Privacy and Security in a Connected Life: A Study of European Consumers

Privacy and Security in a Connected Life: A Study of European Consumers Sponsored by Trend Micro Independently conducted by Ponemon Institute LLC Publication Date: March 2015 Ponemon Institute Research Report

Privacy and Security in a Connected Life: A Study of European Consumers Part 1. Introduction Privacy and Security in a Connected Life was conducted by Ponemon Institute and sponsored by Trend Micro to learn if consumers are worried about how technology that captures personal information, especially Internet of Things (IoT) or Internet of Everything (IoE), is affecting their privacy and security. In the context of this research, security refers to the safeguards in place to protect personal information from being lost or stolen. Privacy is considered to be an individual s right to keep sensitive and confidential information from becoming known unless he or she wants the information to be revealed. In this study of 564 European consumers, we define IoT as the expanding network of billions of connected devices that are permeating our daily lives from smart phones and smart TVs to our WiFi enabled appliances, wireless medical devices and wearable devices. Because consumers are embracing more connected devices, information security leaders predict that IoT will be one of the most significant disruptive technologies in the near future. In addition to issues surrounding the privacy and security of IoT, we also study respondents perceptions about the value of their personal information such as health information, credit history, purchasing habits, browser settings and if they should be paid for their information. Because individuals have different opinions about the importance of privacy, we asked respondents to select a privacy profile they most closely identify with today and five years ago. Three profiles were developed by Ponemon Institute based on consumer research conducted for more than 10 years. The following are profiles of respondents as shown in Figure 1. Privacy centric. These respondents will change their behaviors when they experience events that make them worry about the privacy and security of their personal information (26 percent of respondents). Five years ago, 31 percent of respondents say they were privacy centric. This decline could be attributed to individuals believing they are losing the ability to keep their personal information safe. These respondents have become more privacy sensitive. Privacy sensitive. The majority of respondents (59 percent) are privacy sensitive. These respondents think privacy is important but will rarely change their behaviors or information sharing practices even if they experience an event that affects the privacy or security of their personal information, such as a data breach. Five years ago, 56 percent were privacy sensitive. This increase suggests that individuals are becoming less willing to change behaviors if and when they experience a privacy or security incident. Privacy complacent. These respondents (15 percent) are the least concerned about privacy and security. These respondents really do not care even if their sensitive information is shared or sold. Respondents in this profile increased slightly. Ponemon Institute Research Report Page 1

Part 2. Key findings In this section, we present an analysis of the key findings of this research. The complete audited findings are presented in the appendix of this report. We have organized the findings according to the following topics: Does privacy matter? A privacy problem: losing control over personal information Does personal information have a price? Does privacy matter? Use of mobile devices and data breaches has increased concerns about privacy. Fortynine percent of respondents say they have become more concerned about the privacy and security of their personal information in the past five years. As shown in Figure 2, reasons these respondents worry about their privacy are: the increased use of mobile devices such as smartphones and tablets (66 percent), they became a victim of a data breach (56 percent) and they use social media more often (50 percent). Almost half (49 percent) are worried about sharing their personal information, including medical records shared with third parties. Figure 2. Why are you more concerned about your privacy? More than one response permitted n = 276 I am using my mobile devices such as smartphones and tablets more often 66% I became a victim of a data breach 56% I use social media more often 50% More of my personal information including medical records is being shared with third parties 49% I have growing concerns about government surveillance 39% I know someone who became a victim of a data breach 18% I use mobile payment methods including mobile wallet 9% I am using location tracking devices more often 9% I became a victim of identity theft 5% 0% 20% 30% 40% 50% 60% 70% Ponemon Institute Research Report Page 2

Experience with smart devices is limited. As shown in Figure 3, most respondents are using or planning to use smartphones/tablets and smart TVs (72 percent and 69 percent, respectively). Also revealed is that there is no planned use of smart security systems, Google Glass and fitness tracking wearables (84 percent, 79 percent or 75 percent, respectively). Figure 3. What smart devices consumers use, plan to use or have no plan to use More than one response permitted Smart TV 29% 32% 40% Smartphone/Tablet 28% 28% 44% Smart electric meter 18% 26% 57% Smart kitchen appliances 26% 20% 54% Smart home thermostat 9% 22% 69% Fitness status tracking wearable 8% 17% 75% Google Glass 6% 15% 79% Smart security systems 5% 11% 84% 0% 20% 30% 40% 50% 60% 70% 80% 90% Plan to use Use No plan to use Ponemon Institute Research Report Page 3

The benefits of IoT do not outweigh concerns about privacy and security. Is the use of smart devices connected to the Internet worth potential risks to privacy and security? While 42 percent do believe the benefits of IoT outweigh their concerns about privacy or security, 42 percent say they do not and 16 percent are unsure. Figure 4. Do you believe the benefits of IoT outweigh your concerns about privacy or security? n = 564 45% 42% 42% 40% 35% 30% 25% 20% 15% 16% 5% 0% Yes No Unsure Ponemon Institute Research Report Page 4

A privacy problem: losing control of personal information Uncertainty and the lack of control over how personal information is collected, shared, and stored could deter many consumers from using smart devices. Based on a scale of 1 to 10, Figure 5 shows that only 13 percent of respondents (7 percent + 6 percent) say they have a high degree of control over their personal information in IoT. Seventy-seven percent (53 percent + 24 percent) believe they have very little control over their personal information. We believe this is due to respondents uncertainty as to what information is collected and a lack of awareness about how their personal information is protected. Figure 5. How much control do you have over your personal information in IoT 1 = low control to 10 = high control n = 564 60% 53% 50% 40% 30% 24% 20% 7% 6% 0% 1 or 2 (low) 3 or 4 5 or 6 7 or 8 9 or 10 (high) Ponemon Institute Research Report Page 5

Respondents are unaware of all the sensitive data collected about them. In IoT, devices are capable of collecting and sharing a wide range of personal information. In addition to tracking browsing behavior, software in devices can report on usage, location, and performance, whether through smartphone applications, video games, metadata from digital cameras, or applications running on personal computing devices. Recently it was reported that Samsung Smart TVs collect data from voice communications and even share them with a third party. 1 Figure 6 reveals respondents believe their most sensitive information, such as credit history, special dates including date of birth, school/employer or health condition is rarely collected and used by companies. In contrast, 56 percent are aware that information about their physical location (GPS) is collected because of the prevalent use of smartphones and tablets. When asked specifically about devices that collect information, the majority of respondents believe the devices that collect the most information are: Google Glass, smart security and smart phones or tablets. Figure 6. What personal information consumers believe is collected about them in IoT More than one response permitted n = 564 Email address Name Home address Physical location (GPS) Browser settings & histories Gender Names of friends & family members Photos & videos Payment account details Phone numbers Marital status Hobbies, tastes & preferences Purchase histories Health condition School or employer Special dates including date of birth Credit history 3% 56% 51% 50% 43% 43% 42% 39% 36% 34% 27% 21% 18% 69% 68% 77% 0% 20% 30% 40% 50% 60% 70% 80% 90% 1 Smart TV eavesdropping furor prompts senator to quiz Samsung and LG on privacy, by John Ribiero, PCWorld, February 12, 2015. Ponemon Institute Research Report Page 6

Little information is provided about how smart devices protect and use personal information. What can be fueling respondents worries about IoT is the lack of information about the security safeguards in place. When asked if manufacturers of devices provided details about how their personal information will be used, 82 percent of respondents say they did not receive any information or they are unsure. Only 18 percent of respondents recall receiving such information. It is unclear whether this finding is attributable to manufacturers not providing such information or respondents are not aware that such information is available to them. In any event, respondents believe they do not have such information at hand for assurance. If the manufacturer did provide information about how their personal information is protected, Figure 7 shows what these 18 percent of respondents remember. Fifty percent say they received a promise their data is shared only with trusted parties followed by the ability to opt out of data collection and/or data sharing (44 percent). Forty-six percent say they cannot recall if any of the critical information in the figure was provided to them. Figure 7. What protections are in place to protect your personal information? More than one response permitted n = 84 My data is shared only with trusted parties 50% I can opt out of data collection and/or data sharing 44% The device provides strong authentication controls 23% I can turn off tracking activities anytime 18% My personal information collected is encrypted I can remotely disable the device if it is lost or stolen 16% 15% I can erase any information collected about me There is someone to contact if I have concerns about privacy 12% None of the above 46% 0% 20% 30% 40% 50% 60% Ponemon Institute Research Report Page 7

Respondents are more concerned about their security than privacy. Figure 8 reveals respondents concerns about privacy and security. According to Figure 8, 82 percent of respondents are very concerned about the security of their personal data when using smart devices. Eighty-one percent are concerned about their security when using social media such as Facebook and Google. A higher concern among respondents about the security of their personal information could be based upon the fear of becoming a victim of identity theft. While individuals can have security without privacy, they cannot have privacy without security. In contrast, a much smaller percentage (68 percent) rates their concern about privacy when using social media as high or very high. Similarly, 62 percent rate concerns about privacy when using smart devices connected to IoT as high or very high. This finding is consistent with the privacy profiles of respondents. As discussed previously, most respondents are privacy sensitive and think privacy is important but they are not willing to change their behavior such as stopping their use of social media because of privacy concerns. Figure 8. How concerned are you about maintaining security and privacy in IoT and social media? Very high and high responses 90% 80% 70% 60% 82% 62% 81% 68% 50% 40% 30% 20% 0% Concerns about security in the IoT (n = 462) Concerns about privacy in the IoT (n = 350) Concerns about security when using social media (n = 457) Concerns about privacy when using social media (n = 383) Ponemon Institute Research Report Page 8

Respondents would like to receive compensation and information about the smart devices they are using. Consumers are demanding clarification about how their personal information is managed by manufacturers. They also want assurance that if their personal information is lost or stolen, the manufacturer will assume responsibility and provide compensation to help them resolve any negative consequences. As shown in Figure 9, manufacturers of smart devices should do the following: tell them what information is collected (69 percent), compensate consumers if their information is lost or stolen (69 percent) and how the information is used (67 percent). Figure 9. Manufacturers of smart devices should provide the following information More than one response permitted n = 564 Tell me what information is collected Compensate me if my information is lost or stolen Tell me how the information is used 69% 69% 67% Tell me what I should do if the smart device is hacked Allow me to control what information is collected (opt-in and opt-out of information that is Tell me when my personal information is lost or stolen Assurance that my data is safeguarded 58% 56% 53% 50% Let me know how I can protect my information from being lost or stolen 40% Don t know 21% No information is necessary 15% 0% 20% 30% 40% 50% 60% 70% 80% Ponemon Institute Research Report Page 9

Personal information is off limits to employers. The majority of respondents do not believe their employer has the right to access personal data on their smart device if they use it at work or connect to their employer s Internet (72 percent) and 8 percent are unsure, according to Figure 10. Figure 10. Does your employer have the right to access personal data on your Smart device if you use it at work or connect to your employer s Internet? n = 564 80% 70% 72% 60% 50% 40% 30% 20% 20% 8% 0% Yes No Unsure Ponemon Institute Research Report Page 10

Respondents do not believe they are in control when sharing personal data and making purchases. Only 43 percent of respondents strongly agree or agree they still control how their personal information is collected, shared and stored after they willingly share personal data with companies. Further, in purchasing situations that require the sharing of personal information, respondents believe they have lost control over their personal information. According to Figure 11, 60 percent of respondents say they rarely or never have control over their data after browsing websites and making online purchases and 59 percent say they rarely or never have control over their personal information when making purchases at a store. Figure 11. Do you have control over how your personal data is used? n = 564 45% 40% 35% 30% 25% 20% 15% 5% 0% 38% 39% 22% 22% 22% 18% 19% 20% Yes, most of the time Yes, some of the time Rarely No Control over personal data after browsing websites and/or making online purchases Control over personal data after shopping at a store and share personal information Ponemon Institute Research Report Page 11

Confusion exists over how personal information is used. Thirty-one percent of respondents do not know how companies use their personal information. If they do, they believe it is mainly for marketing purposes to understand their preferences as well as those of others (59 percent and 56 percent, respectively). Twenty-three percent say their data is sold for unknown purposes. Figure 12. What do you believe companies do with your personal data? More than one response permitted n = 564 The data is used to understand my preferences 59% The data is used to understand other consumers preferences 56% I do not know how companies use my personal data 31% The data is used to provide me with better security 30% The data is sold by those collecting it for unknown purposes 23% 0% 20% 30% 40% 50% 60% 70% Respondents are mostly negative about the ads they receive based on their purchasing and browsing habits. Fifty-four percent of respondents say the ads they receive are rarely (22 percent) or never valuable to them (32 percent). Figure 13. Do you believe ads based on your purchasing and browsing habits are helpful? n = 564 35% 32% 30% 25% 20% 20% 26% 22% 15% 5% 0% Yes, most of the time Yes, some of the time Rarely No Ponemon Institute Research Report Page 12

Does personal information have a price? Personal information does have a value to respondents. According to Figure 14, 51 percent of respondents (26 percent strongly agree + 25 percent agree) understand that their personal data is valuable because it helps companies to market and sell products. Sixty-four percent (31 percent strongly agree + 33 percent agree) believe personal data is a financial asset similar to traded goods, currencies or commodities. Figure 14. What consumers think about the value of their personal information n = 564 35% 30% 25% 20% 15% 26% 31% 25% 33% 24% 19% 15% 7% 5% 0% Strongly agree Agree Unsure Disagree Strongly disagree Personal data helps to market and sell products to others and me Personal data is a financial asset similar to traded goods, currencies or commodities Ponemon Institute Research Report Page 13

The majority of respondents do not believe loyalty programs provide adequate compensation. As mentioned previously, 82 percent of respondents do not know or are unsure about how manufacturers of smart devices use and protect their personal information. However, when it comes to loyalty cards, more respondents (67 percent) do have full or some understanding what companies do with their data. This is probably due to the various benefits and compensation loyalty cards provide. Sixty-seven percent of respondents participate in a loyalty program. According to Figure 15, 69 percent of respondents say they mainly receive discounts on future purchases or early access to sales or discounts or hard to get products or services (43 percent). Fifty-seven percent say this compensation is not enough (32 percent) or they are unsure (25 percent). Figure 15. How are you compensated for your participation in loyalty programs? More than one response permitted n = 333 Discounts on future purchases 69% Early access to sales or discounts or hard to get products or services (i.e. tickets to a playoff game) 43% Cash back or reimbursements 31% Free and upgraded flights 19% Free goods and services 11% Concierge services 0% 20% 30% 40% 50% 60% 70% 80% Ponemon Institute Research Report Page 14

Respondents would provide their personal information in exchange for money if they trust the company. Fifty percent of respondents say they would be willing to provide their personal data to trusted companies in exchange for money, as shown in Figure 16. Figure 16. Would you be willing to provide your personal data to trusted companies in exchange for money? n = 564 60% 50% 40% 50% 42% 30% 20% 8% 0% Yes No, I would not provide my personal data for any amount of money Unsure Ponemon Institute Research Report Page 15

How much is one piece of data worth? We asked respondents to indicate what would be the minimum amount they would accept as compensation in exchange for different data categories. On average, respondents believe one piece of data is worth $14.70. The most expensive pieces of data are: passwords (log in credentials) $82, health condition $35, payment details $20.80 and credit history $20.70. The cheapest pieces of data are: name $3.50, phone number $5.40 and browser settings and history $5.90 Figure 17. How much is your personal data worth? Response scale was converted from Euros to US$ Extrapolated average value = $14.70 n = 282 Passwords (login details) $82.0 Health condition $35.0 Payment details (credit card) Credit history Names of friends & family members Purchase histories $20.8 $20.7 $18.8 $17.8 Hobbies, tastes & preferences School or employer Email address Marital status Browser settings & histories Photos & videos Phone numbers Physical location (GPS) Home address Special dates including date of birth Name Gender $9.1 $8.5 $8.5 $6.0 $5.9 $5.9 $5.4 $5.1 $5.0 $4.9 $3.5 $1.4 $0.0 $10.0 $20.0 $30.0 $40.0 $50.0 $60.0 $70.0 $80.0 $90.0 Ponemon Institute Research Report Page 16

Part 3. Methods A sampling frame composed of 16,030 consumers located in Europe was selected for participation in this survey. As shown in the Table 1, 600 respondents completed the survey. Screening removed 36 surveys. The final sample was 564 surveys (or a 3.5 percent response rate). All survey responses were captured November 11 through December 8. Table 1. Sample response EU Total sampling frame 16,030 Total returns 600 Rejected or screened surveys 36 Final sample 564 Response Rate 3.5% Pie Chart 1 reports the highest level of education of respondents. More than half of respondents (62 percent) reported having attended college or earning a college degree. Pie Chart 1. Highest level of education n = 564 8% 1% 18% High School 25% Vocational College (attended, no degree) 20% College (4 year degree) Post Graduate Doctorate 28% Ponemon Institute Research Report Page 17

According to Pie Chart 2, more than half of the respondents (63 percent) reported their income to be less than $60,000 (currency converted from Euros to US$). Thirty-seven percent reported their income to be greater than $60,000. The average respondent s income was $65,450. Pie Chart 2. Household income Expressed in US $, n = 564 8% 6% 1% 13% Less than $25,000 $25,000 to $40,000 $40,001 to $60,000 26% $60,001 to $80,000 $80,001 to $100,000 12% $100,001 to $150,000 $150,001 to $250,000 More than $250,000 24% Pie Chart 3 reports the age of respondents. More than half of the respondents (65 percent) are between the ages of 18 and 45. Pie Chart 3. Age of respondents n = 564 7% 13% 20% 18 to 25 26 to 35 36 to 45 15% 46 to 55 26% 56 to 65 65+ 19% Ponemon Institute Research Report Page 18

As shown in Pie Chart 4, there are 15 countries represented in the European cluster. The largest country segments are: United Kingdom (21 percent), Germany (17 percent) and France (14 percent). Pie Chart 4. Countries represented in the European cluster sample n = 564 4% United Kingdom 21% 2% 1% 1% 4% Germany France Spain Benelux Italy Poland Russian Federation Denmark 17% Ireland Switzerland Sweden Slovenia 12% Greece 14% Ponemon Institute Research Report Page 19

Part 4. Caveats There are inherent limitations to survey research that need to be carefully considered before drawing inferences from findings. The following items are specific limitations that are germane to most web-based surveys. Non-response bias: The current findings are based on a sample of survey returns. We sent surveys to a representative sample of individuals, resulting in a large number of usable returned responses. Despite non-response tests, it is always possible that individuals who did not participate are substantially different in terms of underlying beliefs from those who completed the instrument. Sampling-frame bias: The accuracy is based on contact information and the degree to which the list is representative of individuals who are consumers. We also acknowledge that the results may be biased by external events such as media coverage. We also acknowledge bias caused by compensating subjects to complete this research within a holdout period. Self-reported results: The quality of survey research is based on the integrity of confidential responses received from subjects. While certain checks and balances can be incorporated into the survey process, there is always the possibility that a subject did not provide a truthful response. Ponemon Institute Research Report Page 20

Appendix: Detailed Survey Results The following tables provide the frequency or percentage frequency of responses to all survey questions contained in this study. All survey responses were captured November 11 through December 8. European consumer survey response Freq Pct% Total sampling frame 16030 100.0% Total returns 600 3.7% Rejected or screened surveys 36 0.2% Final sample 564 3.5% Part 1. Privacy profile and the Internet of Things Q1. Based on the descriptions above, what is your privacy profile today? Privacy complacent 15% Privacy sensitive 59% Privacy centric 26% Q2. Based on the descriptions above, what was your privacy profile five years ago? Privacy complacent 13% Privacy sensitive 56% Privacy centric 31% Q3a. Have you become more concerned about privacy and security of your personal data over the past 5 years? Yes 49% No 51% Ponemon Institute Research Report Page 21

Q3b. If you became more concerned about the privacy and security of your personal data over the past five years, why? Please select all the reasons why you have become more concerned. I became a victim of a data breach 56% I became a victim of identity theft 5% I have growing concerns about government surveillance 39% I use social media more often 50% I am using location tracking devices more often 9% I know someone who became a victim of a data breach 18% I am using my mobile devices such as smartphones and tablets more often 66% I use mobile payment methods including mobile wallet 9% More of my personal information including medical records is being shared with third parties 49% Total 301% Q4. Please rate your level of knowledge or familiarity about each device presented using the following scale: 1 = Very familiar, 2 = Familiar, 3 = Somewhat familiar and 4 = Not familiar 1 2 3 4 Total Fitness status tracking wearable 9% 12% 38% 41% 100% Google Glass 11% 14% 22% 53% 100% Smart home thermostat 14% 13% 25% 47% 100% Smart TV 43% 28% 22% 7% 100% Smart kitchen appliances 20% 18% 17% 45% 100% Smart security systems 9% 7% 20% 64% 100% Smart electric meter 22% 18% 21% 40% 100% Smartphone/Tablet 45% 19% 30% 6% 100% Q5. [If not familiar skip to Q8] Do you currently use or plan to use this smart device? No plan to use Use Plan to use Total Fitness status tracking wearable 8% 17% 75% 100% Google Glass 6% 15% 79% 100% Smart home thermostat 9% 22% 69% 100% Smart TV 29% 40% 32% 100% Smart kitchen appliances 20% 26% 54% 100% Smart security systems 5% 11% 84% 100% Smart electric meter 18% 26% 57% 100% Smartphone/Tablet 44% 28% 28% 100% Ponemon Institute Research Report Page 22

Q6. What personal information do you believe is collected by the devices listed above? Check your answers in each cell of the following matrix for these smart devices Fitness tracking Google glass Smart thermostat Smart TV Smart kitchen Smart security Smart meter Smart phone or tablet Browser settings & histories 41% 99% 21% 90% 18% 34% 13% 89% Credit history 0% 4% 2% 1% 4% 8% 3% 6% Email address 90% 59% 62% 89% 83% 77% 74% 79% Health condition 75% 12% 7% 6% 20% 17% 14% 15% Hobbies, tastes & preferences 34% 72% 59% 35% 21% 3% 35% Home address 44% 76% 75% 54% 76% 61% 76% 83% Marital status 33% 90% 5% 21% 42% 46% 25% 31% Name 83% 87% 81% 64% 58% 65% 62% 51% Names of friends & family members 31% 58% 12% 68% 37% 66% 13% 60% Payment account details 24% 49% 36% 54% 23% 52% 47% 54% Phone numbers 18% 30% 20% 25% 17% 94% 21% 87% Photos & videos 74% 53% 8% 36% 8% 86% 4% 74% Physical location (GPS) 43% 82% 16% 13% 36% 85% 94% 77% Purchase histories 0% 77% 2% 47% 37% 11% 0% 44% Special dates including date of birth 6% 11% 0% 9% 30% 18% 2% 3% Gender 90% 90% 29% 45% 36% 72% 5% 33% School or employer 2% 42% 2% 4% 7% 39% 6% 43% Average 38% 55% 22% 38% 31% 48% 26% 48% Q7a. [Only those who use or plan to use] Did any of the manufacturers of the devices you use (or plan to use) provide you with information about how your personal information is protected? Yes 18% No 62% Unsure 20% Ponemon Institute Research Report Page 23

Q7b. If yes, what protections are in place to protect your personal information? My data is shared only with trusted parties 50% I can turn off tracking activities anytime 18% The device provides strong authentication controls 23% I can remotely disable the device if it is lost or stolen 15% I can erase any information collected about me 12% I can opt out of data collection and/or data sharing 44% My personal information collected is encrypted 16% There is someone to contact if I have concerns about privacy None of the above 46% Total 234% Q8. Did any of the manufacturers of the devices you use (or plan to use) provide you with information about how your personal information will be used? Yes 17% No 60% Unsure 23% Q9. How concerned are you about maintaining your privacy in the IoT? 1 or 2 (low) 2% 3 or 4 5% 5 or 6 31% 7 or 8 22% 9 or 10 (high) 40% Q10. How concerned are you about your security in the IoT? 1 or 2 (low) 2% 3 or 4 3% 5 or 6 13% 7 or 8 24% 9 or 10 (high) 58% Ponemon Institute Research Report Page 24

Q11. How concerned are you about the security of your personal data when using social media (such as Facebook and Google)? 1 or 2 (low) 3% 3 or 4 6% 5 or 6 7 or 8 23% 9 or 10 (high) 58% Q12. How concerned are you about the privacy of your personal data when using social media (such as Facebook and Google)? 1 or 2 (low) 5% 3 or 4 4% 5 or 6 23% 7 or 8 35% 9 or 10 (high) 33% Q13. How much control do you have over how your personal information is collected, shared and stored when using smart devices connected to the IoT? 1 or 2 (low) 53% 3 or 4 24% 5 or 6 7 or 8 7% 9 or 10 (high) 6% Q14. Do you believe the benefits of the IoT outweigh your concerns about privacy or security? Yes 42% No 42% Unsure 16% Ponemon Institute Research Report Page 25

Q15. I believe the manufacturer of smart devices that connect to the IoT should provide the following information. Please check all that apply. Tell me what information is collected 69% Tell me how the information is used 67% Allow me to control what information is collected (opt-in and opt-out of information that is collected) 56% Let me know how I can protect my information from being lost or stolen 40% Tell me what I should do if the smart device is hacked 58% Assurance that my data is safeguarded 50% No information is necessary 15% Tell me when my personal information is lost or stolen 53% Compensate me if my information is lost or stolen 69% Don t know 21% Total 498% Q16. Does your employer have the right to access personal data on your Smart device if you use it at work or connect to your employer s Internet? Yes 20% No 72% Unsure 8% Part 2. Value of your personal data Q17. The personal data I provide to companies is valuable because it helps them to market and sell products to others and me. Strongly agree 26% Agree 25% Unsure 24% Disagree 15% Strongly disagree Ponemon Institute Research Report Page 26

Q18. My personal data is a financial asset similar to traded goods, currencies or commodities. Strongly agree 31% Agree 33% Unsure 19% Disagree Strongly disagree 7% Q19. Even if I willingly share my personal data with companies, I still control how they collect, share and store my personal data. Strongly agree 18% Agree 25% Unsure 22% Disagree 26% Strongly disagree 9% Q20. After browsing websites and/or making online purchases, do you believe you have control over how your personal data is used? Yes, most of the time 22% Yes, some of the time 18% Rarely 38% No 22% Q21. Do you believe that when you shop at a store and share personal information you have control over how your personal data is used? Yes, most of the time 22% Yes, some of the time 19% Rarely 39% No 20% Ponemon Institute Research Report Page 27

Q22. When you browse the Internet, shop online or make instore purchases, your personal data is collected. What do you believe companies do with your personal data? The data is used to understand my preferences 59% The data is used to provide me with better security 30% The data is used to understand other consumers preferences 56% The data is sold by those collecting it for unknown purposes 23% I do not know how companies use my personal data 31% Total 199% Q23. When you receive ads based upon your purchasing and browsing habits, do you believe this is helpful to you? Yes, most of the time 20% Yes, some of the time 26% Rarely 22% No 32% Q24. Do you belong to one or more loyalty programs that provide benefits in exchange for purchases (such as those offered by grocery stores, retailers, pharmacies, credit card companies, airlines and others)? Yes 59% No (Skip to Q28) 41% Q25. How are you compensated for your participation in loyalty programs? Please select all that apply. Discounts on future purchases 69% Early access to sales or discounts or hard to get products or services (i.e. tickets to a playoff game) 43% Cash back or reimbursements 31% Free goods and services 11% Free and upgraded flights 19% Concierge services Total 183% Ponemon Institute Research Report Page 28

Q26. Do you understand how your personal data is being used by your loyalty programs? Yes, full understanding 30% Yes, some understanding 37% No 33% Q27. Do you believe you are adequately compensated for participation in your loyalty programs? Yes 43% No 32% Unsure 25% Q28a. Would you be willing to provide your personal data to trusted companies in exchange for money? Yes 50% No, I would not provide my personal data for any amount of money 42% Unsure 8% Q28b. If yes, how much would a trusted company have to pay you to obtain the following data about you? Please identify only one minimum amount for each data category listed. Response scale was converted from Euros to US$. < $1 $1 to 5 $6 to $10 $11 to $25 $26 to $50 $51 to $100 > $100 Average Browser settings & histories 30% 44% 11% 6% 0% 0% 5.9 Credit history 15% 13% 18% 20% 29% 6% 0% 20.7 Email address 41% 17% 27% 11% 2% 2% 1% 8.5 Health condition 28% 20% 8% 6% 9% 12% 16% 35.0 Hobbies, tastes & preferences 40% 27% 17% 5% 7% 4% 0% 9.1 Home address 48% 29% 16% 4% 2% 2% 0% 5.0 Marital status 43% 32% 16% 6% 2% 1% 1% 6.0 Name 55% 35% 5% 3% 1% 1% 0% 3.5 Names of friends & family members 32% 14% 16% 19% 7% 2% 18.8 Passwords (login details) 0% 0% 3% 17% 24% 47% 82.0 Payment details (credit card) 16% 33% 17% 7% 11% 14% 2% 20.8 Phone numbers 29% 33% 31% 5% 1% 1% 0% 5.4 Photos & videos 30% 38% 15% 15% 2% 0% 0% 5.9 Physical location (GPS) 25% 38% 30% 6% 0% 0% 0% 5.1 Purchase histories 8% 11% 29% 32% 16% 2% 2% 17.8 Social Security number Special dates including date of birth 56% 26% 8% 7% 3% 0% 0% 4.9 Gender 78% 22% 0% 0% 0% 0% 0% 1.4 School or employer 36% 32% 15% 7% 7% 3% 0% 8.5 14.7 Ponemon Institute Research Report Page 29

Part 3. Demographics D1. Gender Female 49% Male 51% D2. Age 18 to 25 20% 26 to 35 26% 36 to 45 19% 46 to 55 15% 56 to 65 13% 65+ 7% D3. Highest Level of Education (US scale presented): High School 18% Vocational 20% College (attended, no degree) 28% College (4 year degree) 25% Post Graduate 8% Doctorate 1% D4. Household Income (Converted from Euros to US$): Less than $25,000 13% $25,000 to $40,000 26% $40,001 to $60,000 24% $60,001 to $80,000 12% $80,001 to $100,000 $100,001 to $150,000 8% $150,001 to $250,000 6% More than $250,000 1% European cluster sample of countries Freq Pct% United Kingdom 121 21% Germany 98 17% France 79 14% Spain 65 12% Italy 54 Netherlands 48 9% Poland 23 4% Russian Federation 23 4% Denmark 11 2% Ireland 9 2% Switzerland 8 1% Benelux 8 1% Sweden 7 1% Slovenia 6 1% Greece 4 1% Total 564 100% Ponemon Institute Research Report Page 30

Ponemon Institute Advancing Responsible Information Management Ponemon Institute is dedicated to independent research and education that advances responsible information and privacy management practices within business and government. Our mission is to conduct high quality, empirical studies on critical issues affecting the management and security of sensitive information about people and organizations. As a member of the Council of American Survey Research Organizations (CASRO), we uphold strict data confidentiality, privacy and ethical research standards. We do not collect any personally identifiable information from individuals (or company identifiable information in our business research). Furthermore, we have strict quality standards to ensure that subjects are not asked extraneous, irrelevant or improper questions. Ponemon Institute Research Report Page 31