Does de-identification of data from wearable Biometric Monitoring Technologies give us a false sense of security? A systematic review

It remains unknown whether de-identifying wearable biometric monitoring data is sufficient to protect the privacy of individuals in the dataset. This systematic review seeks to shed light on this. We searched Web of Science, IEEE Xplore Digital Library, PubMed, Scopus, and the ACM Digital Library on December 6, 2021 (PROSPERO CRD42022312922). We also performed manual searches in journals of interest until April 12, 2022. Though our search strategy had no language restrictions, all retrieved studies were in English. We included studies demonstrating re-identification, identification, or authentication using data from wearables. Our search returned 17,625 studies, and 72 studies met our inclusion criteria. Our findings demonstrate that substantial re-identification risk exists in data from sensors generally not thought to generate identifiable information, such as the electrocardiogram and electromyogram. In many cases, only a small amount of data (1-300 seconds of recording) is sufficient for re-identification.