collected from consumer IoT devices and services, the processing of personal data should be kept to the minimum necessary for the intended functionality. 6.5: If telemetry data is collected from consumer IoT devices and services, consumers shall be provided with information on what telemetry data is collected, how it is being used, by whom, and for what purposes. RC (6) MC (6) MC (6) MC (6) Conditions: 1) Passwords are used; 2) Pre-installed passwords are used; 3) Software components are not updateable; 4) The device is constrained; 5) The device is not constrained; 6) Telemetry data being collected; 7) Personal data is processed on the basis of consumers’ consent; 8) The device allowing user authentication; 9) The device supports automatic updates and/or update notifications; 10) A hard-coded unique per device identity is used for security purposes; 11) Updates are delivered over a network interface; 12) An update mechanism is implemented; 13) A debug interface is physically accessible CLS Publication #2 | Page 43 of 49