JMIR Publications

ABSTRACT

Background:

Scientific data collection is strictly regulated regarding data protection and privacy. The European General Data Protection Regulation (GDPR) regulates rights and responsibilities regarding the processing of personal information. Anonymization simplifies data handling by reducing restrictions but requires removing identifiers from data and metadata. Specifically, internet protocol (IP) addresses are considered personal data, as they could be used to track users. In mobile data collection, even if data from a device is fully anonymized, transmitting it via standard protocols still exposes the IP address, preventing full anonymization.

Objective:

To develop a GDPR-compliant concept that enables fully anonymized scientific data collection on mobile devices.

Methods:

We designed a concept enabling scientific data collection on mobile devices using a proxy-architecture and encryption mechanisms to ensure anonymization. The concept is targeted at partnerships between research entities and operators of mobile applications, for example, foundations or companies. In this setup, such companies and foundations can act as data trust agencies to enable scientific data collection without being responsible for the collection of sensible data.

Results:

The proposed concept was integrated and tested in the HerzFit application for cardiovascular prevention with more than 150,000 downloads in German speaking countries. Since the release of the data donation feature in HerzFit, we have received data donations from 6,124 users.

Conclusions:

The proposed concept enables GDPR-compliant, anonymized data collection using mobile devices, facilitating scientific data collection at scale.