ARN

Wearables: Are we handing more tools to Big Brother?

Fitness trackers and other wearables are all the rage, but privacy advocates warn that they come with the risk of a "privacy nightmare"

Most of us would love a break on our health insurance. We would generally appreciate the convenience of seeing ads for things we're actually interested in buying, instead of irrelevant "clutter." A lot of us would like someone, or something, else keeping track of how effective our workouts are.

All that and more is available in a Web-connected world. But those benefits come at a price -- personal information. In the case of health insurance, it means handing over some of the most intimate details of our lives, and lifestyles, in exchange for a couple hundred bucks a year.

[7 hidden dangers of wearable computers]

But it is the kind of deal that, apparently, millions of us are willing to make. We have been carrying smartphones with GPS tracking abilities for nearly a decade now. We carry "loyalty" cards that allow retailers to track our purchases and sell or trade that information to data brokers.

Loyalty cards are a key part of the health insurance discount. The Boston Globe reported last month that Harvard Pilgrim, one of New England's major health insurers, had launched a program that paid its workers $20 a month to shop -- and then presumably eat -- healthy.

To get the cash, employees have to agree to have their, "grocery purchases ... tracked electronically when participants scan loyalty cards at the checkout counters," of several grocery chains. The company is looking to expand that program to the 1.2 million people it insures through 20,000 employers.

And now, we are snapping up "wearables" by the millions. There are at least 55 companies pitching devices, generally worn like a wrist watch, that monitor things like the type and intensity of a user's activity. Interest in the technology has reportedly generated $50 billion in investments.

"There are many different types," said Rebecca Herold, CEO of The Privacy Professor, "and more are released to the market every week, or some weeks it seems daily."

Wearables that function as "fitness trackers" have, not surprisingly, been incorporated into the modern wellness program. Companies like BP and Autodesk are offering lower insurance premiums to workers who prove they are more active through the use of the data generated from trackers.

[Without proper security measures, smart homes are just begging to be targets]

These devices track much more than steps, however. They can tell if the user is biking or running, and can calculate distances traveled and calories burned. That, of course, means "connected" devices know a user's location and how he or she got there -- on foot, by bicycle or in a vehicle. The devices also capture information about sleep patterns, calories, blood pressure, heart rate and other data that most of us consider is between our doctors and us.

This, according Google cofounder Larry Page, is a very good thing. Page is among those who believe that the Health Insurance Portability and Accountability Act (HIPAA), which is aimed at protecting patient privacy through limits on the sharing of Electronic Health Records (EHR), ought to be revoked or at least drastically reformed.

In a recent interview, he said if medical records were widely accessible in an online database, "I imagine that would save 10,000 lives in the first year."

But Deborah Peel, executive director of Patient Privacy Rights, told the Washington Post recently that fitness-tracking devices are "a privacy nightmare."

In a CSPAN interview earlier this year, Peel said more than 4 million businesses can access health records -- ranging from employers to government agencies, insurance companies, billing firms, pharmaceutical companies, pharmaceutical benefit managers, marketing firms and data miners.

"This is a massive violation of our right to keep sensitive information private," she said, adding that, "any kind of mental health diagnosis can ruin your life."

Pam Dixon, founder and executive director of the World Privacy Forum (WPF), agrees. She is one of numerous privacy advocates who point out that most fitness trackers are currently exempt from any regulation -- they are not covered by HIPAA since they are consumer devices that have not been furnished or prescribed by a health-care provider.

[Interconnected cars add unique privacy concerns]

They are not regulated by the Food and Drug Administration (FDA) either. A footnote on the FDA website about apps says the agency does not regulate those that, "are not marketed, promoted or intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or do not otherwise meet the definition of medical device."

Dixon, co-author of a paper on consumer privacy titled, "The Scoring of America: How Secret Consumer Scores Threaten Your Privacy and Your Future," said that once data from things like fitness trackers get into the hands of third parties, they can be used for predictive analysis of how much of a health risk a person is.

"What we found and substantiated with great repetition is that health scoring is happening," she said. "It is used, even under the Affordable Care Act, not to determine your eligibility but to determine how much you pay."

And at this point, consumers who want to use wearables have little choice about their information getting into the hands of third parties. Experts point out that one is required to accept the Terms of Service to use the device, which means in most cases that the information collected by the device is being uploaded and shared.

While most makers of wearables allow users to opt out of GPS location tracking, they are reminded that they will not get the full range of services. And while most privacy policies express a "commitment" to the "privacy, integrity and security" of the personal information of its users, that is generally followed by fine print about sharing information with "strategic partners," plus other companies that, "provide services such as information processing, order fulfillment, product delivery, customer data management, customer research and the like.""

[Smart devices get smarter, but still lack security]

Beyond that, most privacy policies say they disclose, "non-personally identifiable aggregated user data," including data gathered from the devices.

That, Dixon insists, should not reassure anyone. "When the industry says the data is aggregated and anonymized, it really isn't," she said. "There is no such thing as anonymous data any more."

Even the Federal Trade Commission (FTC) has expressed concern about the rampant sharing of personal information by data brokers. That, of course, extends well beyond wearables, but the agency, in a recent report titled, "Data Brokers: A Call for Transparency and Accountability," noted that among the thousands of data points collected on just about every U.S. consumer are, "sensitive categories include(ing) health-related topics or conditions, such as pregnancy, diabetes, and high cholesterol."

That information is at risk from more than data brokers. Experts also note that it is relatively easy for hackers to intercept data from users when it is being uploaded to the cloud.

"If wearables transmit data wirelessly in the clear, then it could be captured out of the air," said Lee Tien, senior staff attorney with the Electronic Frontier Foundation. "A general issue in the Internet of Things is the exposure of data."

And besides the basic privacy risk, there is the problem of accuracy. Dixon and her colleague, Robert Gellman, noted in their report that people currently, "remain in the dark about many of their consumer scores and about the information included in scores they typically don't have the rights to see, correct, or opt out of."

[The use of mobile credentials is on the rise, but can they be secured?]

There are a variety of responses proposed for what more than one expert has called a "wild, wild West" privacy environment for wearables. The FTC has recommended that "Congress consider enacting legislation to make data broker practices more visible to consumers and to give consumers greater control over the immense amounts of personal information about them collected and shared by data brokers."

Ben Edelman, an associate professor at the Harvard Business School and a privacy advocate, said he thinks wearable companies need to be held to their promises. "If a company promises to keep users' wearable-collected data secure, then does not, what happens next?" he said. "With ever-more-sensitive data being collected, we should hold companies to their promises strictly -- including significant penalties if they do not."

Rebecca Herold said it would likely take an aggressive push by government or a groundswell of protest from the grassroots -- or both -- for the makers of wearables to build privacy provisions into their devices.

"Over the past year I've posed the question to hundreds of medical and wearable device manufacturers: 'Will you build privacy controls, such as encryption, GPS turn-off switches, etc. into your devices?'" she said.

"Almost all of them have replied that they will not unless it is required to by laws, or if they get an overwhelming number of requests from customers or potential customers."

[The Internet of things: An exploding security minefield]

And with huge companies like Google creating medical and fitness devices with a philosophy dedicated to opening up health information, "how likely do you think it is that they are going to build them with privacy options, such as turning off GPS trackers, built in?" Herold asked.

"Pretty slim to none from what's been reported."