I suppose one could immediately counter this by asking - how much of your medical history would you willingly share with random people on the street? And how about if you knew they wanted to gather it up and sell it? Maybe for yourself, you don't care about that, but I think most people consider this sort of thing deeply personal and private.

In a more practical sense, it's not a big stretch to imagine a future where there are all kinds of insurance penalties associated with certain health conditions, plus the potential for hidden discrimination in multiple areas like job applications (maybe they did reject you because of your health condition, but how would you prove it?). I'm sure there are other potential problems.

I would choose to share my medical history with strangers over my data from most other digital services, from my Google search history to my private messages to my emails.

> Maybe for yourself, you don't care about that, but I think most people consider this sort of thing deeply personal and private.

Part of the reason I asked. Why are your conversations less private and personal to you/others/this journalist than what is probably a mundane medical history or in this case, just a pulse?

The discrimination angle certainly makes sense though as a plausible fear.

Perhaps medical records are more 'viscerally' private to people than conversations with friends? It's easier to forget that big brother is recording everything you say when most of it is amiable chatter, but when it comes to having, say, incurable butt-warts, people become a lot more reticent, if only out of a fear of embarrassment.

Personally, short of deleting my account, I stay as far away from Facebook as I can, and try to minimise the amount of data I share with other services, although some compromises are still necessary or at least sufficiently convenient.

The issue is in the combination of data. Could you imagine the value of knowing if your heart rate went up after reading a certain message, or seeing a certain ad?

I don't care about the value.

What's the cost?

We can’t know the cost without knowing the value. Nothing will happen to the data unless someone buys it.

To identify the costs, we’ll have to think about who might want to purchase this data and what they could do with it.

Ask yourself this: why would anyone be willing to pay for your heart rate?

>Could you imagine the value of knowing if your heart rate went up after reading a certain message, or seeing a certain ad?

No, I'm guessing it's worth a couple of cents ?

Perhaps. But this kind of psychographic profiling is used in labs to craft better adverts. Video games are another example.

The Left 4 Dead director was trained on player emotions and designed to improve the game, which was a huge success.

Having access to it in the field has real applications.

Beyond health conditions, heart rate is correlated with the activities you do.

Sleeping, walking, running and other fun stuff has a different heart rate profile, especially more so when time is taken into account (do you run for 3 minutes in the morning? maybe you’re late for a bus?).

This becomes even more concerning when it’s crossed with other data such as location, purchases, ad engagement... Very scary to be honest.

I guess it could be a very course analog for "Feeling" in any direction. You could make guesses on what exactly that feeling is based on some context.

At any rate, getting an add that said "Always running late? Try Uber!" after running for a bus would be super creepy, I don't want any of that.

Or worse:

“We noticed your heart rate was only elevated for a couple of minutes in bed last night, need help lasting longer in bed?”

Or

“We noticed the same heart signature while you were away from your wife’s location, need a divorce lawyer?”

Maybe if you consider the heartrate in isolation, but imagine that they corrrelate it with other things. For instance using it to figure out which ads you are responsive to.

Depends on the context.

Data and what one can do with personal data is unknown unknown.

My observation is that "black mirror" type exploitation of private information is already happening.

If you’re focusing on a person having access to your pulse data as the threat model, your thinking is out of date. The real play will be combining heart rate data with other signals like which Facebook page you’re viewing in order to inject ads. Basically, know when you’re most vulnerable to influence and catching you with a post that sends whatever message the highest bidder wants for you at that moment.

That is the rub with most of this 'data'. Each one by itself it is nearly meaningless. But tossed together it creates a much more interesting thing to use. Like my DOB is borderline useless. But combined with a few other random bits of info and you can target me nearly exactly. The amount of random info is not much at all either. Add in a metric like gets depressed/excited by, and the intrusion gets even deeper.

What heart rate makes me most vulnerable?

When they've learned that your base heart rate is ~70bpm and when you get shown a puppy your heart rate excites by 20bpm they can guess that you like puppies. They could be wrong, and it could be that you're actually terrified of puppies, but they'd be safe in assuming that you're a big fan of them and so they add "Enjoys puppies" to their advertising profile of you.