Privacy In mHealth Apps (Part II)

In our recent article, Privacy in Mobile mHealth Apps (Part I), we discussed the core aim of the 'Code of Conduct on privacy for mHealth apps' (Code): to regulate and secure the personal data gathered by mHealth apps. However, compliance with the Code doesn't necessarily equate to compliance with data protection law. Any code for mHealth will need to be consistent with the meaning and spirit of the GDPR, which comes into effect in 2018. Now, we assess the interplay between the proposed Code and the GDPR.

The Code and GDPR

The Article 29 Working Party (WP29) – the collective group of EU data protection authorities – provided recommendations to amend the text of the Code in April 2017. In a letter issued to the project editor of the draft Code, WP29 underlined that the Code should not only be compliant with current law, the Data Protection Directive (Directive), but also with GDPR. WP29 also highlighted that consent to personal data processing for