Sensitive-By-Distance : Quasi-Health Data in the Algorithmic Era

This article offers a new perspective on the boundaries between health and non-health data in the age of “Quantified-Self” apps: the “data-sensitiveness-by-computational-distance” approach — or, more simply, the “sensitive-by-distance” approach. This approach takes into account two variables: the intrinsic sensitiveness (static variable) of personal data and the computational distance (a dynamic variable) between some kinds of personal data and pure health (or sensitive) data, which depends upon the computational capacity. From an objective perspective, computational capacity depends on the level of development of data retrieval technologies at a certain moment; availability of “accessory data” and the applicable legal restraints on processing data. From a subjective perspective, computational capacity depends on the specific data mining efforts (or ability to invest in them) taken by a given data controller: economic resources, human resources, and the use of accessory data. A direct consequence of the expansion of augmented humanity in collecting and inferring personal data is the increasing loss of health data processing “legibility” for data subjects. In order to address this issue, we propose exploiting existing legal tools in the GDPR to empower data subjects (the right to data access, the right to know the logic involved in automated decisionmaking, data portability, etc.)