French DPA demands security fixes to connected toys
The French data protection regulator, the Commission Nationale de l'Informatique et des Libertés (CNIL), has issued a formal notice to Genesis Industries Limited, the maker of the connected toys My Friend Cayla and I-QUE. Genesis has two months to bring the toys into compliance with data protection law. CNIL says that based on the security flaws found by a consumer association (presumably the Norwegian Consumer Council, which did this work in 2016) its chair decided to perform online inspections in January and November 2017, and also sent the company's Hong Kong headquarters a questionnaire. This research found the same security failures as others had found, and also that the toys and associated apps collect a multitude of personal data about children and their families and friends.
CNIL identified two breaches of French data protection law: violation of the right to privacy because of a lack of security; and failure to inform the toys' users of the data processing the companies carry out. CNIL decided to make the notice public because of the vulnerability of the relevant population and the obligation to inform individuals of security failures.