User Consent in IoMT System: A Case Study of Saudi Arabia

The legal and ethical frameworks that apply in many countries around the world require service providers to obtain users’ agreement to the collection and further processing of their personal data. The healthcare sector has long-established foundations regarding consent processes for medical procedures, treatments and the use of patients’ data. As it now seeks to provide many services online, it must refine its processes to maintain its current standards. Of particular interest, the Internet of Things (IoT) is emerging as an important means to deliver healthcare services. Such systems raise many issues regarding consent. For example, some users may not be familiar with their privacy rights, others may not read or understand the privacy policies of service providers, and many may not be familiar with the technical risks posed by IoT systems. This lack of awareness may lead users to give consent for the collection or processing of their sensitive data without being fully informed. Therefore, a consent tool is one of the important components of an IoT system that collects and processes user’s personal data, particularly in the Internet of Medical Things (IoMT) services, where the required data is considered highly sensitive. The specific design and implementation of such tools may affect the users’ decisions regarding consent. Thus, it must be considered whether online management of consent by users is actually reasonable. To do so, we must understand how aware users are of relevant issues and how online consent tools can facilitate the provision of informed consent. To address the above, a case study that includes two main parts was conducted. The first part focused on a study that investigated the level of privacy awareness among users of healthcare services in Saudi Arabia. This used a quantitative survey method. Two types of assessments were used: a subjective assessment, which depended on the participants’ self-assessment, and an objective assessment, wherein the questions had right and wrong answers (which do not depend on the participants’ opinions). The second part focused on a study aimed to explore how users with different privacy awareness levels actually made personal data consent decisions when presented with various scenarios. Such consent was managed using two different smartphone-based applications. The experiment sought to establish how specific aspects of the consent mechanism design affect user-informedness and the actual decisions made. A within-subject experiment approach was used, incorporating both quantitative and qualitative methods. The results revealed that most participants have a medium level of privacy awareness, with no significant differences observed between the objective and the subjective assessments. The results show that users found some aspects of consent tool design helped them make more informed decisions. However, there is still a need to enhance users’ privacy awareness levels regarding their data and to educate them about the privacy regulations that govern their data and the importance of understanding service providers’ privacy policies.