Version classiqueVersion mobile

L’Internet des objets

Pierre-Jean Benghozi
Sylvain Bureau
Françoise Massit-Folléa

The Internet of Things

Chapter 6

The necessity for adapting governance

Texte intégral

1Governance of technical systems is a major component of the governance of modern society. The objective of the World Summit on the Information Society (WSIS), held between 2003 and 2005 under the auspices of the United Nations, was to find the ways and means of providing “transparent, multilateral and democratic” Internet governance. This goal has not yet been reached although talks between stakeholders (States, corporations and civil society) continue within the framework of the Internet Governance Forum.

2Deliberation on the governance of the Internet of the Future is all the more essential in that it increases uncertainties about standards, i.e. generic RFID standards, standards applied to infrastructure networks, those applied to identifiers, and also sector-based business standards, legal standards, socio-cultural standards, health standards, etc. This will occur in a world where it is estimated that billions of people will log on in real-time.

3Contrary to what is shown in the chart below, governance is not just one uniform aspect of the IoT. On the contrary, governance encompasses technical, legal, economic and political issues.

Chart 3 Relationship of RFID research to policy issues

Chart 3 Relationship of RFID research to policy issues

Source: “Radio Frequency Identification tags Portfolio of European Research” (CE-INFSO 2006)

4France and Europe have a strong background in each of these fields. Some suggestions – drawing on principles such as interoperability, openness and end-to-end solutions – brought to the WSIS debate must at present still shape our approach and our decision-making. Europe’s legal apparatus and practice of cooperation must be assessed and perhaps improved, depending on future or current developments. In addition Europe has already produced research findings on the Internet and on converging technologies, in the fields of technology, law and ethics ; these should be made more widely available and used more effectively.

5The chart below shows the different domains in which, in our view, the Internet of Things widens or amplifies the issues raised by Internet governance as we know it.

Chart 4 IoT Governance

Chart 4 IoT Governance

6Before looking at technical standardization in more detail, let us recall that specific health standards regulate the exposure of the human body to electromagnetic fields. These include the European Recommendation (1999/519/CE), the 2004/40/CE Directive of the European Parliament and Council on the Protection of Workers, and the guidelines to limit exposure to electromagnetic radiation (EMR) given by the International Committee for Non-Ionising Radiation Protection.

Technical governance

IoT governance of standards

7International generic standards on RFID technologies have already been set. These concern, for example, electromagnetic compatibility, ways of encoding information, communication protocols between chip and interrogator, etc. Additional standards on conformity and sensors are currently being drawn up. However, it is open to any country or corporation to establish and promote standards, which could lead to imbalance or fragmentation in the global system of digital exchanges.

8Further, it is necessary to ensure the adaptation of Local Area Network (LAN) and Wide Area Network (WAN) infrastructure standards to RFID, insofar as it will be necessary for corporate information systems, and private and public networks to be interconnected. However, some new industries lag behind the more advanced (animal production, transportation) in sector-based standardization committees. Additionally, where the tagging of objects is concerned, all must agree on the principle of a unique identifier, and also on the way this identifier is attributed and used.

9Some have suggested that an independent agency or authority be given overall responsibility for this. Although standardization is a technical issue, it is clear that major struggles for influence underlie the choice and monitoring of one solution over another ; public authorities, albeit by their very nature the guarantor of general interest, are no exception to this rule, either in their own country, or internationally. All in all, it is preferable to remain vigilant regarding the openness of the standards chosen, and also regarding the open-mindedness of those responsible for standardization.

Governance of IoT frequencies

  • 1

10Where management of the spectrum is concerned, in 20021 the European Community made public a decision to harmonize the availability and allocation of the radio-electric spectrum band in favour of the domestic market (676/2002/EC). Passive chips present specific problems insofar as their bandwidth may be used by other wireless systems, such as Wi-Fi, Bluetooth, or ZigBee. However, there is even greater complexity in the case of decimetric waves : frequency management – currently carried out at national level – results in a need for more information to be made available in order to harmonize international regulations that are different or that undergo unanticipated changes. It is not certain that the discrepancy between ISO and EPC standards for air interfaces will be maintained.

11When frequencies are allocated it is necessary to arbitrate between different stakeholders in telecommunications, the media and the Internet, not so much for technical purposes but more for economic and political reasons. The review of the European Directive, “Telecoms package” – which appeared necessary – was difficult to bring about ; yet it is due to come into application by the end of 2008, and should establish new guidelines.

  • 2 See the portal
  • 3 See the Colloquium Spectrum Policy: Property or Commons? Stanford Law School, Stanford, California, (...)

12It is noteworthy that on the other side of the Atlantic, the situation is equally delicate : when Google launched the portal for the “free airwaves” campaign2, Lawrence Lessig, an eminent jurist and advocate of open Internet, called attention to the controversy on the Internet infrastructure as a “common good”3.

The governance of infrastructure networks

Identifying unregulated networks

13As already mentioned when discussing communication infrastructures, the Internet of Things federates an ever-increasing number of personal and local networks, regulated or not. This expansion will generate a wide variety of new networks, each with different types of architecture, interconnections and security levels ; for example, Wide Area Networks or Personal Area Networks, Body Area Networks, Ad Hoc Object Networks, all of which support their own specific application. This complexity will have to be overseen. In B2B, “private” networks (recognized in RFC 1918) are already considered subject to regulation when they intersect with public networks. Connectivity will therefore necessarily adapt, become more localised and flexible, and will also require reconfigurability solutions to be found.

Protecting the principle of neutrality (or end to end principle)

14In the face of attempts to actuate selective segmentation or to completely re-think the architecture of the Internet, we must bear in mind the positive impact of the end to end principle which has allowed “intelligence” to be placed at the end-nodes of the network. In fact, this responds to a triple imperative in terms of social innovation and economic development :

15– the need to ensure competition and the distribution of innovations over all segments of Internet architecture (not only for the content layer but also over the applications that are now the major vector of value creation on the Internet) ;

16– the need to authorize new isolated stakeholders and small structures to offer and distribute innovations on a large scale (as was the case for Web or peer-to-peer systems) ;

17– the need to promote innovation through anti-trust regulation of the Internet in order to allow newcomers to establish different business models.

Controlling the management of critical resources

  • 4 See the speech made by Mathieu Weill, CEO, French Network Information Centre, at the EGENI 2008 col (...)

18Transnational factors associated to managing critical Internet resources must be carefully examined. The Internet of Things implies the sudden entry of many new players who are less familiar with the principles and values that have so far made up the network4.

  • 5 Please refer to the S.I.A.I.G.E (information systems applied to competitive intelligence and econom (...)

19It is first necessary to develop open standards and not to rely solely on proprietary technologies. For example, the first ONS (Object Name System) developed by EPCglobal for RFID tags is modelled on the current DNS, with the same centralized tree structure and the same private application supplier (the American corporate VeriSign). But the system of object naming and addressing will spread well beyond the supply chains put in place by major retailers. In the words of an industry professional : “moving on to the generic notion of the Internet of Things leads us to consider alternative solutions or, at the very least, to compare the different solutions suggested for the same need”5.

  • 6 Speech delivered by Ms Valérie Pécresse, French Minister for Higher Education and Research, Decembe (...)

20Then, the orientation given by the creation of distributed roots should be maintained : as announced in December 2007, there will be a common platform GS1-EPCglobal and Orange Business Services for a French root of the ONS : “(it) plans to constitute the first European root of the Internet of Things. The next stage in the development of this initiative will concern the implementation of technologies which will make interoperability possible with the American root as well as with those that will be created soon in Asia and in the rest of the world”6.

21Close collaboration between public authorities and major economic stakeholders is at the core of this governance ; there is still a need for it to be harmonized at all levels (national, regional, international).

22Lastly, the general public must be involved in these developments. Consumers and citizens must be entitled to control the future uses of their personal data and to keep control over their personal environment.

Privacy : a technical, legal and ethical issue

23The IoT is based on the collection, compiling and processing of data pertaining to objects and, “if necessary” to the people using them. Integration of the Internet Protocol Address and the global positioning parameters are prerequisites to ensure progress in the transmission of information. Therefore, beyond the aspects of technical standardization, questions should be raised on the validation of identifiers, the status and ownership of data, and the measures that should be implemented to guarantee respect of privacy. Winning citizens’ trust is a major challenge we must face if as many people as possible are to reap the benefits of the Internet of the Future. Controversy is already strong as far as RFID is concerned, and we need to know whether the existing legal apparatus is appropriate and is applied in full measure, whether it is necessary to create “new rights”, or to render the different components of the law more effective.

24The following diagram provides an overview of the various problems relating to private life in the IoT.

Chart 5 Factors that will influence the protection of privacy with the development of the IoT

Chart 5 Factors that will influence the protection of privacy with the development of the IoT

Source: International Telecommunications Union

Evolving regulatory frameworks

The European public consultation on RFID

  • 7 cf.

25Regulatory frameworks governing the use of RFID still differ widely within the European Union. In 2007, the European Commission organised a broad consultation on the use of RFID7. It was decided not to implement any regulations on the “chip” market, but nonetheless the Commission wished to enable users to deactivate them. The implementation of this right to deactivation could have been obtained by modifying the legislation on the protection of personal data. However, as a common perception of privacy was lacking, and since no agreement could be reached on what is acceptable in terms of identification and profiling, up to this point it has been left to manufacturers to decide whether chips should be “silent” : they may include – or not – deactivation mechanisms depending on the cost-benefit analysis. The question of reversibility of chip deactivation has not yet been envisaged. However, other applicable instruments already exist over and above the implementation of a framework for RFID.

Monitoring e-commerce

26European Directive 2000/31/CE sets out the basic legal framework for e-commerce on the domestic market. This establishes consistent rules on requirements for transparency and information imposed on on-line service providers, advertisements and e-contracts ; it also limits the liability carried by suppliers of intermediary applications. In addition, The Guidelines for Consumer Protection in the Context of Electronic Commerce, published by the OECD in 1999, calls on companies to provide “accurate and direct information on the goods or services on offer, enabling consumers to decide whether they proceed with the transaction or not with full knowledge of the facts”. These principles governing general information will have to apply to all parties involved in supplying RFID chips to individuals.

Protection of Personal Data

27The OECD Guidelines on the Protection of Privacy, adopted in 1980, the OECD Recommendation on Cross-border Cooperation (2007), and United Nations General Assembly Resolution 45/95 (1990) are the result of an international consensus, although these protocols are not binding. Some of the principles and tools falling within the responsibility of public authorities could assist in their implementation where RFID is concerned. The International Organization for the Promotion of the French Language also considered this issue at its Summit in Bucharest in 2006.

28At international level, as early as 1980 the European Council established a Convention (108) protecting automatically processed personal data ; this was open to all countries (to date, there are 43 signatories). In 1995 the European Union issued a directive on the protection of data (95/46/EC). A further European Directive (2002/58/EC) applies to the processing of personal data through public services and communication networks. It is currently under review in order to take into account interconnections with private systems running RFID applications. The role of the European Data Protection Supervisor – an office created in 2004 – could be strengthened. Lastly, Article I-50 (6) in the Treaty on the European Union, relating to “democratic life in the Union”, reasserts that the Charter of Fundamental Rights of the European Union (2000 and 2007) has the same legal value as the Treaties and that the Union has signed the European Convention for the Protection of Human Rights and Fundamental Freedoms.

Data protection and the IoT

  • 8 The Working Party was established by Article 29 of Directive 95/46/EC. It is the independent EU Adv (...)

29At European level, the Working Party on Article 298, which brings together data protection authorities from all member states, reiterates that information collected and stored on RFID is subject to the rules established in the 1995 European Directive. Its core principles are clear : only relevant information should be collected, this must answer a specific need, and it can be kept only as long as is required to fulfil the specific need.

30Obtaining individuals’ consent prior to collecting information therefore appears to be a necessary condition ; it also seems necessary firstly to provide them with comprehensive information on why data is being collected and by whom, and secondly to ensure that they can access and modify the data collected.

31Particular attention is paid to the protection of children. The Working Party set up a Data Protection Charter that, over time, was extended to eighty French and Spanish-speaking countries. Some of its members consider that the European Convention could provide a blueprint for the establishment of an International Convention under the auspices of the United Nations. At national level and as early as 2003, the CNIL (the French Data Protection Authority) drew attention to four “traps” that could mask the crucial importance of “Data Protection” issues for the IoT :

32– the insignificance of the data (before it is collected and used),

33– the priority of needs (as long as applications relating to individuals are not implemented on a massive scale),

34– the fact that we are in a globalized world (in which the first entrants set the rules),

35– the fact that individuals do not exercise the caution necessary (because activation, entry and monitoring processes are all automated).

36Currently, the CNIL recommends that deactivation mechanisms for “intelligent tags” be installed in some situations, and be left to the free choice of the individual – which could prove a problem if this results in the neutralisation of applications used in the prevention of theft.

Continuing uncertainties

37Some aspects remain unclear however, and the harmonization of European public policies raises two crucial questions underlying the harmonization of techniques and fair market behaviour.

What is the “scope” of personal data ?

38The collection and processing of data via RFID technology falls into the scope of the 1995 European Directive only where the information stored on a chip may be defined as personal data. Interpretations can vary from country to country. It is important therefore to harmonize both at European and international levels.

39Additionally, some Member States do not include public security in the Directive. In this case, it is necessary to ensure that the level of protection described in Article 8 of the European Convention for Human Rights (“necessary, proportional and respectful of human dignity”) is guaranteed.

Who has control over files ?

40The legislation applies firstly to the protection of personal data ; but it does not deal with the consequences of the IoT on certain constitutional freedoms, specifically in the context of individual or group behaviour profiling applications that compile and cross-check data. The legal status given to the “profiles” built using data mining or search engines must be made clear. Further, because tags are invisible and permanent, most people will never know to what extent their personal data is collected and transmitted, and will have neither the time nor the necessary resources to exercise their right to know how the mechanisms function. It will therefore be essential to implement simplified systems that enable citizens to exercise their rights.

41Lastly, the swift development of the RFID system entails the dissemination of low cost chips with limited functionalities. There is a risk that this will limit efforts to build the “privacy by design” that Adam Greenfield claims. But it should not prevent the “chip market” from conforming to the respect of fundamental human rights.

Encouraging fair practice among professionals

  • 9 Future of Identity in the Information Society, cf.

42In order to ensure this principle, the various behaviour codes and other professional charters applied to new technology manufacturers now include certain additional elements introduced by the IoT. In this way, for example, EPCglobal, in its “Guidelines for Consumer Products” produced jointly with the International Chamber of Commerce, specifies that “consumers are clearly informed that there is an EPC (Electronic Product Code) on the product or the packaging, and will be informed of the use of EPC. Consumers will be informed through the opposition of a logo or an EPC identifier on the products or the packaging.” This is an example of a responsible approach that should be extended to the whole system, in all sectors involved, including public services. However, it does not completely allay fears that data could fall into the wrong hands or be misused. Some associations and researchers are developing a more comprehensive, or “holistic” approach – as put by the European research network FIDIS9, for instance.

Is it possible to determine rights and offences specific to the IoT ?

  • 10

43Among other examples, reports on the FIDIS project refer to a possible “RFID Bill of Rights” submitted by an American, Simon Garfinkel10, who lists consumer rights as the following :

44– the right to know if a product contains an RFID tag ;

45– the right to have “silent chips”, i.e., removed or deactivated after purchase ;

46– the right to use RFID-based services without RFID tags ;

47– the right to access data stored on chips ; and

48– the right to know when, where, and how the data is read.

49Application of these requirements should respond to user demands.

Laying the Ethical Basis for International Regulation of the IoT

  • 11 International Review of Information Ethics.

50As we are dealing with a global infrastructure and globalized activities when considering the Internet, we must have common core principles. However the wealth of historical, cultural, and religious backgrounds that determine the fundamental values of each society lead to significant complexity in questions of ethics. Notions of ownership and privacy are viewed differently in the Western World, Africa and Asia ; the use of cryptography remains illegal in some countries ; IoT R&D programs have different names, and the underlying political visions and technical options may differ. However, an increasing body of research has been conducted into the cross-cultural dimension of the ethics of information11 ; these findings are useful not only for conquering markets but also ensuring the effectiveness of public policies.



2 See the portal

3 See the Colloquium Spectrum Policy: Property or Commons? Stanford Law School, Stanford, California, 1-2 March 2003.

4 See the speech made by Mathieu Weill, CEO, French Network Information Centre, at the EGENI 2008 colloquium.

5 Please refer to the S.I.A.I.G.E (information systems applied to competitive intelligence and economic warfare) blog.

6 Speech delivered by Ms Valérie Pécresse, French Minister for Higher Education and Research, December 3 2007.

7 cf.

8 The Working Party was established by Article 29 of Directive 95/46/EC. It is the independent EU Advisory Body on Data Protection and Privacy.
Its main tasks may be summarized as follows:

– to provide expert opinion from member state level to the Commission on questions of data protection
– to promote uniform application of the general principles of the Directives in all Member States through co-operation between data protection supervisory authorities.
– to advise the Commission on any Community measures affecting the rights and freedoms of natural persons with regard to the processing of personal data and privacy.
– to make recommendations to the public at large, and in particular to Community institutions on matters relating to the protection of persons with regard to the processing of personal data and privacy in the European Community.

9 Future of Identity in the Information Society, cf.


11 International Review of Information Ethics.

Table des illustrations

Titre Chart 3 Relationship of RFID research to policy issues
Légende Source: “Radio Frequency Identification tags Portfolio of European Research” (CE-INFSO 2006)
Fichier image/jpeg, 60k
Titre Chart 4 IoT Governance
Fichier image/jpeg, 172k
Titre Chart 5 Factors that will influence the protection of privacy with the development of the IoT
Crédits Source: International Telecommunications Union
Fichier image/jpeg, 113k

© Éditions de la Maison des sciences de l’homme, 2009

Conditions d’utilisation :

Rechercher dans OpenEdition Search

Vous allez être redirigé vers OpenEdition Search