Datafication of Care: Security and Privacy Issues with Health Technology for People with Diabetes ^†

Abstract

Through the conceptual framework of datafication, dataism and dataveillance, this study investigates beliefs and attitudes regarding datafication and the related privacy and security concerns among individuals with Type 1 diabetes. Qualitative research was conducted through interviews among fifty-two individuals with Type 1 diabetes in Poland and Italy. The findings reveal a dynamic interplay between self-discipline and empowerment. The majority of interviewees emphasized the benefits of technologies for gaining a better understanding of their health condition and for more effective disease management. However, a minority of interviewees perceived the negative effects of datafication, including dataveillance, which leads to hyper-control of the disease, and dataism, characterized by excessive reliance on and dependency on technology. Critical beliefs about technologies fuelled rejection attitudes, leading some interviewees to suspend or abandon their use. Lastly, reflexivity on privacy and security issues appears to be low, particularly among older individuals with lower levels of education and socioeconomic status. This results in a poor understanding and underestimation of the potential risks associated with security and privacy. The findings increase the understanding of the factors that can facilitate or hinder the adoption of technology among people with diabetes.

1. Introduction

Digital health technologies can play a crucial role in transforming healthcare [1]. They can help healthcare systems cut costs, for instance, by using assistive devices to support the ageing in place of older adults [2]. Simultaneously, these technologies can empower individuals to independently manage their health conditions [3,4], thus enhancing their quality of life [5,6]. Type 1 (henceforth T1) diabetes presents a unique condition. It demands substantial patient engagement in daily disease management [7] amidst an evolving landscape of advanced digital interventions, making this illness increasingly “technologically textured” [8,9].

While the adoption of digital solutions in patient care unlocks new opportunities for self-management [10,11], it also introduces challenges related to data security and system integrity [12,13,14]. With the gradual introduction of digital devices that produce, collect, store and analyse an increasing amount of personal health data, concerns about patient safety and privacy are growing [12], extending to patients themselves [14]. An evaluation of privacy-related permissions in mobile apps for diabetes revealed that around 60% of the apps requested potentially risky permissions, while 28.4% lacked a privacy policy website, posing a significant risk to users’ data privacy [13].

Therefore, this article aims to analyse safety and privacy concerns related to digital health technologies, focusing on individuals with T1 diabetes residing in Poland and Italy. These countries offer an interesting field of study, as they share similarities in terms of diabetes prevalence, level of digital skills among the general population as well as legal framework concerning health security and data privacy. However, they also exhibit differences in their healthcare systems and access to diabetes care technologies (see Section 1.2). This comparative approach allows us to understand the prevailing social attitudes towards our research subject among people with diabetes who operate in similar legal frameworks but partially different healthcare contexts.

Adopting a qualitative research design based on grounded theory, this study examines the issue of privacy and security from the perspective of people with diabetes through semi-structured interviews. Grounded theory aims to achieve “the discovery of theory from data systematically obtained from social research” [15] (p. 2). By adopting an inductive approach, grounded theorists endeavour to discern themes and theoretical categories from the data and to analyze the relationships among the key categories [16]. This method proves particularly useful for research on chronic illness, as it facilitates the collection of lived experiences of ill individuals, their social construction of self and illness and their diverse interpretations of actions and situations [17,18,19].

This study employs the theoretical framework developed around the concept of ‘datafication’ [20,21], aiming to explore the social impact that the constant production of data has on people with diabetes who use digital tools such as continuous glucose monitoring and insulin pumps as well as their beliefs and attitudes regarding the security and privacy of their health data. Understanding these factors is crucial because beliefs about datafication and security/privacy issues can act as barriers to technology adoption [3].

1.1. The Datafication of Care between Dataism and Dataveillance

In recent decades, technologies aimed at treating diabetes, particularly T1 diabetes, have advanced rapidly [22]. These advancements include self-management devices designed for monitoring blood glucose levels and administering insulin, along with e-health tools such as mobile applications, app technologies and telehealth services for providing diabetes education on topics like nutrition, physical activity and medication adherence [23,24]. The primary technological innovations driving these improvements have been the introduction of continuous glucose monitoring devices (“sensors”), which supplement manual meters, and the adoption of a continuous subcutaneous insulin infusion for insulin delivery (known as “insulin pumps”) as an alternative to multiple daily injections, such as those administered through “pens” [10,11]. Through traditional instruments, such as glucometers and test strips, persons with T1 diabetes tend not to adhere properly to the self-monitoring regimen necessary to slow the progression of medium and long-term diabetic complications [10]. Continuous glucose monitoring devices have revolutionized the self-monitoring method that individuals use to measure their blood glucose, enabling them to achieve more optimized glycemic control and, consequently, to make informed decisions about diabetes management [10,25]. In parallel, insulin pump technology has also advanced, aiming to more accurately mimic the physiological secretion of insulin and support individuals in achieving more efficient glycemic control and precise insulin dosing with fewer injections, while minimizing the risk of hypoglycemia [11].

Several studies have emphasized the potential benefits of using these technologies in diabetes management. The use of continuous blood glucose monitoring tools enhances blood glucose control [25,26,27,28] mitigates the occurrence of hypoglycemic episodes [27,29,30] and reduces a significant parameter like glycated hemoglobin and diabetic complications [31,32,33]. Similarly, automated insulin infusion systems can have positive effects in reducing hypoglycemia, improving blood glucose control and enhancing patients’ quality of life [34,35]. This results in increased freedom and flexibility for patients in self-managing their disease [36,37].

Nevertheless, despite the numerous possibilities, concerns arise regarding the practical application of health technologies. In the contemporary sociological literature, there is an ongoing discourse concerning the influence of health technology use, particularly the “self-surveillance/empowerment dichotomy”. On the one hand, digital health technologies exhibit a self-surveillance effect, while on the other, they carry an empowerment effect inherent in health technologies [38,39,40,41,42,43]. The former perspective underscores the disciplinary and constraining impact of health technologies, which may induce behavioural changes through continuous data generation and transmission [9,44,45,46,47,48]. This, in turn, fosters an expansion of medical scrutiny into the day-to-day lives of self-tracked patients [39,43,49] and introduces an individualistic dimension to health, transferring responsibility from healthcare systems to individuals [9,44,50]. The latter perspective views the individualization of responsibility for one’s health condition positively, emphasizing the empowering potential of technology [51,52]. Health technologies empower patients by fostering a heightened awareness of their health status, which can inculcate a greater sense of responsibility for one’s health, initiating a virtuous cycle [3,45,53].

A specific aspect related to digital health technologies for diabetes involves the continuous generation of data enabled by the tools used for blood glucose monitoring and insulin infusion [54,55]. The social impact of the substantial data generation enabled by diabetes technologies can be an intriguing subject of investigation, in light of the dichotomy between self-surveillance and empowerment. In this work, we specifically adopt the theoretical framework developed around the concept of datafication.

Datafication refers to the social process involving both the transformation of human behaviour into data [20,21,50,56] and the generation of various types of value through data [57]. The first aspect, namely the process of quantification of human life, is conditioned by the mechanisms of data collection [57]. Therefore, it is necessary to promote the adoption of digital tools that facilitate data collection and to adopt changed practices instead of those traditionally conducted differently through these tools [50]. Indeed, individuals with diabetes are increasingly shifting their self-management practices to incorporate the use of health apps, sensors and insulin pumps [22].

The second aspect refers to the extraction of different kinds of value from data and represents the most critical point in the datafication process. As Mejias and Couldry argue, the problem does not lie in the collection of data, but rather “with how and by whom it is systematically collected and used” [57] (p. 7), [21]. Many recent theoretical contributions on datafication primarily examine the phenomenon in the context of capitalism, focusing on data production managed by digital platforms owned by large corporations and its commercialization, i.e., the exploitation of data for profit [20,21,39,56,57,58]. Originating from different theoretical and disciplinary perspectives, these reflections seek to uncover the power dynamics and the social risks underlying the process of datafication.

The main social risks highlighted in the literature generally concern the reduction of individual autonomy in datafication processes [21,59,60,61,62]. Socio-legal studies, for instance, criticize datafication as detrimental to basic individual rights and individual autonomy. The protection of personal data is considered a fundamental right [63] (Article 2), and these studies call for developing effective regulatory mechanisms to safeguard citizens’ privacy. As Cohen argued, “a society that values innovation ignores privacy at its peril” [61] (p. 1906); therefore, to protect privacy is also to shield the processes of play and experimentation that produce innovation.

To understand how to address social risks related to privacy violations, it’s essential to consider the basic distinction within the literature on two perspectives: consequentialism and deontology [64,65]. Consequentialism assumes that “normative properties depend only on consequences” [66]. Consequentialist approaches weigh the value of actions by primarily establishing what is ‘good’; hence, ‘right’ is defined as that which achieves ‘the good’ [67]. Therefore, from a consequentialist perspective, harm is represented by the negative consequences that individuals may experience from data privacy violations. These consequences can be direct (e.g., workplace discrimination when information about one’s health condition has been disclosed) or indirect (emotional distress arising from anxiety about data insecurity) [64].

In contrast, deontological approaches hold that ‘right’ results are independent of whether or not actions lead to ‘good’ results [65,68]. Deontological harms are independent of whether negative outcomes are experienced. In other terms, harm is unacceptable, regardless of its consequences. If a data breach occurs, privacy has been violated even if no one exploits the affected individual’s data or the individual remains unaware of the violation [64]. The deontological perspective emphasises both the duty of technology developers to ‘protect’ user rights and the autonomy rights of people who adopt the technologies.

Concerning individual autonomy, facilitated by tools like self-tracking devices, algorithms and workplace tracking systems, datafication arguably intrudes upon the fundamental integrity of the self, considered foundational to autonomy [58]. In particular, this reduced autonomy comprises a set of secondary effects of datafication that can be traced back to two key concepts: dataism and dataveillance [20,69,70,71].

Dataism has two implications: on the one hand, it is based on the widespread belief that human behaviours can be monitored and transformed into data through digital technologies, and that such data and numbers are neutral and objective [20]. Data are portrayed as fundamentally reductionist, and the acts of quantification as a means in the pursuit of simplifying all phenomena, regardless of their complexity, into numerical representations, thereby displacing alternative forms of meaningful expression [39,43]. On the other hand, dataism implies a certain level of trust in the independence and integrity of organizations, be they corporate platforms or government agencies, involved in collecting, interpreting and distributing data extracted through digital technologies [20].

Dataveillance, instead, refers to the “disciplinary and control practice of monitoring, aggregating, and sorting data” [69] (p. 124). The continuous surveillance through data manifests itself through three functions: (i) monitoring, (ii) prediction and (iii) prescription [20,69]. The monitoring practices refer to the process of quantification of human behaviours, both biological life through sensors and wearable devices and interactions, choices and preferences through traces left on digital platforms. Concerning the predictive function, datafication implements a new paradigm for understanding the world, whereby big data analytics can be leveraged not only to describe but also to anticipate social behaviours [20,39,43,58]. According to Zuboff [72] and Rubeis [49], the predictive capacity of data initiates a new phase for capitalist systems, namely “surveillance capitalism”, in which human experiences are quantified into behavioural data and used to condition and predict social actions. Lastly, the prescription function represents the highest form of the conditioning power of data on human agency. Unlike the subjective information obtained through senses and observations, digital data possess an “aura of scientific authority” [39] (p. 56). Therefore, the prescriptive power of data implies that social experience is inevitably influenced by how data describe us, anticipate our preferences and choices and point to the path we should take. According to Mejias and Couldry, “we are, through datafication, becoming dependent on (external, privatized) data measurements to tell us who we are, what we are feeling, and what we should be doing, which challenges our basic conception of human agency and knowledge” [57] (p. 6).

In the field of digital health technologies, the prescriptive function of datafication aligns with an interpretation that emphasizes the disciplinary power of self-surveillance through medical devices. As Latour and Akrich pointed out [73,74], technologies influence human actors’ behaviour by prescribing specific actions. Prescription involves the range of actions that a particular device either enables or restricts, shaping certain expectations to which actors adhere by modifying their behaviour in diverse ways. Therefore, health technologies that “datafy” biological parameters can modify human behaviours through the constant self-surveillance that social actors subject themselves to [40,71].

However, the discourse surrounding datafication and its potential disciplinary effects has been problematized and reinterpreted through the lens of the empowerment perspective. In fact, while authors aligning with the Foucauldian theses of disciplinary power and governmentality [75] argue that empowerment is nothing more than a necessary derivative to ensure self-discipline and, consequently, the achievement of governmental objectives without the need for direct intervention [76,77], other studies have criticized this stance [43,51,78,79,80,81]. In particular, the perspective of self-surveillance would underestimate human agency and the “agentic possibilities” [82] (p. 268) that health technologies and their datafication process enable [43]. Sharon and Zandbergen [51] demonstrated through an ethnographic approach that individuals engaging in self-tracking are not ‘data fetishists,’ as commonly perceived; instead, they ascribe significance to their data-gathering practices. Health technologies can enhance patients’ understanding of their illness, making them more knowledgeable and putting them in control of their health conditions [3,39,43,51,82].

1.2. Datafication and Security of Health Technologies in Poland and Italy

This study, therefore, aims to explore critically the issue of the datafication of care among individuals with T1 diabetes, focusing on aspects related to the perception of self-surveillance, empowerment and the safety of digital technologies. Indeed, while the majority of theoretical contributions on the process of datafication concern its implementation through digital platforms, with a few exceptions [50,82], less attention has been devoted to the datafication of health and social risks in terms of safety for individuals.

Therefore, this study presents a qualitative research design based on semi-structured interviews among Italian and Polish individuals with T1 diabetes. The selected countries represent two interesting case studies, as they share similarities in terms of diabetes prevalence and the level of digital skills in the general population but, at the same time, they present differences in terms of access to diabetes care technologies.

Regarding the prevalence of diabetes, considering age-adjusted prevalence as an indicator, in 2021, the prevalence rate was 6.8% in Poland and 6.4% in Italy [83]. Similarly, in 2021, considering the digital skills possessed by the population, people with basic digital skills amounted to 26% in Poland and 31% in Italy1.

However, the healthcare systems and the expenditure allocated to diabetes differ between the two countries. Italy has a universalistic system, while Poland’s is insurance-based, resulting in considerably different levels of expenditure related to diabetes. In 2021, Italy spent USD 3280.8 per person, whereas Poland spent USD 994.3 [83]. Moreover, while both countries offer modern medications and technologies for managing T1 diabetes, access to technological devices is not universal in Poland, unlike in Italy. Poland provides free insulin pumps for children and young adults with T1 diabetes (up to 26 years old) [84]. Conversely, since 2023, the reimbursement for continuous glucose monitoring and flash glucose monitoring has significantly expanded to include individuals with diabetes who require intensive insulin treatment [85]. Therefore, these countries offer an opportunity to examine the impact of diabetes technologies while considering both a scenario where access to technologies is completely free and one where reimbursement is available only for certain devices.

Concerning safety, privacy and data management, the recent literature highlights the significance of developing a robust regulatory system for data security and privacy to ensure that health technologies address people’s concerns and support technology adoption [86]. Regulatory frameworks and implementation practices should be considered in the context of diabetes technology to support the use of these tools by diabetic patients [87], who may have concerns about it [14].

Therefore, the legal framework of the two countries—including laws/guidelines issued by national/regional healthcare organizations (e.g., Ministry of Health and local health organizations) and recommendations/guidelines by scientific associations and patient associations—is outlined in the following sections.

1.2.1. Security and Privacy Issues Concerning Digital Health Technologies in Poland

This section examines the state-level legal regulations in Poland concerning the security and privacy of digital medical technologies in the Polish health system. The analysis encompasses various aspects, including health law, personal data protection, technical standards and certification. Notably, specific regulations for digital solutions targeting particular patient groups, such as diabetics, are lacking.

The first area covered is health law and the registration of medical products in Poland, governed by several laws, with the key one from 7 April 2022, focusing on ensuring the safety and effectiveness of medical devices [88]. The Law on Medical Devices is a fundamental regulatory tool ensuring a high level of safety and effectiveness of medical products in the Polish market. It is designed to provide a safety guarantee for potential users/patients, eliminating the risk of health exposure resulting from using a product (health application) that does not meet the legal requirements [89]. This law encompasses a broad range of products, from simple medical devices to more complex ones, including digital devices used in the diagnosis, treatment and monitoring of patients. It imposes detailed obligations on manufacturers, distributors and importers of medical devices.

Concerning health applications for diabetics, the Law on Medical Devices in Poland holds fundamental importance. It addresses issues related to production, tests conducted and product verification. Health applications, especially those pertaining to diagnosis, treatment or health monitoring, should unequivocally adhere to the provisions of this Act. The regulations outlined in the Act are complemented by ordinances, such as the Minister of Health’s Ordinance dated 27 October 2022, amending the Ordinance on the list of medical devices issued on prescription [90]. This document includes regulations for sensors in the Continuous Real-Time Glycemia Monitoring System (CGM-RT), either up to 3 units (sensors requiring replacement every 10 days) or up to 5 units (sensors requiring replacement every 6 or 7 days). These provisions indicate that the distribution system of devices for diabetics is subject to detailed regulations primarily addressing reimbursement and regulating the availability periods for individual patients. However, the legal provisions and the regulation do not directly address issues related to digital security and user privacy, implying that these concerns fall under the purview of the manufacturer and are part of the privacy policy specific to the application that operates the device (sensor).

Regulations directly addressing the issues of security and privacy during the use of mobile health applications pertain to the protection of patients’ rights. Notably, these regulations apply to patients in general, without dividing them into specific user groups, such as people with diabetes. The protection of patient data in health apps is a key concern, and regulations related to data privacy cover various aspects, including the collection, processing, storage and sharing of personal data [91]. In the context of Poland’s membership in the European Union, the General Data Protection Regulation (GDPR) is a crucial piece of legislation. Unified rules for safeguarding the information of EU citizens are devised to ensure their safety and privacy. Entities failing to adhere to the GDPR guidelines face substantial penalties. Notably, based on the aforementioned rules, we can assess the reliability (vis-a-vis privacy) of an app [92].

According to the GDPR, health apps must obtain the patient’s consent to collect and process their personal data. This consent is known as “informed consent” [63]. Compliance with GDPR and other data protection regulations is not merely a legal issue but also a matter of establishing trust in health apps among patients. Therefore, health app providers must adhere to the highest standards for protecting patient data [93]. An interesting solution to enhance the security of health apps is the launch of a pilot programme from 31 March 2023, to certify such solutions for patients. This initiative applies to all health apps and not just those for diabetics. Its primary goal is to increase the level of user safety. Evaluating and certifying apps and placing them in the Portfolio of Health Apps (PAZ) can benefit all healthcare system participants. For the patient, it will mean that an app is validated in terms of content and information security. Medical personnel will gain a tool that can help, for example, monitor the patient’s health status and support the implementation of recommendations (on, for instance, diet and exercise) and other non-pharmacological recommendations. Such patient involvement in taking care of his or her health can also help alleviate the burden on medical facilities.

For app developers, on the other hand, the PAZ will be a testament to the superior quality, efficacy, and safety of their product, as well as an opportunity to reach a wide range of patients (the Ministry of Health is starting to certify health apps). By design, the verification must be fully transparent, and the evaluation as reliable as possible, which is why expert and patient organizations have been invited to work on app evaluation [94]. The opportunity to express opinions and voice concerns and recommendations provides an opportunity to create regulations that improve the security and privacy of health app users [95].

1.2.2. Legal Framework in Italy: Regulation for Diabetics

The legal framework in Italy governing the management of digital devices for monitoring diabetics (such as blood glucose sensors and pumps) appears rather fragmented due to the absence of specific ministerial provisions regulating their use concerning this type of pathology. Instead, there are only recommendations from national and local health organizations and patient associations and guidelines from the Ministry of Health. In fact, these institutions often address privacy and/or data security issues indirectly without explicitly mentioning them.

For example, a report edited by the Ministry of Health and the National Agency for Regional Health Services (AGENAS) in 2020 (on real-time devices for continuous blood glucose monitoring with a long-lasting sensor in patients with diabetes mellitus) explores health issues related to the use of these technologies [96]. It investigates their clinical efficacy, safety, costs and ethical issues, but does not discuss the legal framework governing cybersecurity, health data protection and patient privacy. Clinical recommendations on the use of insulin therapy with pumps and continuous glycemic monitoring can also be found in the guidelines of the Italian Society of Diabetology and the Association of Diabetes Physicians [97]. However, there is no direct reference to the issue of data security and privacy of patients employing these digital devices. What is emphasized, however, is the potential difficulty in their use by older and less educated people, given the likely lower level of familiarity with technology and the complexity of using these tools.

To specifically analyse security and privacy issues related to digital health technologies, a good starting point could be an enforcement order issued by the Italian Data Protection Authority (order No. 242/2022) [98]. This order imposed a penalty of EUR 45,000 on a U.S. company that markets digital medical monitoring tools for diabetics in Italy. The penalty was for unintentionally disseminating the personal data of 2000 people undergoing glucose monitoring through an app. The company was held liable for unlawfully transmitting personal data through email (data breach) because a smart-working employee mistakenly entered patients’ email addresses without ensuring that they were obscured, as part of an information campaign, spreading them among all recipients. Thus, unauthorized third parties gained access to the email addresses of people interested in diabetic products and were able to learn about their disease2 (see [63]).

In the order, the Italian Data Protection Authority also refers to another general measure dated 9 November 2005, intended for healthcare institutions that process patients’ personal data. This measure enforces the requirements to ensure respect for patients’ dignity, consistent with the 2016 EU General Data Protection Regulation [63,99]3. In fact, the regulations on the protection of personal health data state that information on the state of health can be communicated only to the person concerned or to third persons with a suitable legal prerequisite or an indication of the person concerned with the latter’s written authorization (Art. 9 Regulations and Art. 83 Legislative Decree No. 196 of 30 June 2003—Code on the Protection of Personal Data)4.

From the aforementioned enforcement order of the Italian Data Protection Authority, a kind of guideline can be gleaned that governs the “correct” behaviours when handling medical apps. In summary, patient data can be processed only if there is an appropriate legal basis; moreover, if there are multiple purposes, each of them must have its own legal basis. In the specific case of the glucose monitoring sensor, consent to the terms of the license agreement and consent to the privacy policy must be separate and not on the same page—consent must be expressed with two different “clicks”.

Besides this, in line with the transparency principle, the data subject (i.e., the person with diabetes using the digital tool) must be aware of what data are being collected and for what purposes. There should also be a provision for the revocation of consent, the indication of the rights of data subjects and the possibility of complaining to the Data Protection Authority. As evident from this discussion, digital health implies significant transformations in traditional medicine, opening up the use of technologies such as glucose monitoring devices via apps for diabetics. This implies that, in almost all cases, the data owner is the health institution providing the service, along with the technology provider. Both these entities are legally responsible for diagnosis and treatment. Consequently, the healthcare facility involved is obligated to choose providers of digital medical tools who must comply with GDPR guidelines, and these providers are jointly liable in the event of violations5.

Concerning the general functional and technological requirements outlined for telemedicine services, including blood glucose monitoring devices and insulin pumps for diabetic patients as part of telemonitoring medical tools, the Italian Ministry of Health has recently published guidelines [100]. Regarding the specific issue of data security, the measure explicitly states that regional telemedicine infrastructures operate as per the security guidelines of the Agency for Digital Italy at the Presidency of the Council of Ministers [101], with the mandatory application of personal data protection regulations.

1.3. Objective and Research Questions

The theoretical analysis of the social risks associated with the datafication of care has revealed that datafication manifests itself through the processes of dataism and dataveillance. Dataism assumes the neutrality of data and the integrity of the organizations that collect and manage health data. Dataveillance, on the other hand, refers to the continuous surveillance enabled by the collection and examination of data, which may encourage disciplinary effects on individuals.

Concerning dataism, the analysis of the legal framework of Poland and Italy has reconstructed a rather homogeneous context in the two countries regarding the legislation governing the security of digital health technologies and the management of health data privacy. The main legislative reference in both contexts is the GDPR. While the GDPR adopt a preventive risk-based approach focused on data protection by design and by default, its prescriptions need to be concretised and applied by state regulations. Particularly, the regulations govern the responsibility of organizations that produce data collection devices and, consequently, must safeguard the integrity of such data. However, as the case of the data breach in Italy demonstrates, an advanced legislative framework cannot prevent privacy violations of patients, but can certainly strengthen control and sanctioning mechanisms.

Further, considering diabetics, neither health agencies nor scientific organizations dedicated to this specific disease include aspects of technology security and data privacy in their guidelines. Sensitizing people with diabetes to these aspects appears to be insufficiently supported by the bodies responsible. Limited information on these topics can restrict the reflexivity of people with diabetes, that is, their understanding and capacity for self-reflection. In other words, it may constrain their capacity to reflect critically upon the social expectations that may influence their behaviours and examine their decisions and practices. Reflexivity implies that “social practices are constantly examined and reformed in the light of incoming information about those very practices, thus constitutively altering their character” [102] (p. 38) [103,104].

Therefore, the overall objective of this study is to examine beliefs and attitudes about datafication, and privacy and security issues among persons with T1 diabetes, in order to address the following research questions:

RQa. How do individuals with Type 1 diabetes perceive the datafication of diabetes care?

RQb. How do individuals with Type 1 diabetes perceive privacy and security issues related to diabetes technologies?

2. Materials and Methods

To address research questions RQa and RQb, a qualitative inquiry was conducted through interviews to delve into the subjective experiences and beliefs that individuals with diabetes attribute to issues related to datafication and security. This multicenter study was approved by the Ethical Committee of the University of Macerata (Prot. n. 0009024).

This qualitative research utilises grounded theory as the general framework. Therefore, the comparative analysis between Italy and Poland does not aim to highlight the individual peculiarities of the two contexts with respect to the research object. Instead, the purpose of this comparative analysis—as illustrated by Glaser and Strauss—is the ‘generation of theory’ [15] (p. 21) [16,105]. By examining similarities and differences in the two sub-samples (Italian and Polish individuals with T1 diabetes), themes and categories can be identified, enhancing the resulting theory’s generalisability and explanatory power [16,105,106]. Minimizing differences among comparison groups helps establish a clear set of conditions for a category’s existence. Therefore, the similarities that emerge across diverse groups provide the broadest uniformities of a theory, confirming its existence by validating the data supporting it. Conversely, maximizing differences among comparison groups enhances the chance of collecting varied data on a category while also revealing appropriate similarities among the groups [15,16,105].

For participant selection, this study relied on theoretical quota sampling [15,107,108]. As Glaser and Strauss pointed out, the main purpose of theoretical sampling is “to generate theory, not to establish verifications with the facts” [15] (p. 48) [16,105]. The selected sample, therefore, may not be representative, but its adequacy is assessed based on how groups are chosen to saturate categories. Accordingly, interviewees were selected to ensure a balanced representation based on gender, age, socio-economic status and diabetes technology usage (sensor-only, insulin pump-only or both). The eligibility criteria for the participants were as follows: (i) age 18 or older, (ii) diagnosed with T1 diabetes for at least 5 years, (iii) using at least one diabetes device (sensor or insulin pump) for at least one year and (iv) no cognitive deficits.

Participants were reached through the collaboration of two diabetes centres (one in the Marche Region of Italy and the other in the Lublin province of Poland). The Italian research team prepared a brief report describing the main aspects of the study (objectives, interview procedures, etc.). This document was translated into Polish and distributed by healthcare professionals (nurses) among patients at various diabetes centres who met the inclusion criteria. The patients who agreed to participate in the study gave their consent to be contacted by the research teams. The researchers then contacted the potential interviewees by phone and/or email and sent them the informed consent form, which was drafted according to the template provided by the Ethical Committee of the University of Macerata and translated into both languages. All participants signed the informed consent form before starting the interview.

Recruitment continued until theoretical saturation was reached. Overall, sixty-one individuals were contacted, among which nine refused to participate due to time constraints (four individuals) or disinterest in the research (five individuals). The final sample of interviewees comprised fifty-two individuals with T1 diabetes (fifteen from Poland and thirty-seven from Italy).

Interviews were conducted within the diabetes centres and university departments. A semi-structured interview grid was initially developed in English by the Italian research team and then discussed with the Polish team. The final version of the interview grid was translated into Italian and Polish. It included general socio-demographic information (gender, age, educational level and perception of socio-economic status) and questions that directly addressed issues related to subjective experience with diabetes technologies (sensor and/or insulin pump). The interviews particularly focused on the respondents’ concerns regarding datafication, data security and privacy through the following questions: (i) Sensors and insulin pumps allow continuous glucose monitoring and controlled management of insulin therapy. What are the main advantages of continuous data monitoring? In addition, what are the main disadvantages? (ii) Regarding the diabetes technologies you are using, do you worry about the security of your data, i.e., whether your data is safe? (iii) Have you ever thought that using a sensor or insulin pump might compromise your privacy? (iv) Do you believe that the data collected by these technologies is secure? (v) Have you ever been bothered by the fact that your diabetologist can access your data? (vi) Have you received information about the privacy of your data and the security of the diabetes devices you use? (vii) Do you feel sufficiently informed about these aspects?

Potential biases related to the interviewers, participants and selection process are addressed. Regarding the interviewers, both in Italy and Poland, interviews were conducted by trained researchers. Before data collection, the two teams discussed potential biases arising from their expectations and behaviours and established strategies for maintaining a neutral and open-ended questioning approach. The interview guide was carefully designed to be neutral. As far as the participants, thanks to the collaboration of the two diabetes centres, it was possible to recruit a sample of participants balanced in gender, age, and socio-cultural background. Additionally, the eligibility criteria helped avoid biases related to the duration of device use. It is plausible that technology’s positive or negative effects are more easily recognized if the individual has used the tools for a sufficient period; therefore, the selection criterion included using a sensor or insulin pump for at least one year.

The interviews, ranging from 45 to 85 min, were conducted between November 2022 and October 2023 in both countries. All the interviews were audio-recorded and transcribed verbatim in their original languages. The Italian and Polish research teams discussed and established transcription strategies for the interviews. Specifically, the transcription needed to be as faithful to the original as possible; however, minimal modifications or omissions were allowed if they contributed to a better understanding of the text (e.g., omitting repeated fillers like ‘you know’ or ‘let’s say’). Moreover, punctuation was added to make the text comprehensible and para-verbal elements were included in round brackets (e.g., laughter, crying and gestures). Transcriber comments were added in square brackets only if they were essential for understanding the text.

Following the data analysis methods of grounded theory [16,105,109,110,111,112], a qualitative content analysis was conducted on the corpus of the interviews. Code categories were derived inductively from the text, and the analysis was conducted collaboratively by all authors. Both research teams proceeded to work parallelly on the initial coding. At the familiarization stage, each researcher thoroughly reviewed the transcripts in their own language to grasp the experiences and perspectives of each participant. During this initial stage, the research teams coded the transcripts line-by-line and incident-by-incident. The main text segments relevant to the research questions detected in the two sub-samples were translated into English and compared to identify similarities and differences. This initial analysis enabled the researchers to identify the ‘themes’, i.e., the main and common topics that emerged from the interviews conducted in both countries. Subsequently, focused coding was performed, considering patterns of meaning and divergent viewpoints or experiences in the development and naming of codes, until a coherent narrative emerged. In detail, while the researchers coded an incident for a category, they compared it with previous incidents coded in the same category in the two sub-samples. Through multiple comparisons, the research teams converged on the main focused codes, enabling them to synthesise and conceptualise larger segments of data in the two sub-samples. Finally, theoretical coding led the researchers to identify the definitive categories that crystallised the interviewees’ experiences.

To ensure participant anonymity, in the interview excerpts presented in the following section, personal names (interviewees’ first names and names of relatives, doctors, acquaintances, etc., mentioned during the interview), names of places (cities, healthcare facilities, etc.) and explicit references to health conditions other than diabetes have been omitted.

3. Results

This qualitative research provides the subjective perspective of individuals with diabetes who use technologies for self-management of their condition. The sample consisted of fifty-two individuals with T1 diabetes: fifteen from Poland and thirty-seven from Italy. The main socio-demographic characteristics of the participants are summarized in

Table 1. Participants’ personal characteristics.

	Poland	Italy
N	15	37
Age (mean) years	42	39
Female	9	18
Time of onset of T1 diabetes
<5 years	6	15
>5 years	9	22
Type of technology adopted
Glucose-monitoring device (sensor)	9	20
Insulin pump	1	2
Both the devices	5	15
Educational level
Primary (secondary school diploma or less)	2	4
Secondary (high school diploma)	8	23
Post-secondary (university degree or higher)	5	10

.

At the beginning of the interview, respondents were asked some socio-demographic questions regarding their educational background, profession and perception of their socio-economic status (low, lower-middle, middle, upper-middle or high). These pieces of information enabled us to stratify the sample based on the socio-economic status of the interviewees. The sample thus comprised two-thirds (36 subjects) of individuals with a medium (mostly) or upper-middle status and one-third with a lower-middle or low status (16 subjects, mainly Italian).

The content analysis conducted on the interview corpus revealed four major themes through which the collected data were interpreted: technology acceptance (identified in 38 interviews), technology rejection (14 interviews), datafication (47 interviews) and privacy and security reflexivity (52 interviews). Except for ‘technology rejection’ and ‘datafication’, the other themes were identified in the Italian and Polish sub-samples in a proportionally balanced manner relative to the different group sizes.

For each theme, initial focused coding led to the identification of several core categories (see

Table 2. List of themes, categories, properties and their frequencies.

Theme	Category	Properties of the Category	Frequency (n. of Interviews)
Technology acceptance	Technology helpful in disease management	Interviewees largely tend to highlight the positive effects of using these technologies. The main aspects highlighted are as follows: (i) better practical management of the disease, as the sensor allows for constant blood glucose level monitoring and the insulin pump provides a more calibrated and adaptable dosage of insulin as well as assistance with bolus calculation; (ii) improvement in certain parameters (such as glycated haemoglobin) and (iii) a general improvement in quality of life.	38
	Technology helpful in the acceptance of the disease	Interviewees highlight better disease management through devices, a perceived growing acceptance of diabetes and increased confidence in disease management.	11
Technology rejection	Technical rejection	Interviewees emphasise the negative aspects associated with using technology, focusing on technical aspects related to the devices: the presence of ‘tubing’ for the insulin pump; the bulkiness and inconvenience of wearing two devices; difficulties in wearing certain clothes; bruising where the devices are applied; sensor alarms, especially at night, etc.	14
	Social rejection	Interviewees underline negative social and individual aspects related to using sensors and insulin pumps: the devices force illness disclosure, particularly in summer, and individuals with diabetes negatively perceive the curious glances of others. Some individuals perceive themselves as ‘more ill’ and less ‘normal’ with the use of the devices.	10
Datafication	Datability	Frequent measurement of parameters enables better self-management of diabetes. Interviewees emphasise that the sensor and pump help them have greater self-control of their blood glucose levels and make more precise and targeted insulin ‘corrections’.	36
	Dataveillance	Due to the continuous monitoring, frequent alarms and perceived need for constant vigilance when using the tools, interviewees experience some negative aspects of datafication: a tendency to hyper-control, increased focus on the disease and perceiving oneself as ‘sick’, an over-reliance on the devices and a reduced perception of ‘individual feelings’ regarding diabetes.	11
	Dataism	The increasing delegation of disease management to devices and the trust placed in their capabilities create a paradoxical situation for some interviewees: patients feel they have ‘lost touch’ with the illness and exhibit dependency on the devices.	9
Privacy and security reflexivity	Consequentialists	Consequentialists tend, on one hand, to underestimate the risks associated with improper use of their data and, on the other, to embrace the idea that ‘the end justifies the means’ since the collection and analysis of their data can not only improve disease self-management but also be beneficial for others.	31
	Worried	These interviewees declare themselves poorly informed about security and privacy issues and, at the same time, fear that their data may not be secure. Moreover, they are concerned that their parameters are constantly visible to diabetologists, and they believe this continuous monitoring invades their privacy.	11
	No opinion	These interviewees do not express concerns about the security of their data and consider themselves to be poorly informed. Privacy does not appear to be a topic of interest.	10

). The different categories overlapped for some themes, i.e., two different categories could be found within the same interview (as in the case of the categories for the themes ‘technology acceptance’, ‘technology rejection’ and ‘datafication’). However, for ‘privacy and security reflexivity’, the categories were mutually exclusive, as the respondents clearly or predominantly exhibited a particular attitude that contrasted with other emerging categories.

Regarding individual experiences with the devices, this research identified two distinct underlying attitudes among the interviewees. These contrasting attitudes have been categorised into two themes.

The first theme—technology acceptance—applies to a majority of respondents (38 out of 52) who exhibited a general acceptance of the adopted technologies. Most of these individuals were under 40 years old and had a middle or upper-middle socio-economic status. Within this theme, two categories were identified. The entirety of the ‘accepting’ group highlighted the advantages the tools provided concerning diabetes self-management (category: technology is helpful in disease management). During the interview, they emphasised the positive changes that technology use has brought to disease self-management, including improvements in clinical parameters and overall quality of life. For example, this interviewee highlighted the effectiveness and practicality of the sensor in measuring blood sugar:

When I was younger, I used to go around, but when I had to check my blood sugar, I had to go to the bathroom, figure out how I was doing and try to estimate the dose. Instead, with the sensor, I can see the trend directly. You realise so many things that you couldn’t know before.

(I03, female, 34 yrs., degree, Italy)

Another interviewee stressed the advantages of the insulin pump in achieving a more precise management of the disease:

First is the fact that you don’t have to puncture [yourself] with a needle every time. So, even when you’re out, maybe you don’t have to go to the bathroom; you can do it directly while you’re having dinner. Then, the fact that it delivers a basal throughout the day, whereas before when I did the slow one the night before going to bed, it covered me until 7:00 p.m. So, I remained uncovered until I took the next dose, and consequently, my blood sugar was always a bit higher. And then, in this way, you can also manage the basal, meaning that in some time slots, you need more insulin—more basal than others—or while you’re doing [some] physical activity, you suspend it. These are, in my opinion, the advantages of the insulin pump that come to mind, but there are really many. Since I have had the insulin pump, my life has improved completely in terms of both glycaemic targets and my own management.

(I41, female, 28 yrs., high school diploma, Italy)

A few (11 cases) reported an additional positive effect. Those who experienced an improvement in the general acceptance of the disease due to technology use were classified under the category ‘technology is helpful in the acceptance of the disease’. Some, for example, accentuated that the improvements in clinical parameters triggered by the use of the insulin pump led to a more positive perception of the disease, as in the following case:

The pump has helped me a lot in accepting it [diabetes]. It helped me because I saw better blood glucose levels, which lifted my spirits and then… well… for the advantages, I mentioned [them] before. If I am out for dinner, I don’t have to go to the bathroom to take insulin. I have a basal rate that I can adjust or increase as needed. Mostly, seeing good blood glucose levels lifts my spirits.

(I09, female, 36 yrs., high school diploma, Italy)

According to other interviewees, the technology enables them to live better with diabetes and feel safer:

I worry less about diabetes because I feel more secure, in the sense that I am monitored. This also depends on the sensor… so on both [insulin pump and sensor], I feel safer because I feel more monitored and therefore more under control, whereas before, it was always the stick, always the insulin, how much is needed… yes, but, you know, I risked going hypo; instead, this way, I feel safer.

(I19, female, 29 yrs., degree, Italy)

Conversely, under the theme ‘technology rejection’, the interviewees highlighted the problems that technology use has introduced, mainly referring to technical issues and the ‘social management’ of the disease. These participants were predominantly Italian women with a middle or lower-middle socio-economic status and used the insulin pump. The potential reasons for this rejection within the Italian sub-sample may be due to the differences in access to technology, particularly insulin pumps. In Italy, the device is recommended by the physician, while in Poland, the choice largely falls on the patient, who must also contribute to the costs. Therefore, in Poland, individuals who adopt the technology are more likely to have a higher motivation to use it and, consequently, a lower level of refusal.

Several respondents recounted technical problems related to the devices, such as with the sensor (‘Many times, I can’t calibrate it, or it doesn’t adhere to my skin’) (I22, male, 49 yrs., high school diploma, Poland) and the insulin pump when it is not connected to a sensor:

The drawbacks could be malfunctions of the machine, which happened to me two years ago when a bubble formed inside the reservoir of the insulin pump, causing my blood sugar to rise to over 400. In short, I had to go to the emergency room. But at that time, I didn’t have the sensor yet. Had I also had the sensor at that moment, maybe it wouldn’t have happened because I would have seen that my blood sugar was rising.

(I35, female, 46 yrs., secondary school diploma, Italy)

Regarding the social management of the disease, the category ‘social rejection’ included interviewees, particularly females, who asserted that the primary drawbacks of the technologies were their consequences on social interactions. These individuals exhibited a certain apprehension regarding judgment from others and preferred to maintain discretion about their illness:

A young girl who wants to wear a particular piece of clothing has to think about where the ‘snails’ are, whether they are visible or not […]. I’ve never been able to fully adapt to showcasing the device, in the sense that I know other people who… let’s say… I say ‘showcasing’ because probably I’ve never, let’s say, wanted to display it, especially in the summer at the beach.

(I17, female, 21 yrs., high school diploma, Italy)

I can’t stand it anymore (she laughs). I can’t stand it because it’s uncomfortable and bulky. I don’t know if it’s the model, but it’s quite chunky. So I often clip it to my bra. But there’s this little tube that sticks out. So in the summer, forget about wearing anything low-cut. And all this stuff attached to my belly… After four years, I went back to the beach this year. And exactly what I was afraid of happened—everyone was staring at this tube, all curious about it. Whether you like it or not, having people stare at you is annoying; it’s not pleasant at all.

(I16, female, 40 yrs., degree, Italy)

The third theme—datafication—enabled us to identify ambivalent attitudes among the research participants, which have been classified into three categories: ‘datability’, ‘dataveillance’ and ‘dataism’. Considering the greater propensity among Polish interviewees to accept technology, more Italian interviewees emphasised the negative effects of datafication. However, three Polish respondents also reported some negative aspects under the category of ‘dataism’.

The first category ‘datability’ appeared to trigger positive effects in terms of greater patient empowerment. The continuous generation of data is recognised by some as an opportunity to understand and manage diabetes more effectively:

Last night, I downloaded the data, and I saw that I have the same curiosity as doctors when they go to download the data.

(I49, male, 41 yrs., high school diploma, Poland)

The more data I can provide, the more I can put the doctor in a position to make more accurate blood sugar readings.

(I02, male, 60 yrs., high school diploma, Poland)

The technologies appear to initiate a ‘virtuous cycle’: the data generated by the sensor, in conjunction with the use of the insulin pump, foster greater motivation in individuals to monitor their parameters:

I’m more motivated to check myself now, in the sense that having this insulin pump that gives me the readings with the sensor—something I didn’t do before—when I notice my blood sugar is going to 200, 210, I go ahead and take a bolus so it doesn’t get higher… I mean, I feel more in control now compared to before. Before, I knew I had to check at breakfast, lunch and dinner… but I never did the check two hours after eating because it felt like a burden. But now, I’m relaxed, I’m at ease, I do it with a spontaneity that I didn’t have before.

(I19, female, 29 yrs., degree, Italy)

On the other hand, the category ‘dataveillance’ revealed the negative effects of datafication among some interviewees, particularly those who tend to resist technology. For them, datafication implies a condition of self-surveillance and more frequent thoughts about the disease, as revealed by this respondent who is considering discontinuing the sensor:

At a psychological level, perhaps I have to stop because even with the sensor, I find myself thinking more often that I am diabetic because you always have something external, something foreign, on you.

(I11, male, 57 yrs., high school diploma, Italy)

For other interviewees, datafication triggers a form of hyper-control, i.e., a constant focus on managing the devices and, consequently, the disease, which generates stress and negative emotions:

It’s like being on probation. I mean, for convenience, nothing to say, for the fact of pricking oneself less […] but I’ve become a bit obsessive about control.

(I01, 28 yrs., high school diploma, Italy)

Another aspect related to datafication has been classified under the category ‘dataism’. Some individuals with diabetes perceived a kind of dependency on the devices and felt they had ‘lost touch’ with their condition by delegating control to the devices and trusting the device’s capabilities.

Because the sensor gives you alarms, it starts going off before, then it stops after, then before you go low… the sensor makes a mess, and I have to keep up with it more. Whereas when I do it on my own, I go by my own feelings, like how I feel.

(I06, female, 27 yrs., high school diploma, Poland)

Furthermore, in the following excerpt, another respondent who had just decided to discontinue the insulin pump explained the dataism effect:

You feel the disadvantage when you don’t give the right attention to the device, which has a lot of potential, but you have to be careful. So, maybe, in life… in the last period, I experienced more of the disadvantages… I struggled to understand… how can I explain… to understand the automatic function and how it worked, what it required from me… I lost a bit of the connection with the sensations that blood sugar gives you. Because then… effectively… as long as it’s just you deciding, so you decide the dose, you give yourself the injections, then you maintain some control there, whereas if you rely on the device, you have to trust the device first of all, but you lose some of the sensations. For example, one thing I noticed at night… the insulin pump vibrates or beeps if it realises that the blood sugar is too high or too low. At night, I swear my husband sleeping next to me could hear it, but I couldn’t. So I had lost the sensations that blood sugar gives you. Instead, now that I’ve removed it, maybe because I’m also more attentive, a bit scared… I wake up at night if something isn’t right and the sensations are a bit different.

(I40, female, 33 yrs., degree, Italy)

Finally, the fourth theme—privacy and security reflexivity—highlights the interviewees’ reflexivity upon privacy and security issues, namely the understanding and capacity for self-reflection over issues related to the security and privacy of data generated by the devices [103,104]. Coding of the interviews led to the identification of three categories: the ‘consequentialists’, the ‘worried’ and those with ‘no opinion’.

A cross-cutting element across the three categories, codified in the majority of interviews (44 out of 52), is that the interviewees claimed to have received limited information on these topics from doctors. For some respondents, specialists who assisted them during the device installation phase provided some information, primarily aimed at the general safety of the devices, rather than the issue of personal data security.

An additional topic coded in the interviews (19 interviews), cutting across the identified categories, concerned the information provided regarding personal data processing. These respondents stated that they had signed an informed consent form for privacy before using the device, but they did not receive a thorough explanation. They reported that they skimmed through the form quickly and did not recall precise information. The other interviewees did not mention the informed consent form.

About two-thirds of the interviewees (31 cases) showed a ‘consequentialist’ approach to privacy and security issues: the costs associated with the loss of privacy are balanced by the benefits available. In this perspective, the security risks—which interviewees consider to be rather remote—are offset by the advantages these technologies offer to patients. Individuals also tend to highlight the altruistic function that the data collected by devices can have in making the tools’ calculations and predictions increasingly accurate:

I don’t have any, any difficulty, actually… if only there had been someone before me who had transmitted the data for a longer period because maybe they could have optimised and improved the software… what’s it called… the algorithm. Besides, it’s also a matter of… let’s call it civility, personal responsibility because if I can be helpful to someone else to feel better, well, what problem do I have with that?

(I43, male, 56 yrs., degree, Italy)

Listen, I think that in the end, these are really advanced tools, advanced technology… I believe we’re safe when we use them. And then… the more data I can provide, the better I can help the doctor manage blood sugar levels more accurately.

(I27, male, 58 yrs., secondary school diploma, Italy)

However, other interviewees—the ‘worried’—appeared concerned about their data security and privacy and reported having received limited information. Their concerns focused on two main aspects. On one hand, the worried respondents stated that they had limited knowledge of how the personal data produced by the devices were stored. They were troubled by the possibility that the security systems employed by the technologies could fail or that there could be human error, leading to their data being disclosed to third parties. This concern was particularly evident among respondents who tended to reject technology, deny their illness and, consequently, keep it hidden:

You often hear news about cyberattacks… a company we work with had a data breach… so, let’s say that we diabetics don’t have a clear understanding of security systems… yeah, I mean, they don’t explain much to us. What if my data ends up in the wrong hands? I want to be the one to decide who should or shouldn’t know that I’m diabetic. I do everything I can to hide the presence of this insulin pump. That’s something I can’t do in relationships for obvious reasons, and things have changed there because it’s a device that requires special precautions in certain situations. Those who knew before still know, and those who didn’t know before still don’t. So I often worry that my data isn’t safe.

(I29, male, 48 yrs., degree, Italy)

On the other hand, some respondents seemed disturbed by the fact that their data was visible to doctors, feeling that their privacy was somehow violated:

[Interviewer: Does the fact that your data is constantly viewed by doctors bother you?] Well, a bit, yes. I realise that it’s inevitable. It bothers me a bit because… I don’t know how to say it… in the sense… you’re exposed… it’s like losing a bit of privacy. However, on the other hand, there’s no other way, because if they don’t see the data, they can’t help me with the therapy. I mean, I realise I can’t do otherwise because it bothers me a bit; it’s like I’m exposing myself. Because it happens… I don’t know… one evening, I go over a bit because I feel like having ice cream and I go get ice cream… I could avoid it… and there it really comes out… ‘What did you do there? That evening?’.

(I30, male, 37 yrs., degree, Italy)

Some of the interviewees did not express particular interest in issues related to the privacy and security of their data. These individuals, categorised as ‘no-opinion’, provided extremely brief responses to questions on these topics, demonstrating a lack of reflexivity and underestimating the potential risks associated with data protection. Additionally, they all stated that they were not at all or poorly informed on the matter. Some interviewees dismissed the issue by referring to the vast amount of data collected about individuals from digital platforms (search engines, social media, etc.):

Honestly, with all the data they collect when we’re on social media or doing searches… well, I’m not too worried about the sensor data anymore.

(I35, female, 46 yrs., secondary school diploma, Italy)

‘Worried’ and ‘no-opinion’ respondents, who demonstrated a poor understanding of the security and privacy of their data, were mostly older individuals with lower levels of education and lower socio-economic status.

4. Discussion

This study enabled us to delve into the issue of datafication and the security of technologies for diabetes self-management, examining the beliefs and attitudes of persons with T1 diabetes through qualitative research in two national contexts.

Concerning the process of datafication, it involves transforming human conditions and behaviours into data and generating various forms of value from that data. As described in the Introduction, the debate in the current literature regarding the effects of digital health technologies seems polarized around the dichotomy between self-surveillance and empowerment. The results of our study align with those from previous research that emphasized the ‘agentic possibilities’ enabled by technologies in individuals [9,43,51,78,82]. The category of ‘datability’ encapsulates the beneficial effects arising from the datafication process derived from technological devices used in diabetes self-management. Most of the interviewees in the two sub-samples highlighted this ‘datability’ effect of using continuous glucose monitoring and insulin pumps, both in terms of a better understanding of their health condition and optimization of disease management. Consistently, fieldwork demonstrates that examining personal data charts and visualizations can prompt critical reflection and generate new questions to explore [50,82]. The empowered patient achieves greater autonomy through an enhanced understanding of their illness, which fosters an increased sense of responsibility for self-managing the condition. Consequently, patient empowerment strengthens motivation and adherence to the use of health technologies. Moreover, the interviewees not only adopt the devices with better outcomes but also exhibit greater acceptance of their illness. Acceptance of the disease can be considered an unintended effect of using technologies for diabetes self-management. Through the ‘datability’ effect, individuals gain a deeper understanding of the illness, manage it more efficiently, and, as a result, mitigate or reduce its negative impact on daily practices.

Instead, the self-discipline perspective tends to conceal the various ways individuals participate in the discourse of healthy citizenship that do not support concerns of normalization and discipline [43,78]. The dynamic interplay between self-discipline and empowerment is revealed by the current study. The negative effects of datafication are reflected in the concepts of dataveillance and dataism.

Dataveillance, understood as the self-disciplinary practice arising from the monitoring, aggregation, and organization of data, is perceived by interviewees as a state of hyper-control. This effect is particularly evident in the practices of continuous monitoring enabled by the devices and the frequent alarms that prompt individuals to maintain constant vigilance over their condition. While most interviewees view this constant monitoring as an opportunity for better disease management, others perceive it as a barrier. For these individuals, the self-surveillance and the resulting disciplinary effects are experienced as excessive control, leading them to think more frequently about the disease and to feel ‘sicker’.

The concept of dataism, which assumes that data are neutral and that quantifying human behaviours can lead to better decision-making, is observed in our sample of interviewees as an over-reliance on the tools and the data they generate. For some respondents, delegating disease management to the devices has triggered a kind of relaxation in their internal control mechanisms. These individuals report no longer noticing the sensor alarms during the night and experience a diminished sense of ‘individual feelings’ concerning diabetes. Critical beliefs about technologies—whether they exert overcontrol or reduce subjective autonomy in managing their condition—fueled rejection attitudes, leading some interviewees to suspend or abandon their use.

As far as privacy and security issues, the analysis of the Polish and Italian legal framework has revealed aspects of similarity in the regulation of health technologies. The European regulatory framework [63], being incorporated into various national contexts, has facilitated the spread of similar regulatory approaches across different countries. Indeed, despite adopting different internal devices, Italy and Poland exhibit an advanced level of regulation concerning data privacy and patient safety in the realm of digital health technologies. On the contrary, the aspect of security related to the specific disease of diabetes appears to be more lacking, with a dearth of recommendations, guidelines or interventions promoted by patient associations and scientific societies aimed at diabetics.

This situation seems to be reflected in the subjective experiences of people with diabetes, and it emerged consistently in the two case studies investigated. The majority of the respondents claimed to be poorly informed about privacy and security issues. The inadequate knowledge of these aspects, and the limited information they received from doctors and specialists, even at the time they signed informed consent forms when installing the devices, have resulted in respondents exhibiting low reflexivity, meaning a lack of understanding of potential risks and, consequently, underestimation [103,104].

On one hand, the majority of the interviewees displayed a consequentialist attitude, asserting that the risks associated with security and privacy are outweighed by the benefits brought by the technologies. However, even these interviewees, who demonstrate a greater capacity for self-reflection on the ‘altruistic’ function of providing their data to improve technology, tend to be poorly informed and underestimate security risks. On the other hand, the lack of information has generated two other attitudes among the interviewees. The ‘worried’ have manifested fear about the security of their data. This negative attitude could have the secondary effect of increasing the rejection of technology, as our interviewees have shown. Instead, the ‘no-opinion’ neither expressed concern nor showed interest in security issues.

Moreover, our research reveals disparities in the approach to privacy and security issues, consistent with findings from previous studies [9]. In fact, the level of reflexivity regarding the security risks of the devices appears to be rather low among the worried and no-opinion interviewees, who were mostly less educated, older and of low socio-economic status.

However, as the aforementioned case of a data breach in Italy [98] as well as previous studies demonstrated [13], data security is a highly significant issue that deserves further investigation. In a cultural context where datafication seems both advantageous and unstoppable, Cohen argues that the concept of privacy may appear “antiquated and socially retrograde” [61] (p. 1905) [64]. Indeed, the strict application of the two main approaches to security and privacy issues—the consequentialist and the deontological model—could lead to underprotection or overprotection of data, resulting in recognizable harm to patients in both cases [64,65].

The analysis of the legal framework revealed that Italy and Poland adopt a common approach to guarantee privacy, based on the ‘transparency and consent model’ (see Section 1.2.1 and Section 1.2.2). According to Nissenbaum [60] and Cohen [113], this approach presents a flaw, namely, the premise is that individuals are capable of grasping all relevant information necessary for making informed decisions during the contracting interactions with data gatherers. This study has shown that, instead, individuals with diabetes interviewed do not seem to have obtained the necessary information and, therefore, developed a full understanding.

To overcome this approach, Nissenbaum proposes a different model based on the theory of contextual integrity that grounds privacy regulations in social contexts and societal roles. Privacy is delineated by anticipated streams of personal data, conceptualized through the framework of context-relative informational norms. Similarly, Cohen adopts a ‘post-liberal’ conception of privacy, where privacy is not to be understood as a defensive device, aimed at preserving negative spaces where individuals can seek refuge from the pressures of technological changes. Instead, privacy appears as a socially constructed concept, akin to the concept of the self. The post-liberal self emerges from the everyday practices of situated individuals exercising their agency; it is the result of the ordinary behaviours of individuals immersed in social and cultural contexts [59,60,61,64].

Limitations of the Study

While offering valuable insights to enhance the experience of individuals with diabetes, our study has some limitations. First, the method used to recruit participants may have introduced selection bias. The interviewees are patients from diabetes centres, individuals monitored by physicians and public healthcare organizations. Those who are more marginalized and have less regular access to healthcare services were not reached by our survey. Second, due to the research design, the results of this qualitative research are neither generalizable nor comparable to other contexts. Third, despite adhering to participant selection criteria and their stratification based on certain variables, the sub-samples in Italy and Poland are numerically unbalanced. A possible motivation for achieving a smaller sample size in Poland is due to the lower prevalence of insulin pumps among the adult population (who are required to make out-of-pocket payments). Nevertheless, the sample size achieved still allowed for reaching theoretical saturation.

Despite these limitations, this research provided the opportunity to explore the effects of datafication in the field of health and chronic disease management. Both Italy and Poland have implemented advanced regulatory measures addressing data privacy and patient safety in the realm of digital health technologies. However, there is a deficiency in addressing security concerns related to the specific disease of diabetes.

5. Conclusions

The present study was designed to assess the effect of datafication and the perception of security and data privacy issues among a sample of individuals with T1 diabetes, which represents a condition particularly interested in the adoption of digital health technologies.

The qualitative investigation has shown that most interviewees highlighted the advantages of utilizing sensors and insulin pumps. However, a minority expressed concerns regarding the adverse consequences of datafication, such as dataveillance, which can lead to excessive monitoring and overly meticulous disease management, as well as dataism, indicating an overreliance on technology resulting in dependency. Moreover, the research underscores disparities in attitudes towards datafication and security concerns. Reflexivity seems to be lower, especially among individuals with lower levels of education, lower socio-economic status and older age.

Dataism and dataveillance are two sides of the same coin, viz. datafication. Protecting the security of digital health devices and managing health data, supported by increased reflexivity among people about these aspects, could enhance patients’ trust, consequently mitigating the negative effects of data surveillance. If individuals believe that the tools they use are secure and their data are protected and used properly, the perception of self-surveillance may yield a different attitude, focused on empowering human agency driven by technology.

These aspects become even more important when a lack of trust in device security and data privacy, as well as a perception of self-surveillance, can lead individuals to reject technology and predispose them to abandon it, as this study seems to indicate. Previous studies have highlighted similar results: concerns about security and privacy have represented a barrier to technology adoption regarding both diabetes technologies [14], but also other health technologies, such as portal technology for self-care [114,115,116] and tools for online health information seeking [117]. Considering the benefits that the use of continuous glucose monitoring devices and insulin pumps have for optimal disease management, reduction of disease complications and quality of life [6,25,29,31,32,34], technology acceptance must be supported among patients. The fear for the security of their data, as emerged, can be a factor that hinders acceptance.

Further research is needed to explore issues of social and economic disparities that may interfere with the access and adoption of digital health technologies. Our findings suggest that greater attention to security issues may be warranted both when devices are initially introduced to the patient and when devices are installed and individuals sign the informed consent form. Explanations should be as personalized and tailored to the understanding abilities of each individual patient as possible. Moreover, this study underscores the need to implement activities aimed at the formulation of recommendations and guidelines for privacy protection and digital security by patients’ associations and national scientific societies, specifically targeting individuals with diabetes.