How do we ensure accuracy in IoT?
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
The accuracy principle in data protection law means you must:
- take all reasonable steps to ensure the personal information you process through your IoT product is not incorrect or misleading about any matter of fact;
- keep the personal information up-to-date, if necessary; and
- consider how you will respond to any challenges from users about the accuracy of the information you’ve gathered through your IoT product.
In practice this means you must take reasonable steps to design your IoT product so that the information it processes is accurate. If the technology – such as sensors – that your IoT product relies on to process personal information is inaccurate, such as sensors, you will probably not be able to meet the requirements of the accuracy principle.
The accuracy principle is also linked to the security principle. The accuracy of the personal information is important for the integrity of your systems and processes.
The accuracy principle applies to the processing of all personal information, including biometric data and information processed by AI systems.
Some IoT products use biometric recognition systems, for example:
- to authenticate users through their fingerprint;
- to identify people through a security or a doorbell camera; or
- to match a query on a voice assistant to a household member.
They can also use AI systems, for example to draw inferences about people based on their health and wellbeing information from fitness trackers or other wellness devices.
Biometric recognition and AI systems may involve the processing of personal information, so the accuracy principle applies. But they don't need to be 100% statistically accurate to comply with it.
The outcomes of your biometric recognition or AI system are statistically informed guesses about someone’s identity or something that might be true about a person now or in the future.
To avoid these outcomes being misinterpreted as factual, you should ensure your records indicate they are statistically informed guesses rather than facts.
At the same time, you must ensure your system is sufficiently statistically accurate for your purposes. This doesn’t mean every single outcome has to be correct, but you must factor in the possibility of errors and their possible effect on your decision-making and the people it applies to. If you don’t do this, your processing may not comply with the fairness principle.