Digital health fiduciaries: protecting user privacy when sharing health data

Abstract

Wearable self-tracking devices capture multidimensional health data and offer several advantages including new ways of facilitating research. However, they also create a conflict between individual interests of avoiding privacy harms, and collective interests of assembling and using large health data sets for public benefits. While some scholars argue for transparency and accountability mechanisms to resolve this conflict, an average user is not adequately equipped to access and process information relating to the consequences of consenting to further uses of her data. As an alternative, this paper argues for fiduciary relationships, which put deliberative demands on digital health data controllers to keep the interests of their data subjects at the forefront as well as cater to the contextual nature of privacy. These deliberative requirements ensure that users can engage in collective participation and share their health data at a lower risk of privacy harms. This paper also proposes a way to balance the flexible and open-ended nature of fiduciary law with the specific nature and scope of fiduciary duties that digital health data controllers should owe to their data subjects.

Ethics in Design and Implementation of Technologies for Workplace Health Promotion: A Call for Discussion

“…Given that the law not yet protects the user in fiduciary relationships in certain professions ( 31 ), it is important to acknowledge these design-use dynamics in the design phase of a new technology and come up with solutions that could help overcome this gap in the law. Although some researchers already call for changing the law for fiduciary relationships ( 33 ), this would be a long and arduous process. Even if the law would change on this matter, it would still be important to define in which situations data sharing is condoned and with whom sharing health data is necessary.…”

“…In case of workplace improvements, the use of personal data could help to improve working conditions. The GDPR, however, does not provide a legal basis for the exchange of personal data in these specific relationships ( 33 ), making it difficult to use digital health data in the work environment, even if it can improve health of a worker.…”

Security and Privacy of mHealth Applications: A Scoping Review

“…Existing US regulations in the space of digital health include those of the Food and Drug Administration (FDA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which provides a Privacy Rule for safeguarding medical information [13]. However, HIPAA has been recently criticised for allowing too much access to data and not protecting patients from new threats to their data [14], [15].…”

The key to mental fatigue

“…In case of workplace improvements, the use of personal data could help to improve working conditions. The GDPR, however, does not provide a legal basis for the exchange of personal data in these specific relationships (Arora, 2019), making it difficult to use digital health data in the work environment, even if it can improve a worker's health.…”

“…Given that the law not yet protects the user in fiduciary relationships in certain professions (GDPR, 2016), it is important to acknowledge these design-use dynamics in the design phase of a new technology, and come up with solutions that could help overcome this gap in the law. Although some researchers already call for changing the law for fiduciary relationships (Arora, 2019), this would be a long and arduous process. Even if the law would change on this matter, it would still be important to define in which situations data sharing is condoned and with whom sharing health-data is necessary.…”