On 25.3.26, the FDPIC published on his website Notes on wearables published. They are aimed at users – buyers and parents who track their children.
The following requirements and recommendations can be derived from the information:
Manufacturer and supplier
- Privacy by Design
- Encrypting data transfers
- Security updates, vulnerability assessment
- Purpose limitation: Use of data for marketing or product development only with express consent
- Transparent data protection declarations
- Designate contact person for data protection inquiries; representation in Switzerland if necessary
User (buyer)
- Read privacy policy and terms and conditions
- Check where data is stored
- Restrict app permissions to what is functionally necessary, reject or revoke unnecessary ones
- Install updates regularly
Users of smart glasses and camera-enabled wearables
- Informing third parties about recordings and obtaining consent
- Refrain from undercover recordings (criminal law)
Parents
- Act in the interests of the child and respect their privacy
- Children cannot consent to their own surveillance
You will largely agree with this, except on one point:
Under Swiss law, the use of data for marketing purposes or for the development of own products requires the express consent of the data subject (see also Cookie Guide).
The processing of particularly sensitive personal data only requires consent if the principles of data processing are violated or such data is passed on to other data controllers (see e.g. here). The controller may therefore generally use health data for marketing purposes and product development without consent, including with profiling, also using machine learning.
The FDPIC does not justify the consent requirement in his guidance, but is likely to consider the processing of health data for the purposes mentioned as disproportionate from which he derives a requirement for consent.
Whether this argument is admissible or rather the free purpose of the person responsible violated, does not need to be discussed in detail here (see here). In any case, however, disproportionality could be only in individual cases and all circumstances would have to be taken into account, including
- the cost of the wearable or the associated services,
- the question of whether or not sensor data for marketing purposes uses potential health data as such. Upselling in an app based on training data, for example, uses data that allows conclusions to be drawn about the state of health, but the controller does not have to use this information content. If he does not do so, his processing cannot be equated with the processing of health data;
- Opt-out or other control options for the user;
- whether product development or marketing measures are also in the well-understood interest of the user.
It is also interesting to note the FDPIC’s reference to the Cookie guide. The FDPIC assumes that the use of non-essential cookies tends to be disproportionate and then requires justification. This is questionable in such general terms. In any case, however, the FDPIC also expressly leaves out the Justification by overriding interests open, and the same should apply here.
As a result, those responsible for data processing via wearables are advised to at least provide an opt-out right, i.e. a low-threshold option for limiting the use of sensor data. In this case, overriding interests are more likely or – which amounts to the same thing – a classification as proportionate.