Google’s Fitbit faces GDPR action in Austria, Italy and Netherlands

Vienna-based noyb, the non-profit European Center for Digital Rights, has filed three complaints against Google-owned fitness app Fitbit in Austria, the Netherlands and Italy with the relevant data protection authorities (DPAs). The claims state that Fitbit forces users to agree to contravened European data protection laws to continue using the app. “The popular health and fitness company, acquired by Google in 2021, forces new users of its app to consent to data transfers outside the EU. Contrary to legal requirements, users aren’t even provided with a possibility to withdraw their consent. Instead, they have to completely delete their account to stop illegal processing,” said noyb. “When creating an account with Fitbit, European users are obliged to ‘agree to the transfer of their data to the United States and other countries with different data protection laws’. This means their data could end up in any country around the globe that does not have the same privacy protections as the EU,” claimed noyb. “In other words: Fitbit forces its users to consent to sharing sensitive data without providing them with clear information about possible implications or the specific countries their data goes to. This results in a consent that is neither free, informed or specific – which means that the consent clearly doesn’t meet the GDPR’s requirements,” it added. The group pointed out that according to Fitbit’s own privacy policy, the shared data includes things like a user’s email address, date of birth and gender. The company can also share “data like logs for food, weight, sleep, water or female health tracking”, noyb said. “The collected data can even be shared for processing with third-party companies, of which we do not know where they are located. Furthermore, it is impossible for users to find out which specific data is affected. All three complainants exercised their right of access to information with the company’s Data Protection Officer – but never received an answer,” it added. Maartje de Graaf, data protection lawyer at noyb, said: “First, you buy a Fitbit watch for at least 100 euros. Then you sign up for a paid subscription, only to find that you are forced to ‘freely’ agree to the sharing of your data with recipients around the world. Five years into the GDPR, Fitbit is still trying to enforce a ‘take it or leave it’ approach.” To make sure users can change their mind, the GDPR also gives every person the right to withdraw their consent for data sharing, at least in theory. But noyb explains that Fitbit’s privacy policy states that the only way to withdraw consent is to delete an account. For consumers, this means losing all their previously tracked workouts and health data. This even applies if you buy a premium subscription for €79.99 per year. There is no realistic way to regain control over your data without making your product useless, said noyb. Bernardo Armentano, data protection lawyer at the organisation, said: “Fitbit wants you to write a blank check, allowing them to send your data anywhere in the world. Given that the company collects the most sensitive health data, it’s astonishing that it doesn’t even try to explain its use of such data, as required by law.” The Vienna-based legal action group said that even if there was a way to withdraw consent, Fitbit still wouldn’t comply with European privacy law. Romain Robert, one of the complainants, added: “Fitbit may be a nice app to track your fitness, but once you want to learn more about how your data is being handled, you are bound for a marathon.” Noyb has requested that the Austrian, Dutch and Italian DPAs order Fitbit to share all mandatory information about data transfers with users and allow them to use its app without having to consent to transfers. Based on the turnover of Alphabet, Google’s parent company, last year, the competent authorities could issue a fine of up to €11.28bn.

Google’s Fitbit faces GDPR action in Austria, Italy and Netherlands

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Related Articles