Wearable tech can raise data protection issues
What your fitness tracker does with the information it collects is key, says David Gourlay
Wearable technology is now part of everyday life, with devices that track sleep, steps and other daily habits becoming a key part of the “healthmaxxing” trend. Smartwatches and fitness trackers can build a detailed picture of how our bodies are performing, but what may look like simple wellbeing data can raise more complex legal questions. For businesses, a key data protection issue is knowing when that information crosses the line and becomes protected health data.
This distinction came up during our recent Glasgow Tech Week panel on wearable technology and personal data. Under UK data protection law, information concerning a person’s physical or mental health is special category data and subject to additional safeguards. “Wellbeing data”, however, is not a separate legal category, so how information is collected, combined and used can make a real difference to whether it falls within the concept of health data and how it should be treated.
Take something as simple as a step count. On its own, it may only show how active someone has been that day. But combined with resting heart rate, sleep patterns and longer-term changes in activity, it could contribute to a much clearer picture of their health and may allow conclusions to be drawn about their physical or mental condition. The issue, therefore, is not just the individual pieces of information a device collects, but what can be learned when they are brought together.
This will become increasingly relevant as wearable technology becomes more sophisticated. Many devices already go well beyond simply recording information for users to view themselves. They can identify trends, generate scores, flag changes and make recommendations based on the data they collect. As artificial intelligence becomes more widely used, the ability to spot patterns and draw conclusions from large amounts of information is only likely to increase.
Businesses developing or using wearable technology should therefore look beyond whether a product is described as focusing on “fitness” or “wellbeing”. What matters is what the technology actually does with the information. If it is being used to identify, infer, assess or draw conclusions about someone's physical or mental health, additional data protection requirements may apply.
Transparency is also important. Someone sharing their step count with a fitness app will most likely believe that the information is being used to track their exercise. They may not expect it to be combined with other information to assess health risks or build a more detailed picture of their wellbeing. Businesses therefore need to be clear about what they are collecting, how it is being analysed and how it may ultimately be used to reveal about a person’s health.
None of this means that wearable technology should be treated with suspicion. It can give people useful information about their health and wellbeing and has the potential to support better monitoring and earlier intervention. But as devices become more capable, the legal position depends less on the label attached to the data and more about what can be inferred from that data when it is analysed, combined with other information or used to generate insights.
The line between wellbeing data and health data will not always be obvious, particularly where seemingly innocuous data points are combined to reveal information about someone’s health. For organisations working in this space, understanding when that line has been crossed, or may have been crossed through the analysis and combination of different data points, will become increasingly important as the technology develops.
David Gourlay is a Partner, MFMac