Wearables makers often retain data after closing down

As wearables makers have proliferated over the last decade, the lack of clarity over ownership, storage, retrieval and disposal of customer's biometric data held on company servers after they are acquired by other businesses, close down or change business models is leading to increasing frustrations surrounding data privacy and cyber risk in the IoT era. The current lack of industry regulation over this issue means that the digital health industry is mainly free to set their own policies in this regard, and often they choose to retain such data, leaving customers to question whether the data privacy risks of using wearables outweigh the perceived health advantages.

Whether he was dancing at Burning Man or biking through San Francisco, Greg Schwartz always trusted his BodyMedia Fit armband to track his activity. So when BodyMedia announced that, as of Jan. 31, its customers would no longer be able to access their data as the result of the company being acquired by Jawbone, Schwartz was disappointed. But what really frustrated him was the process of exporting his data before the shutdown.

BodyMedia’s website let him download the totals of various activity levels logged per day. Yet Schwartz, who is on an ongoing and concerted quest to understand his health, wanted his data down to the minute.

As a member of the Quantified Self community, he probably cares about this data more than most people do — and yet, he argues, he and all other customers have a right to it in full.

“If I told you, ‘You uploaded photos to our photo-backup website and you can’t have them, we’re going out of business, goodbye,’ people would scream,” Schwartz, a 32-year-old freelance user experience designer and online dating coach, told BuzzFeed News. “It isn’t really fair to say, ‘Oh, it’s just data and sorry, you can’t have it’ or ‘We’re going to make you jump through hoops to get it.’ It’s something I think a lot of companies don’t get yet and are starting to as this kind of thing happens.”

Wearables startups have proliferated over the last decade or so. But as some of them get acquired, close, or change business models, customers are starting to find that it can be tricky to get large volumes of irreplaceable biometric data off their servers. For some, it’s merely annoying; others see potentially bigger privacy issues in whether they’re allowed to delete their data before a shutdown — or how a company might continue using it after it cuts off access.

Those questions could grow as the wearables industry begins to shrink to a handful of power players. (Last year, for example, Misfit was acquired by watchmaker Fossil, and Adidas bought the app and wearable maker Runtastic.) While relatively few people used BodyMedia until the end, it’s not hard to imagine that at least some of Fitbit’s customers would be peeved if the company were to theoretically go out of business and take away or limit access to their data.

In a way, it’s the latest version of a classic problem: Data formats tend to become obsolete as technologies come and go, making it hard or impossible to read a floppy disc, watch a VHS tape, or listen to a CD.

