The European Union (EU) General Data Protection Regulation (GDPR) imposes legal responsibilities concerning the collection and processing of personal information from individuals who live in the EU. It has particular implications for the remote monitoring of cardiac implantable electronic devices (CIEDs). This report from a joint Task Force of the European Heart Rhythm Association and the Regulatory Affairs Committee of the European Society of Cardiology (ESC) recommends a common legal interpretation of the GDPR. Manufacturers and hospitals should be designated as joint controllers of the data collected by remote monitoring (depending upon the system architecture) and they should have a mutual contract in place that defines their respective roles; a generic template is proposed. Alternatively, they may be two independent controllers. Self-employed cardiologists also are data controllers. Third-party providers of monitoring platforms may act as data processors. Manufacturers should always collect and process the minimum amount of identifiable data necessary, and wherever feasible have access only to pseudonymized data. Cybersecurity vulnerabilities have been reported concerning the security of transmission of data between a patient's device and the transceiver, so manufacturers should use secure communication protocols. Patients need to be informed how their remotely monitored data will be handled and used, and their informed consent should be sought before their device is implanted. Review of consent forms in current use revealed great variability in length and content, and sometimes very technical language; therefore, a standard information sheet and generic consent form are proposed. Cardiologists who care for patients with CIEDs that are remotely monitored should be aware of these issues.

Modern Implantable Medical Devices (IMDs) are enabled to communicate with an external device trough wireless channels. The non-invasive method allow health-care practitioners to investigate the effectiveness of a treatment delivered by the IMD and tailor it specifically to the patients' needs. The wireless communication capability however, also facilitates an adversary to gain illegitimate access to the live-saving medical device due to insufficient security measures to establish a secure communication channel. Since there is good reason to safeguard the IMD from prying eyes to avoid access to malicious entities, we present Heartwear, a lightweight security scheme to allow the establishment of a secure wireless communication channel between an IMD and legit external device. Heartwear takes advantage of heartbeat signals in order to provide both key establishment as well as unilateral authentication to protect against attacks of passive and active adversaries.