I was in charge of data security and privacy at Pebble among other things. I fought hard against data science teams having access to PII. It made me few friends but considering the data could reveal health issues I regarded it as health data even if it technically legally is not at the moment.
We were bought by Fitbit which operated with almost complete disdain for any attempt at security or privacy that could slow down operations. Anybody who wanted paintext access to user data seemed to get it without delay. Security and privacy were not among the things that created shareholder value so every issue I discovered was permanently backlogged.
It was depressing seeing all the data I fought to hard to protect be absorbed into a machine that would sell it off to the highest bidder, or shrug when it got stolen by a blackhat. I quit 3 months before my golden handcuffs would have kicked in because it felt too unethical to keep working there.
Then of course all the data was sold again, this time to Google. No Pebble user ever consented to their health data being sold to Google, but all of this is legal.
We were bought by Fitbit which operated with almost complete disdain for any attempt at security or privacy that could slow down operations. Anybody who wanted paintext access to user data seemed to get it without delay. Security and privacy were not among the things that created shareholder value so every issue I discovered was permanently backlogged.
It was depressing seeing all the data I fought to hard to protect be absorbed into a machine that would sell it off to the highest bidder, or shrug when it got stolen by a blackhat. I quit 3 months before my golden handcuffs would have kicked in because it felt too unethical to keep working there.
Then of course all the data was sold again, this time to Google. No Pebble user ever consented to their health data being sold to Google, but all of this is legal.