Top Stories
Privacy activist Schrems files complaints against Google’s Fitbit
Global Banking & Finance Review®
Company
By Supantha Mukherjee
STOCKHOLM (Reuters) – Advocacy group Noyb on Thursday filed complaints against Google-owned Fitbit in Austria, the Netherlands and Italy accusing the fitness tracking company of violating the European Union’s General Data Protection Regulation (GDPR) privacy regime.
Vienna-based Noyb (None Of Your Business), the digital rights group founded by privacy activist Max Schrems, has already filed hundreds of complaints against big tech companies ranging from Alphabet Inc’s Google to Meta over privacy violations, some leading to big fines.
Fitbit forces its users to consent to data transfers outside the EU and does not provide the possibility to withdraw their consent, violating GDPR’s requirements, Noyb said.
Fitbit sells watches that track activity, heart rate and sleep. It also offers a subscription service starting at $9.99 a month.
“Given that the company collects the most sensitive health data, it’s astonishing that it doesn’t even try to explain its use of such data, as required by law,” said Bernardo Armentano, data protection lawyer at Noyb.
Fines for violating GDPR rules can reach up to 4% of a firm’s global annual revenue. Google’s annual revenue was $280 billion in 2022.
The advocacy group wants Fitbit to be forced to share all mandatory information about the data transfers with its users and allow them to use its app without having to consent to the transfers.
While GDPR allows every person to withdraw their consent, Fitbit’s privacy policy states that the only way to withdraw consent is to delete an account, which means losing their previously tracked workouts and health data, Noyb said.
(Reporting by Supantha Mukherjee in Stockholm; Editing by Kirsten Donovan)
The General Data Protection Regulation (GDPR) is a comprehensive data protection law in the EU that governs how personal data is processed, stored, and shared.
Data protection refers to the practices and processes designed to safeguard personal information from unauthorized access, use, or disclosure.
User consent is the agreement given by individuals for their personal data to be collected and processed, often required by laws like GDPR.
A privacy policy is a legal document that outlines how an organization collects, uses, and protects personal data from its users.
A data transfer refers to the movement of personal data from one location to another, which can raise privacy concerns, especially across borders.
Explore more articles in the Top Stories category
