Control measure: There is clarity provided on who is processing the personal information and what their responsibilities are for all connected toys and devices.
Risk: Without clear data mapping to document the flow of information and contractual agreements (where appropriate) between all parties involved in providing and delivering the services, this may breach articles 5, 6, 15-22, 25 and 28 of the UK GDPR.
Ways to meet our expectations:
- Make it clear in privacy information who will process the personal information that the toy or device transmits via the network connection and what their data protection responsibilities are.
- Ensure appropriate contracts are in place that clearly outline controller and processor responsibilities if the online functionality or connected element of the toy or device is outsourced or ‘bought in’.
- Provide clear information to indicate that the product processes personal information at the point of sale and before device set-up.
- Ensure both the packaging of the physical product, and the product leaflet or instruction booklet (paper or digital), carry a clear indication (such as an icon) that the product is ‘connected’ and processes people’s personal information.
- Provide potential purchasers with the ability to view clear product privacy information, terms and conditions of use and other relevant information online, without having to purchase and set up the device first. This means they can make an informed decision about whether to buy the device in the first place.
- Communicate ‘just in time’ information to the child or their parent, for example:
- use auto-play audio messages;
- only allow default settings to be changed by a support app; or
- support interactive auto-bot ‘conversations’ with the user.
Options to consider:
- Provide focused or bite-sized privacy information for processing by connected devices.
- Provide information or explanations using graphics or visual content to support accessibility.