| |
| META TOPICPARENT | name="FirstEssay" |
|---|
| |
<
< | Who knew tracking your 10.000 daily steps could lead to disastrous data breaches?
The answer is: Every Single Knowledgeable Person Who Ever Gave A Moment's Thought To It. A more pertinent question would be, Why Didn't Anybody Tell Us?
| >
> | Why were there no disclaimers that tracking your 10.000 daily steps could lead to disastrous data breaches? | | |
-- By OnaMunozRuscalleda - 13 Oct 2023 | | | In May 2022, The Economist issued a series of articles named "The quantified self". The main premise of these articles is that humans can now measure all sorts of health data through their smart wristbands, watches or other devices, and enhance their health using that information. These devices can track all sorts of data: daily steps, sleeping habits, blood pressure, heart rate, and respiration, among others. The articles claim that there’s several benefits to measuring your health data with wearable devices, for example: increasing daily movement among sedentary people, reducing spikes in blood sugar after meals and thus helping people with diabetes, and helping design AI-personalised diets, among others.
It sounds too good to be true: you put on a watch, and it can help you design a meal plan, a workout plan and a daily routine that will reduce your risk of disease and your risk of mortality and increase your health and well-being. All this, with just a watch! Unfortunately, it is too good to be true: the privacy risks that these data-collecting wearable devices pose is not explored in The Economist’s articles, despite being a real threat to consumer’s privacy. | |
<
< | This essay will thus examine the issues that arise from wearing such devices and having them collect all your data. It will start by presenting the case of Fitbit and Apple’s data breach, and continue by analysing the legal aspect of the issue. The essay will conclude with an overview of the problems that this issue poses for current and future legislation, highlighting why this issue is so difficult to regulate.
To say that The Economist was ten years late in not noticing the negative social externalities of technology it was promoting is not newsworthy. What they had to say is, as you point out, discredited by its failure to ask the real questions. So why did you spend just short of 20% of your draft on this?
| | | | |
<
< | The problem: The data breach
The situation that these wearable devices create is that almost all this data, which includes information about virtually all your physical information, your habits, your overall health, and even your location, is now bundled together in one of these devices and their respective databases. And problems arise when there’s a data breach, and all this information is not private anymore (was it ever?). | >
> | The problem: A centralized data design, and its breach
The situation that these wearable devices create is that almost all this data, which includes information about virtually all your physical information, your habits, your overall health, and even your location, is now bundled together in one of these devices and their respective databases. Apple Watch's services were designed to centralize all information collected, instead of not collecting it at all. Problems arise when there’s a data breach, and all this information is not private anymore (was it ever?). | | | This was the case for FitBit? and Apple: in 2021, an unsecured database containing more than 61 million records was hacked into, leaking all the information collected from fitness tracking and wearable devices. The information leaked included names, birthdares, weight, height, gender and geolocation. The main reason for the data breach was the fact that the database was not password-protected and the data was not encrypted. | |
<
< |
No, the main reason was that the service was designed to centralize the information collected, rather than leaving it with the people it was collected from. That a centralized data store exists is the primary reason it is compromised. The secondary details of how a compromise was effected is less important than the existence of an inherently unsafe design. You could compare, for example, everything Mishi Choudhary and I have ever written about the Government of India's Aadhar digital identity scheme with the same "who could have known?" bullshit after the initial occasions of compromise.
| | | What can the current law do about it?
Facing a situation such as Fitbit and Apple’s data breach, the question arises: what can the law do about this, if anything? The question is particularly problematic because these wearable devices lie at the intersection of several areas: health, data protection and personal fashion accessories. | |
<
< | There are many laws that partially apply to this issue, but none that fully covers the whole legal issue.
Firstly, the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This act created a series of national standards to protect sensitive patient health information from being disclosed without the patient’s consent. Specifically, the HIPAA applies to “health care providers”, defined in section 1171 of the aforementioned as “a provider of medical health services”. Asserting that a wearable watch is a “health care provider” seems like a far-reaching conclusion, but it does nonetheless provide databases with health information about the consumer. The main issue with the HIPAA is that the data collected in these devices is beyond the context of insurance reimbursement claims and that fitness trackers are not generally considered medical devices per se, which makes it harder for the HIPAA to apply to these kinds of devices.
Secondly, the FDA has a Medical Device Tracking Regulation, the purpose of which is to ensure that manufacturers and importers of certain medical devices receive approval for these devices and are later able to locate them in the distribution chain. Again, the main issue is that more often than not fitness trackers are not considered to be medical devices. The FDA also released guidance and voiced its support for medical device cybersecurity, but this hardly amounts to proper legislation.
Thus, with the current legislation there is no comprehensive data protection which covers fitness devices and their data.
There's no one law that covers all the legal problems of automobiles, but that's neither a problem nor a significant analytical observation. Actually describing the texture of the various tangentially-relevant schemes is more work than you could do in 10,000 words, and you have about 150 at most. Because there isn't any point to the point, anyway.
| >
> | There are many laws that partially apply to this issue: the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the FDA's Medical Device Tracking Regulation are the most relevant. However, this essay will not delve further into the current legislation. | | |
What should the law do about it?: Problems with this case |
|