Smart watches: a helping hand or sinister culture of surveillance?

Kat friend Jessica Banks provides perspective on the potential legal challenges to privacy posed by the increasing use of smart watches, especially with respect to children.

Use of smart watch technology is on the seemingly inexorable rise. One need only think of the use of a smart watch. A brief look around the office will show a growing proportion wearing some form of smart watch to track one's steps, monitor their heartbeat and distinguish their daily movements. With 71 million smartwatches reportedly sold in 2018 it was only a matter of time before this technology reached the younger generation. But the watches contain notable amounts of 'personal data' as defined by the Data Protection Act 2018, including location, call logs and phone numbers.

Enter the 'Enox Safe-Kid-One', produced by ENOX Production Services GmbH. This watch is designed to allow parents to track the location of their child and contact them through an accompanying app. At first glance, this might be seen as a parents' dream, enabling them to easily contact their child and ensure that they can monitor that their child is in a safe location at all times. The app even allows parents to "draw a geographical fence" around their child, which notifies a parent when their child exits that 'safe' area.

On the one hand, this enables a parent the freedom to leave their child to play and explore within a permitted perimeter, checking on them from the convenience of their office or home. However, on the flip side, would you want to be tracked? Doing so conjures up worrying connotations of animal tracking; moreover, it does not exactly engender a sense of trust between parent and child.

True, the watch is not the first of its kind in this area; Kat readers may be familiar, for example, with the Apple app 'find my friend', as a means of tracking our loved ones. But if we are able to track our friends and family so easily, who else could be doing the same?

Against this background, there have been a variety of concerns raised in connection with this Enox watch. Most notably, the European Commission has recalled the sale and distribution of this watch over safety fears for children. In an ironic twist, the watch, which is designed to promote child safety, may have resulted in the opposite.

The Commission considered this a serious security risk and as a result, alerted other nations in the European Economic Area (EEA) via its Rapid Alert System. Thus, the European Commission, in its recall alert, expressed concerns that the app could be easily hacked and data “such as location history, phone numbers, serial number can easily be retrieved and changed”.

The Commission also highlighted that commands could be sent through the watch to any "malicious user", making it possible to track and communicate easily with a child. Security experts have found it worryingly simple to track children when the watches did an inadequate job of encrypting data or checking who was logging information. This could, therefore, result in children's personal information being widely available to potentially dangerous individuals. The Commission, therefore, has directed public authorities across Europe to recall the product from end users.

Enox plans to appeal the decision with Iceland's consumer protection regulator, which had forwarded its concerns about the watch to the Commission. Enox founder, Ole Anton Bieltvedt, has stated that the watch had passed the necessary tests carried out by German regulators last year, allowing it to be sold.

As Kat readers are aware, over the last few years, we have seen some notable data breaches, including at British Airways, Dixon Carphone and even our own government. The GDPR introduced a duty to report data breaches within 72 hours to the relevant supervisory authority as soon as such breach was known to have occurred. Any organisation failing to notify a breach when required to do so can result in a fine up to 10 million euros or 2 per cent of global turnover. Fines aside, a concern that hacking may lead to disclosing the location and patterns of movement for children is of substantial concern.

The appeal by Enox puts into relief the conflicting concerns between parental responsibility and trust against the risk of privacy, cyber-hacking and data breach. So whether or not you are an advocate of this watch, it merits keeping a close eye on how this case develops.