Abstract
It remains unknown whether de-identifying wearable biometric monitoring data is sufficient to protect the privacy of individuals in the dataset. This systematic review seeks to shed light on this. We searched Web of Science, IEEE Xplore Digital Library, PubMed, Scopus, and the ACM Digital Library on December 6, 2021 (PROSPERO CRD42022312922). We also performed manual searches in journals of interest until April 12, 2022. Though our search strategy had no language restrictions, all retrieved studies were in English. We included studies demonstrating re-identification, identification, or authentication using data from wearables. Our search returned 17,625 studies, and 72 studies met our inclusion criteria. Our findings demonstrate that substantial re-identification risk exists in data from sensors generally not thought to generate identifiable information, such as the electrocardiogram and electromyogram. In many cases, only a small amount of data (1-300 seconds of recording) is sufficient for re-identification.
Competing Interest Statement
JD is a scientific advisor with stock options at Veri, Inc. She has also received a grant from the Chan Zuckerberg Initiative, consulting fees from Gold Track, Inc, honoraria from the American College of Cardiology and Shionogi, Inc., and support for attending meetings (ICAMPAM 2022 and PMWC 2022). DG is a scientific advisor for Magic Leap and Epilepsy AI, has stock options with Magic Leap, and has received gifts and services from Magic Leap. All other authors declare that they have no competing interests.
Funding Statement
This study did not receive any funding.
Author Declarations
I confirm all relevant ethical guidelines have been followed, and any necessary IRB and/or ethics committee approvals have been obtained.
Yes
The details of the IRB/oversight body that provided approval or exemption for the research described are given below:
This is a systematic review of available literature.
I confirm that all necessary patient/participant consent has been obtained and the appropriate institutional forms have been archived, and that any patient/participant/sample identifiers included were not known to anyone (e.g., hospital staff, patients or participants themselves) outside the research group so cannot be used to identify individuals.
Yes
I understand that all clinical trials and any other prospective interventional studies must be registered with an ICMJE-approved registry, such as ClinicalTrials.gov. I confirm that any such study reported in the manuscript has been registered and the trial registration ID is provided (note: if posting a prospective study registered retrospectively, please provide a statement in the trial ID field explaining why the study was not registered in advance).
Yes
I have followed all appropriate research reporting guidelines and uploaded the relevant EQUATOR Network research reporting checklist(s) and other pertinent material as supplementary files, if applicable.
Yes
Footnotes
↵* Co-senior authors
Abbreviations
- N
- number of subjects
- EER
- Equal Error Rate
- CIR
- Correct Identification Rate
- IMU
- inertial measurement unit
The Chan Zuckerberg Initiative, Cold Spring Harbor Laboratory, the Sergey Brin Family Foundation, California Institute of Technology, Centre National de la Recherche Scientifique, Fred Hutchinson Cancer Center, Imperial College London, Massachusetts Institute of Technology, Stanford University, University of Washington, and Vrije Universiteit Amsterdam.