Image: Fitbit
The NGO founded by Max Schrems accuses the fitness tracker of violating the EU General Data Protection Regulation (GDPR), as noyb announced on Thursday. Fitbit will force new app users to consent to data transfers outside of the EU without the ability to withdraw consent.
In order to prevent illegal distribution, the account must be completely deleted. “It’s impossible to avoid data transfers,” said None Of Your Business (noyb) in a broadcast. Fitbit also does not provide any clear information about the possible consequences or the specific target countries of the data transfers, the NGO further criticized. “This results in consent that is neither free, informed nor specific – making it clearly non-compliant with the requirements of the General Data Protection Regulation (GDPR).”
Fitbit sells watches that measure activity, heart rate, and sleep. It also offers a subscription service starting at EUR 8.99 per month. According to Fitbit’s privacy policy, in addition to the user’s email address, date of birth and gender, the shared data also includes logs about food, weight, sleep, water or female health, an alarm clock and messages in discussion forums or to friends on the Services , so noyb. This data could also be shared with unknown third party companies.
“Fitbit wants you to give them a blank check for data transfers anywhere in the world. The company collects highly sensitive health data,” said Bernardo Armentano, privacy lawyer at noyb. “It’s amazing that it doesn’t even try to make the use of this data lawful.”
According to the Reuters news agency, a violation of the European data protection directive could result in penalties of up to four percent of the annual global company turnover. In 2022, Alphabet subsidiary Google generated $280 billion in revenue. In the past, the Vienna-based group noyb has sued numerous technology groups for data protection violations and has in some cases obtained billions in fines.
Source: Nachrichten
