Privacy in wearable health devices: How does POPIA measure up?

Abstract

The market for wearable devices that is used for health monitoring has steadily increased over the past few years. South Africa has also seen an increase in the adoption of these wearable device. This is partly because these devices allow users to monitor their health and wellbeing in real time. However, to be efficient, the devices must collect a large amount of data. Some of the data that is collected include personally identifiable and health information which could be considered sensitive to the user. This study investigated if the Protection of Personal Information Act (POPIA) provides adequate protection to South African users of wearable health devices. The POPIA and the privacy policy of the 2 most popular wearable health devices in South Africa, the Apple watch and Fitbit, were qualitatively compared making use of Hutton et al’s (2018) heuristic framework. The study found that POPIA protected the users’ privacy when it came to notice, users’ awareness, choice and consent, access and participation. The Act did not cover any privacy matters related to social disclosure of information by users. The study also found that Apple watch and Fitbit did well in protecting users’ privacy with regards to notice and awareness as well as access and participation. The two wearables performed poorest in regards to choice and consent as well as social disclosure controls to protect users’ privacy. The study recommend that users educate themselves in regard to how their data collected by wearable health devices are collected and protected.