3 ms·

If you live in the EU you can send them a data access request, which means they have to provide you with all your personally identifiable information that they

If you live in the EU you can send them a data access request, which means they have to provide you with all your personally identifiable information that they keep, in this case that means pretty much everything. I hate it when companies think that they can get away with making you pay for your data.

dawson 14y ago
I have always been curious about this, from a healthcare perspective. For example, we encrypt PID information one way (the patient has their own unique data access key, which is then encrypted with their password + salt and some 'other stuff'), so we couldn't hand over any information if a data access request was made, even if we wanted to as we don't have access to that information ourselves!
- hayksaakian 14y ago
  You could hand over the encrypted data, the usefulness of such data being low however.
  - dawson 14y ago
    The issue is that the PID is all encrypted, I wouldn't know if we have a John Doe on our system, we can't see anything to verify that user exists or that they're the appropriate owner of said data. We do have an email (which is also encrypted at a system level, which in theory we could access), but verifying an access request based on an email address? I don't know. The way we solve the problem is by making all the data available to the user once they have authenticated, as long as you can login to our website, all your data is available to you, but if you made a direct data access request to us, like a FOI to our office by letter (the typical way it's done), not much I think we could do.
    - thisone 14y ago
      Your IG team will know. From my understanding, from the yearly IG briefings I used to have, you would be able to provide that requester with information on how to obtain their personal access, and point out to them where they can find the information they have requested. Information needs to be made accessible, you don't necessarily need to actually provide printouts. For example, FOI requests from news agencies often cover the same topics. This information can and often is posted publicly on the organisation's website and the FOI responses refer the requester to those links.
      - alexkus 14y ago
        FOI requests are often made because people don't trust that the "all your information is displayed here on the website" is actually all of the information that is being held on them. What if the FOI request was supplemented with the users password (changed by them to a temporary one)? Other possibilities would be encrypting a second copy of the patients data (each time it is stored by the user) using a public key with the corresponding private key held in escrow somewhere on a machine with no network connection. It would then be someone's job, upon receiving an FOI request, to take the patients master-encrypted record(s), put them on the non-connected computer that contains the private key, decrypt, and print out in order to reply to the FOI and then clean up.
        thisone 14y ago
        If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and by whom, and that information must be available as well. Information that you'll probably also need to encrypt, but still be able to search by patient, date, and decrypter. (requests come through to find all records a particular employee has seen within a certain date range as well) I can see the start of a rabbit hole, which is why organisations dealing in PID have IG teams or consultants who know the laws and know how much needs to be done. If a patient thinks an organisation is holding out on them, that patient has a way to complain, and the complaints aren't taken lightly from what I've seen.
    - davidw 14y ago
      Interesting... I'm dealing with similar issues. What would be ideal is to have some kind of "password/data escrow" service that is separate from companies like yours, or the one I'm working with, so that there is a way to recover the data if a password is lost, but a formal/legal separation of the means to access it is maintained.
    - rmc 14y ago
      if you made a direct data access request to us, like a FOI to our office by letter (the typical way it's done), not much I think we could do. Minor pedantic peeve of mine: Many countries have Freedom of Information (FOI) laws, and Data Protection. Often FOI only refers to government bodies and covers lots of stuff (e.g. "How much per year does my local council spend cleaning the local park?"), however data protection mostly applies to personal data that anyone (government or private enterprise) holds on you. Data Protection laws sometimes make it illegal for the company to tell third parties the personal data about you.
- rmc 14y ago
  That sounds like no problem at all. You (the company) only have to hand over data you have. If you have no data, then you have nothing to hand over.
rmc 14y ago
This is only really useful if the company is in the EU. If they aren't then they aren't bound by that law. After all, there is nothing your local Data Protection Commissioner / courts can do to them to make them comply. From looking around the FitBit site, it seems they are in California, so Californian law applies. No EU Data Protection Directive there I'm afraid. (If they were in EU their terms & conditions would probably not be binding anyway, against the EU Unfair Terms & Conditions Directive)
- omh 14y ago
  Their Privacy Policy[1] says that they're a member of the Safe Harbor scheme - which is supposed to provide "equivalent" protection for exported data. It includes the principle that users should have access to their information, albeit with a significant caveat: Individuals must have access to personal information about them that an organization holds and be able to correct, amend, or delete that information where it is inaccurate, except where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy in the case in question, or where the rights of persons other than the individual would be violated It would be interesting to send them a request and see what their position is. [1] http://www.fitbit.com/uk/privacy http://www.fitbit.com/uk/privacy

dawson 14y ago

I have always been curious about this, from a healthcare perspective. For example, we encrypt PID information one way (the patient has their own unique data access key, which is then encrypted with their password + salt and some 'other stuff'), so we couldn't hand over any information if a data access request was made, even if we wanted to as we don't have access to that information ourselves!

hayksaakian 14y ago
You could hand over the encrypted data, the usefulness of such data being low however.
- dawson 14y ago
  The issue is that the PID is all encrypted, I wouldn't know if we have a John Doe on our system, we can't see anything to verify that user exists or that they're the appropriate owner of said data. We do have an email (which is also encrypted at a system level, which in theory we could access), but verifying an access request based on an email address? I don't know. The way we solve the problem is by making all the data available to the user once they have authenticated, as long as you can login to our website, all your data is available to you, but if you made a direct data access request to us, like a FOI to our office by letter (the typical way it's done), not much I think we could do.
  - thisone 14y ago
    Your IG team will know. From my understanding, from the yearly IG briefings I used to have, you would be able to provide that requester with information on how to obtain their personal access, and point out to them where they can find the information they have requested. Information needs to be made accessible, you don't necessarily need to actually provide printouts. For example, FOI requests from news agencies often cover the same topics. This information can and often is posted publicly on the organisation's website and the FOI responses refer the requester to those links.
    - alexkus 14y ago
      FOI requests are often made because people don't trust that the "all your information is displayed here on the website" is actually all of the information that is being held on them. What if the FOI request was supplemented with the users password (changed by them to a temporary one)? Other possibilities would be encrypting a second copy of the patients data (each time it is stored by the user) using a public key with the corresponding private key held in escrow somewhere on a machine with no network connection. It would then be someone's job, upon receiving an FOI request, to take the patients master-encrypted record(s), put them on the non-connected computer that contains the private key, decrypt, and print out in order to reply to the FOI and then clean up.
      - thisone 14y ago
        If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and by whom, and that information must be available as well. Information that you'll probably also need to encrypt, but still be able to search by patient, date, and decrypter. (requests come through to find all records a particular employee has seen within a certain date range as well) I can see the start of a rabbit hole, which is why organisations dealing in PID have IG teams or consultants who know the laws and know how much needs to be done. If a patient thinks an organisation is holding out on them, that patient has a way to complain, and the complaints aren't taken lightly from what I've seen.
  - davidw 14y ago
    Interesting... I'm dealing with similar issues. What would be ideal is to have some kind of "password/data escrow" service that is separate from companies like yours, or the one I'm working with, so that there is a way to recover the data if a password is lost, but a formal/legal separation of the means to access it is maintained.
  - rmc 14y ago
    if you made a direct data access request to us, like a FOI to our office by letter (the typical way it's done), not much I think we could do. Minor pedantic peeve of mine: Many countries have Freedom of Information (FOI) laws, and Data Protection. Often FOI only refers to government bodies and covers lots of stuff (e.g. "How much per year does my local council spend cleaning the local park?"), however data protection mostly applies to personal data that anyone (government or private enterprise) holds on you. Data Protection laws sometimes make it illegal for the company to tell third parties the personal data about you.
rmc 14y ago
That sounds like no problem at all. You (the company) only have to hand over data you have. If you have no data, then you have nothing to hand over.

rmc 14y ago

This is only really useful if the company is in the EU. If they aren't then they aren't bound by that law. After all, there is nothing your local Data Protection Commissioner / courts can do to them to make them comply. From looking around the FitBit site, it seems they are in California, so Californian law applies. No EU Data Protection Directive there I'm afraid. (If they were in EU their terms & conditions would probably not be binding anyway, against the EU Unfair Terms & Conditions Directive)

omh 14y ago
Their Privacy Policy[1] says that they're a member of the Safe Harbor scheme - which is supposed to provide "equivalent" protection for exported data. It includes the principle that users should have access to their information, albeit with a significant caveat: Individuals must have access to personal information about them that an organization holds and be able to correct, amend, or delete that information where it is inaccurate, except where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy in the case in question, or where the rights of persons other than the individual would be violated It would be interesting to send them a request and see what their position is. [1] http://www.fitbit.com/uk/privacy http://www.fitbit.com/uk/privacy