Fitbit may pose privacy risk to users, Europe warns
The European Commission has warned that Google’s purchase of smartwatch company Fitbit may risk owners’ privacy and data protection.
Discussing mergers and their impact on European data protection law this week, the European Data Protection Board (EDPB) in Brussels raised concerns about the “ potential combination and accumulation of sensitive personal data in Europe by a major tech company”.
The board reminded both Fitbit and Google of its obligations under European law and asked it to conduct an assessment of the privacy implications “in a transparent way”.
In a statement, Commission said: “The EDPB reminds the parties to the proposed merger of their obligations under [EU law] and to conduct a full assessment of the data protection requirements and privacy implications of the merger in a transparent way.
"The board urges the parties to mitigate possible risks to the rights to privacy and data protection before notifying the merger to the European Commission.”
There have been calls for a probe from regulators over Google’s $2.1bn (£1.6bn) takeover of Fitbit over fears it will give the search engine access to millions of users' private health data.
Fitbit’s wrist trackers collect data on movement, weight, sleep, heart rate and other sensitive customer information. Some of this information is used by life insurance companies to assess customers.
Announcing the deal in November last year, Fitbit promised that data would not be used for Google advertising, claiming that “strong privacy and security guidelines have been part of Fitbit’s DNA since day one, and this will not change”.
Rick Osterloh, Google’s hardware chief, also insisted that “privacy and security are paramount” and that the company would be transparent about how it collects data.
The UK is still subject to the EU's General Data Protection Regulation (GDPR), and plans to adopt a version of after Brexit known as “UK GDPR”.
