Privacy issues around wearables come into view

As wearable technology moves further into the mainstream, thoughts are turning toward how individual privacy can be protected with such devices that track and transmit information as personal as health data and real-time location. Among the projects the Office of the Privacy Commissioner is slated to tackle over the next year is an analysis of fitness-tracker privacy and security. This project “will examine the relationship between the data collection and transmission practices of fitness-tracking devices, the cloud services they integrate with and how third parties may obtain access to this information,” OPC spokeswoman Valerie Lawton said in an email. According to speaking notes posted online, federal Privacy Commissioner Daniel Therrien told the International Association of Privacy Professionals (IAPP) at a symposium on May 28: “The OPC intends to explore and better understand the wide range of technologies and applications to manage health and fitness. We will reach out with information to ensure Canadians understand the privacy risks associated with things like wearable technology and other types of assistive devices. We will also provide guidance to help developers build privacy into new products at the front end." Wearable tech advocate Tom Emrich said in a phone interview that whenever there is a shift in technological advancements, the question of privacy comes up. He said that most wearable companies in Canada are “savvy in understanding that privacy is paramount,” and this results in safeguards built into the devices. “Looking at the companies that I’m close to in Canada, they all are moving forward with this idea of 'privacy by design,' which means that the data that is collected through this wearable device is not ever shared unless the user actively gives permission to do so, and that’s important,” he said. Emrich added that there is “a growing need for society to tackle a redefinition of privacy as we move forward into this age of the Internet of Things, which wearable technology is part of. And so privacy itself needs to be disrupted in order for the future to happen.” A major issue with wearable technology is a lack of awareness people have about how much information they are giving out to companies, said David Skillicorn, a professor of computer science at Queen's University in Kingston, Ont. “They know where you are every second of the day, so your location is suddenly much more available to hackers, and of course that means that they can break into your house when you’re not there,” Skillicorn said in a phone interview. “That’s a new level of intrusion that people have not been accustomed to and probably aren’t very aware of.” The line is blurry when trying to understand who gets blamed if personal information is hacked or compromised, whether it is the company that creates the wearable, the company that is outsourced for security protection or the telecommunications service provider involved in sending the information. The OPC has told organizations to follow what is detailed within the Personal Information Protection and Electronic Documents Act (PIPEDA) as a base for collecting information via wearable devices. Any clarification on accountability can be found in the interpretation bulletin, which is part of the legal information related to PIPEDA. There also is specific documentation for using cloud-serving companies. During a phone interview, former Ontario privacy commissioner Ann Cavoukian said it’s been nearly 20 years since PIPEDA was enacted and that “technology has outpaced everything and certainly outpaced regulation,” so relying on it is not enough. “If we see the tip of the iceberg in terms of the privacy infractions and data breachers, we’re lucky; that’s all we’re seeing, " she said. "The majority of the harms and the privacy hackers and data breachers are largely behind our knowledge. They remain unknown, unchallenged, unregulated.” Section 4.1.3 of the interpretation bulletin states that “an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third-party for processing. Organizations must use contractual means to provide a comparable level of protection while the information is being processed by a third-party.” Even though many companies exercise the option of third-party companies managing security or cloud serving, they still need to follow PIPEDA regulation, it says. Jawbone, the maker of Up fitness-tracking bracelets, does not use external companies, said company spokeswoman Gwendolyn Smith. “We are custodians of the user’s data," she said in an email. "We collect it, analyze it, and present it back to the user with meaning. The user may give us permission to share that data. They can download their data and take it somewhere else. And they can ask us to delete it, which we will do. We also facilitate users to request deletion of their data from any third-party apps that may be connected to Up.” If data in the possession of a third party or the company producing the wearable tech is breached, each situation is judged on a case-by-case, the OPC's Lawton said. “Every breach would have its own set of circumstances, and if the OPC were called upon to investigate a particular breach, we would look at all the contributing factors and draw our conclusions based on the facts before us," she said in an email. Lawton added that while the PIPEDA doesn’t limit organizations from using third-party companies to manage security or cloud serving, the company using that third party has to attain documentation that ensures the information collected is secure. She said that “organizations must also be satisfied that the third party has policies and processes in place, including training for its staff and effective security measures, to ensure that the information in its care is properly safeguarded at all times.” Skillicorn said companies that use a third party to manage information or security will present a statement that many users blindly sign without knowing the implications of lost or compromised data. With regard to telecom-service providers, Skillicorn said that "carriers and so on will completely disown any responsibility for the data they carry. They will say, ‘We are just carriers,' if they get asked, and there’s never been suing of the manufacturers or software providers for the devices themselves.” Several telecom-service providers including BCE Inc., Rogers Communications Inc., Telus Corp. and Shaw Communications Inc. declined to comment for this article. — With reporting by Shruti Shekar at sshekar@thewirereport.ca and editing by Derek Abma at dabma@thewirereport.ca

Privacy issues around wearables come into view

Broadcast | June 19, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy issues around wearables come into view

Broadcast | June 19, 2015

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC announces changes to Broadband Fund

CRTC launches consult on providing more info to consumers shopping for internet services

Champagne announces launch of Canadian AI Safety Institute

Satellite is ‘here to stay’ as connectivity solution, industry players say

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us