethics and can source in-house the expertise that may be necessary for the evaluation of its own practices.305 The same cannot be said for most commercial IoT applications. The Edinburgh initiative is also a reminder that the many instances of the ethical turn are 'often very siloed, when IoT is always a cross-cutting endeavour, with decisions about hardware, software, data, application area and users intertwined.'306

Lastly, the most recent and problematic form of self-regulation is the regulation by design.307 This is connected to the idea of (binary) code as the law of cyberspace, as famously put forward by Lawrence Lessig and his followers.308 The way the internet – and the IoT – is designed (e.g. which content Apple Watch's screen shows us or hides from us) affects us in a way that is similar to the way democratically produced laws impact citizens,309 despite code being developed in an untransparent and undemocratic way. 310 IoT's code, in particular, being ubiquitous and hidden in seemingly harmless everyday objects, has the potential to

304 ibid 8.

 regulate the citizens' behaviour in unforeseeable ways. It may sound like a stretch to argue that the idea of technologically regulating through Things was written in cyberspace's DNA; however, it is a fact that 'cyberspace' comes from 'cybernetics,' which comes from *kybernetiké téchne*, the art of control at a distance through devices.311 *Cybernetics* was coined by Norbert Weiner in 1948 to refer to the scientific study of control and communication in the animal and the machine.312 And control – or regulation by code (or by design) – at a distance through Things is what is happening with the IoT, where private companies seek to 'promote techno-regulation through design, algorithms and market-based contracts.'313

The relationship between self-regulation and code is relevant for at least two reasons. First, the possibility of self-governance depends on architectural features of the internet, and these are not always developed in democracy-supporting ways.314 Second, companies are increasingly expected to operate self-restraint 'by design.' This is perhaps best exemplified by the 'data protection by design' obligation under GDPR and by the UK government's *Code of Practice for Consumer IoT Security*. 315

The former requires data controllers to implement technical and organisational measures that embed data protection principles from the outset, i.e. from the conception and design of a product or service,316 Things included. This would mean, for example, that if the Thing contains cameras, these should not be hidden in order to prevent the Thing from becoming a means of covert surveillance. 317 'Data protection by design' has its roots in the 'privacy by design' 318 approach, which was entirely voluntary. With the GDPR, it has become a binding obligation and could be regarded as a form of coregulation, where the lawmaker sets forth the high-level principles and the data controllers transform them into design rules.

The 'by design' trend, however, goes beyond data protection, and most of it still qualifies as a form of self-regulation. The *Code of Practice for Consumer IoT*

*Security*, based on the Secure by Design report,319 is a prime example of this type. This code sets out steps for IoT manufacturers and other stakeholders to improve the security of consumer-interfacing Things by implementing thirteen guidelines, including no default passwords and minimisation of exposed attack surfaces.320 The fact that many Things are sold with universal default usernames and passwords leads to serious security issues; therefore, the requirement to sell Things with unique passwords is a positive move.321 As to the minimisation of exposed attack surfaces, Things should operate on the 'principle of least privilege'; 322 therefore, unused ports shall be closed, hardware shall not unnecessarily expose access, services shall not be available if not used, and code shall be minimised to the functionality necessary for the Thing to work. 323 At its core, the Code of Practice is a traditional self-regulatory 'soft' measure in that it is 'outcome-focused, rather than prescriptive, giving organisations the flexibility to innovate and implement security solutions appropriate for their products.'324 Whilst the effort may be laudable, it is peculiar to leave this to private companies' goodwill, as the security of Things 'is now as important as the physical security of our homes.' 325 The same can be said for the first globally applicable standard for consumer IoT security, released by the European Telecommunications Standards Institute in February 2019.326 It includes provisions storage of security-sensitive data, software integrity, and system resilience. 327 Such important things should not be left to the discretion of private corporations.

As IoT companies use design/code to regulate us, it makes sense to 'regulate' them through design/code. However, the idea that technology will resolve the problems created by technology is excessively optimistic. There are grounds for scepticism when technological design is presented as *the* solution to human rights problems; in this sense, regulation by design can be regarded as antagonistic to

319 Department for Digital, Culture, Media & Sport, 'Secure by Design' (2018).

320 Department for Digital, Culture, Media & Sport (n 113).

321 ibid. Guideline No 1.

actual regulation.328 Regulation by design suffers from a legitimacy gap. Indeed, as Langdon Winner 329 argued already in 1980, technologies embody power relations, and their design is an insufficiently democratic activity. The design of new technologies 'is so thoroughly biased . . . that it regularly produces results heralded as wonderful breakthroughs by some social interests and crushing setbacks by others,'330 which is a strong argument for more participatory methodologies 331 – what is usually missing both in the ethical turn and in regulation by design. Whilst refusing techno-solutionism, this book has been written on the assumption that 'by design' solutions can and should complement – though never replace – more traditional, 'hard' regulatory responses.

Self-regulation and, more generally, soft initiatives have the benefit of being more flexible than traditional top-down regulation and to follow the principle of subsidiarity. 332 Under this principle, a central authority or a transgovernmental network has a subsidiary function in handling only those tasks that cannot be handled by the self-regulatory authority. 333 Self-regulation and minimal state involvement have been seen as more efficient in dynamic, innovative industries. 334 However, the question is inherently political and at least five arguments can be made against a soft approach to IoT regulation. First, letting the (binary) code regulate itself means assuming absolute technological neutrality, but technology's social impact cannot be regarded as neutral.335 Second, the internet is characterised by economies of scale and network effects that have led to noncompetitive markets.336 The failures of antitrust jurisprudence in addressing patent abuses are a good illustration of this issue and will be analysed in Chapter 6 . Third, there is a democratic argument to regulate, since voters may 'not allow governments to ignore the social impact of this ubiquitous medium.'337 Fourth, it is in the nature of self-regulation to be nonbinding; indeed, it can act only as a form of moral suasion

330 ibid 125.

and when certain conditions occur, such as sanctions under contract or association rules.338 The flexibility of soft laws and self-regulation should not be the dominant factor in making decisions about regulation.339 Indeed, this ideological stance causes 'regulatory inertia'340 and 'legal procrastination'341 that are difficult to break without a substantial and public failure.342 Indeed, as IoT companies increasingly adopt business models based on big data and on the use of Things to further their marketing activities, 'their resistance to subsequent restriction of these activities will increase.'343 Finally, even more radically, it can be argued that self-regulation is not actual regulation. Indeed, a commonly accepted definition of 'regulation' is 'the sustained and focussed attempt to *alter the behaviour of others* according to standards or goals with the intention of producing a broadly identified outcome or outcomes, which may involve mechanisms of standardsetting, information-gathering and behaviour modification.'344 By definition, selfregulation cannot alter the behaviour of others as it is self-directed. Therefore, if we want IoT companies to act differently, external stimuli are needed.

Especially in markets where big tech such as Google, Apple, Facebook, and Amazon (GAFA) – and its Chinese counterparts, Baidu, Alibaba, Tencent, and Xiaomi (BATX) – dominate and have little or no incentives to self-restrict their behaviour, the argument can be put forward that hard laws are more suitable than soft laws. The need to regulate the behaviour of GAFA and BATX is a common thread in recent debates about how to counter illegal content online345 and whether to 'break' these companies, since fines do not exert any meaningful deterrence function.346 For example, in *United States v. Facebook*, 347 Facebook settled348 with the FTC a number of privacy violations. Under the settlement, the social networking site will have to pay a record \$5bn fine for data mishandling.

338 Hoppner and Gubanova (n 392).

## 54 *IoT Law*

However, Facebook reacted by immediately posting a \$2.6bn profit, which led to a 3% rebound of its stocks.349 Whilst this rise may be explained with the fact that the settlement would extinguish more than 26,000 consumer complaints against Facebook pending at the FTC,350 it is not unreasonable to see this as the confirmation that thinking to regulate big tech by means of fines is not a winning strategy.

Consumers' choices are increasingly determined by the products and the information that GAFA and BATX show on the 'digital shelf' (e.g. Amazon's Buy Box).351 With the IoT, this shelf is becoming smaller and smaller. Therefore, regulators should ask themselves new questions and think of new strategies to deal with abuses of power by IoT corporations. A good starting point would be to reflect on whether control over the design of the web and the underlying algorithms that attempt to monopolise our attention has become 'the latest tool in the landlord's toolbox.' 352 It would be naive to leave the regulation of the IoT to the market; indeed, GAFA, BATX, and other digital landlords that use algorithms and web design as the tools of a new enclosure tend to seek monopolistic rents and maximise profit at the expenses of smaller businesses and society at large. Schumpeter believed that technological innovation could cause a reduction in wealth and rent inequalities through powerful destruction.353 However, he himself acknowledged that this innovation often leads to temporary rents, which can, over time, become traditional monopolistic rents.354 Relying on the invisible hand of market to achieve the best good of all, without government interference, is a political choice that is no longer sustainable.355

In a context of IoT innovation dominated by few rent-seeking and fine-immune multinationals, transnational hard laws should be part of the regulatory strategy.