On IoT Devices and Software Liability

An academic article argues that while users of smart devices often have data protection remedies after cyberattacks, third-party victims lack equivalent redress, especially when attacks exploit publicly known, unremediated vulnerabilities. It examines recent rulings by the UK and Irish Supreme Courts to evaluate whether negligence claims against IoT manufacturers could succeed. The paper proposes a narrow set of circumstances under which a duty of care between manufacturers and third-party victims may be established.