Ethical Ambiguities in the Privacy Policies of Mobile Health and Fitness Applications

Author(s):  
Devjani Sen ◽  
Rukhsana Ahmed

Personal applications (apps) collect all sorts of personal information like name, email address, age, height, weight, and in some cases, detailed health information. When using such apps, many users trustfully log everything from diet to sleep patterns. Studies suggest that many applications do not have a privacy policy, or users do not have access to an app's permissions before s/he downloads it to the mobile device. This raises questions regarding the ethics around sharing personal data gathered from health and fitness apps to third parties. Despite the important role of informed consent in the creation of health and fitness mobile applications, the intersection of ethics and sharing of personal information is understudied and is an often-ignored topic during the creation of mobile applications. After reviewing the online privacy policies of four mobile health and fitness apps, this chapter concludes with a set of recommendations when designing privacy policies to share personal information collected from health and fitness apps.

Author(s):  
Devjani Sen ◽  
Rukhsana Ahmed

Personal Applications (apps) collect all sorts of personal information like name, email address, age, height, weight and in some cases detailed health information. When using such apps, many users trustfully log everything from diet to sleep patterns. Studies suggest that many applications do not have a privacy policy, or users do not have access to an app's permissions before s/he downloads it to the mobile device. This raises questions regarding the ethics around sharing personal data gathered from health and fitness apps to third parties. Despite the important role of informed consent in the creation of health and fitness mobile applications, the intersection of ethics and sharing of personal information is understudied and is an often-ignored topic during the creation of mobile applications. After reviewing the online privacy policies of four mobile health and fitness apps, this chapter concludes with a set of recommendations when designing privacy policies to share personal information collected from health and fitness apps.


Author(s):  
Devjani Sen ◽  
Rukhsana Ahmed

With a growing number of health and wellness applications (apps), there is a need to explore exactly what third parties can legally do with personal data. Following a review of the online privacy policies of a select set of mobile health and fitness apps, this chapter assessed the privacy policies of four popular health and fitness apps, using a checklist that comprised five privacy risk categories. Privacy risks, were based on two questions: a) is important information missing to make informed decisions about the use of personal data? and b) is information being shared that might compromise the end-user's right to privacy of that information? The online privacy policies of each selected app was further examined to identify important privacy risks. From this, a separate checklist was completed and compared to reach an agreement of the presence or absence of each privacy risk category. This chapter concludes with a set of recommendations when designing privacy policies for the sharing of personal information collected from health and fitness apps.


Author(s):  
Devjani Sen ◽  
Rukhsana Ahmed

With a growing number of health and wellness applications (apps), there is a need to explore exactly what third parties can legally do with personal data. Following a review of the online privacy policies of a select set of mobile health and fitness apps, this chapter assessed the privacy policies of four popular health and fitness apps, using a checklist that comprised five privacy risk categories. Privacy risks, were based on two questions: a) is important information missing to make informed decisions about the use of personal data? and b) is information being shared that might compromise the end-user's right to privacy of that information? The online privacy policies of each selected app was further examined to identify important privacy risks. From this, a separate checklist was completed and compared to reach an agreement of the presence or absence of each privacy risk category. This chapter concludes with a set of recommendations when designing privacy policies for the sharing of personal information collected from health and fitness apps.


2020 ◽  
Vol 2020 (4) ◽  
pp. 491-510
Author(s):  
Laura Shipp ◽  
Jorge Blasco

AbstractMenstruapps are mobile applications that can track a user’s reproductive cycle, sex life and health in order to provide them with algorithmically derived insights into their body. These apps are now hugely popular, with the most favoured boasting over 100 million downloads. In this study, we investigate the privacy practices of a set of 30 Android menstruapps, a set which accounts for nearly 200 million downloads.We measured how the apps present information and behave on a number of privacy related topics, such as the complexity of the language used, the information collected by them, the involvement of third parties and how they describe user rights. Our results show that while common pieces of personal data such as name, email, etc. are treated appropriately by most applications, reproductive-related data is not covered by the privacy policies and in most cases, completely disregarded, even when it is required for the apps to work. We have informed app developers of our findings and have tried to engage them in dialogue around improving their privacy practices.


2021 ◽  
Vol 2021 (2) ◽  
pp. 88-110
Author(s):  
Duc Bui ◽  
Kang G. Shin ◽  
Jong-Min Choi ◽  
Junbum Shin

Abstract Privacy policies are documents required by law and regulations that notify users of the collection, use, and sharing of their personal information on services or applications. While the extraction of personal data objects and their usage thereon is one of the fundamental steps in their automated analysis, it remains challenging due to the complex policy statements written in legal (vague) language. Prior work is limited by small/generated datasets and manually created rules. We formulate the extraction of fine-grained personal data phrases and the corresponding data collection or sharing practices as a sequence-labeling problem that can be solved by an entity-recognition model. We create a large dataset with 4.1k sentences (97k tokens) and 2.6k annotated fine-grained data practices from 30 real-world privacy policies to train and evaluate neural networks. We present a fully automated system, called PI-Extract, which accurately extracts privacy practices by a neural model and outperforms, by a large margin, strong rule-based baselines. We conduct a user study on the effects of data practice annotation which highlights and describes the data practices extracted by PI-Extract to help users better understand privacy-policy documents. Our experimental evaluation results show that the annotation significantly improves the users’ reading comprehension of policy texts, as indicated by a 26.6% increase in the average total reading score.


Author(s):  
Zerin Mahzabin Khan ◽  
Rukhsana Ahmed ◽  
Devjani Sen

No previous research on cancer mobile applications (apps) has investigated issues associated with the data privacy of its consumers. The current chapter addressed this gap in the literature by assessing the content of online privacy policies of selected cancer mobile apps through applying a checklist and performing an in-depth critical analysis to determine how the apps communicated their privacy practices to end users. The results revealed that the privacy policies were mostly ambiguous, with content often presented in a complex manner and inadequate information on the ownership, use, disclosure, retention, and collection of end users' personal data. These results highlight the importance of improving the transparency of privacy practices in health and fitness cancer mobile apps to clearly and effectively communicate how end users' personal data are collected, stored, and shared. The chapter concludes with recommendations and discussion on practical implications for stakeholders like cancer app users, developers, policymakers, and clinicians.


2019 ◽  
Vol 28 (1) ◽  
pp. 68-96
Author(s):  
Konstantina Vemou ◽  
Maria Karyda

Purpose In the Web 2.0 era, users massively communicate through social networking services (SNS), often under false expectations that their communications and personal data are private. This paper aims to analyze privacy requirements of personal communications over a public medium. Design/methodology/approach This paper systematically analyzes SNS services as communication models and considers privacy as an attribute of users’ communication. A privacy threat analysis for each communication model is performed, based on misuse scenarios, to elicit privacy requirements per communication type. Findings This paper identifies all communication attributes and privacy threats and provides a comprehensive list of privacy requirements concerning all stakeholders: platform providers, users and third parties. Originality/value Elicitation of privacy requirements focuses on the protection of both the communication’s message and metadata and takes into account the public–private character of the medium (SNS platform). The paper proposes a model of SNS functionality as communication patterns, along with a method to analyze privacy threats. Moreover, a comprehensive set of privacy requirements for SNS designers, third parties and users involved in SNS is identified, including voluntary sharing of personal data, the role of the SNS platforms and the various types of communications instantiating in SNS.


2019 ◽  
Vol 14 (2) ◽  
pp. 116-118 ◽  
Author(s):  
Stephanie Krueger

A Review of: Tummon, N., & McKinnon, D. (2018). Attitudes and practices of Canadian academic librarians regarding library and online privacy: A national study. Library and Information Science Research, 40(2), 86-97. https://doi.org/10.1016/j.lisr.2018.05.002 Abstract Objective – To assess attitudes of Canadian academic librarians regarding online privacy issues and to gauge their knowledge of related procedures and policies at their institutions. Design – Attitudinal online survey in English. Setting – English-language academic libraries in 10 Canadian provinces. Subjects – English-speaking academic librarians across Canada. Methods – Survey, based on Zimmer’s 2014 study of librarians in the United States of America, announced via email to 1,317 potential participants, managed using LimeSurvey, and available from April 7 to May 5, 2017. In 28 optional multiple choice or Likert scale questions, the survey prompted participants to express their attitudes regarding online privacy scenarios and privacy-related library practices, including patron data collection. Results were analyzed in Microsoft Excel and SPSS. Main Results – The survey response rate was 13.9% (183 respondents). Job position, age, or geographic location did not appear to influence attitudes towards privacy, with almost all respondents strongly agreeing or agreeing that individuals should control who sees their personal information (96.2%) and that companies collect too much such information (97.8%). Respondents voiced slightly less concern about government information collection, but nearly all respondents agreed that governments should not share personal information with third parties without authorization and that companies should only use information for the purposes they specify. When asked if privacy issues are more important today than five years ago, 69.9% of respondents said they were more concerned and 78.1% noted they knew more than five years before about privacy-related risks. Regarding online behaviour, 53.3% of respondents felt web behaviour tracking is both beneficial and harmful, with 29.1% considering it harmful, and 13.7% finding it neither beneficial nor harmful. Online shopping and identify theft, social media behaviour tracking, search engine policy display, and personal information sharing were also areas of concern for respondents, with the majority noting they were somewhat or very concerned about these issues.  In terms of library practices, most respondents strongly agreed that libraries should not share personal information, circulation records, or Internet use records with third parties unless authorized, though 33% of respondents noted they could neither agree nor disagree that libraries are doing all they can to prevent unauthorized access to such information. The majority of respondents strongly agreed or agreed that libraries should play a role in educating patrons about privacy issues. Many respondents (68.9%) did not know if their libraries had practices or procedures for dealing with patron information requests from law enforcement or governmental representatives. The majority of respondents did not know if patrons at their libraries had inquired about privacy issues, 42.3% did not know if their libraries communicate privacy policies to patrons, and 45.4% noted their libraries did not inform patrons about library e-resource privacy policies. Many respondents (55.2%) had attended educational sessions about online privacy and surveillance in the past five years, while 52.2% noted their libraries had not hosted or organized such sessions over the same period. Conclusion – Survey participants showed concern about online and patron privacy, though their lack of knowledge about local procedures and policies highlights a potential need for enhanced privacy education.


2021 ◽  
Author(s):  
Daria Ilkina

This thesis investigates the privacy risks that m-learning app users face by identifying the personal information that m-learning apps collect from their users, and the privacy policies of these apps. It reveals that most of the m-learning applications have similar privacy policies, which seem to protect the interest of the providers rather than the users. The Privacy by Design framework is reviewed to determine whether it can help the developers address user privacy practices. The results from the sample of 260 participants suggest that users are less concerned with the collection of personal information that is non-identifiable. The survey also revealed that the users are more concerned when an app shares their personal information with third parties for commercial purposes than when it is shared with the government.


Author(s):  
Irene Maria Portela

The chapter discusses the role of CNPD (Comissão Nacional de Proteção de Dados) in case of violation of privacy, like dissemination or revelation of personal data by a public/private organization or entity. About this subject, the CNPD can issue a recommendation to the Portuguese Treasury to take some measures to strictly protect the security of the personal information using the Portuguese “E-Invoice.” Portuguese people must be protected against the misuse of personal data by the use of the “E-Invoice.” A Security System Administrator continuously monitors the network and all data traffic to prevent any misuse or abuse of the system. A prerequisite for trust and acceptance of these information systems is that appropriate data protection measures are implemented against possible misuse of personal data decreasing the risks in its utilization. Protective measures should be taken by the Treasury referring additional procedures against the misuse of data because the administrative control system is inefficient regarding unauthorized access, disclosure, misuse of localization data or loss, modification, and appropriation of information linked with the use of the Portuguese “E-Invoice.”


Sign in / Sign up

Export Citation Format

Share Document