Data Collection

Criteria: I know what user information this company is collecting and when.

See this test in action:

• Smart lock
• Smart pressure cooker
• Smart baby monitor

Notes:

• Some devices may capture a category of information but not transmit that data to the service provider, instead using the data only locally on the device, or presenting it for the information of the owner.
• In such cases, that data capture may not be reported in the legal documents as being collected by the service provider.
• While we encourage companies to develop products that only store collected data locally on the device instead of transmitting data to the cloud, it is still a best practice for companies to inform users of all data that is collected, even if a piece of information does not leave the device.
• It is important to note that these indicators (like many of the others in the Digital Standard) measure only what the service provider says that they do in their own documents. They do not measure what data the product actually collects.

Methodology for Assessing Each Indicator

1) Disclosure of the type of user information collected.

• Obtain and review a copy of the service provider’s legal documents.
• Find the portion of the legal documents that describe what information the service provider collects in the course of operation of the product.
• If the legal documents are not clear about whether they apply to the “smart device” being evaluated, or only to the websites and other services of the service provider, limit grade to PARTIAL PASS.
• If the legal documents provide a description of precisely what user information the service provider collects, or describes the data in more generalized categories or types of information, mark PASS.
• If the legal documents do not describe data collected, or describe that data at such a high level as to be unhelpful for the consumer, mark FAIL.

2) Disclosure of how user information is collected.

• Obtain and review a copy of the service provider’s legal documents.
• Find the portions of the legal documents addressing information collection. This information may be specified on its own, but may also be mixed in with the descriptions of the types of data collected, so gathering the information from a few locations may be necessary.
• If the legal documents are not clear about whether they apply to the “smart device” being evaluated, or only to the websites and other services of the service provider, limit grade to PARTIAL PASS.
• Determine whether the documents describe the method for collecting each type of data listed in the disclosures. Note that there are some types of information for which the means of collection are self-evident, e.g. billing and contact information that is collected when a user creates an account with a service are obviously collected directly from the user. If the legal documents do not include such obvious methods of collection in such self-evident instances, but describe other methods of collection, mark PASS.
• If the legal documents describe how the information is collected for each type of data the service provider collects from the user, mark PASS.
• If the legal documents describe how the information is collected for some, but not all of the types of data the service provider collects from the user, mark PARTIAL PASS.
• If the legal documents do not describe how information is collected at all, mark FAIL.

3) Test the product's sensors to determine whether they give clear indication when they become activated.

• Examine product description, legal documents, and/or product advertising to collect a list of probable sensors included in the product.
• For each sensor that could collect personal information, take whatever steps are necessary to activate the sensor and look for indication of activation.
• If every sensor that could collect personal information displays some indication when it is activated, mark PASS.
• If the test can show that the device’s sensors activate but there is no clear indication for users, mark FAIL.