On November 8, 2016, the Dutch DPA announced that a sportswear company's fitness app no longer violated the Dutch data protection act. During an earlier investigation, the DPA concluded that the company had not provided its users with sufficient information on the use of health data transmitted through the app, nor had it determined retention periods for this data. Such data included running distances, calories burned, user location, and other metrics such as a user's gender, height, and weight. The DPA announced that the company began to request the data subject's consent and allowed the data subjects to minimize the specificity of their health data. In addition, the company encrypted all running data from inactive users of the older app versions to ensure that health data was not used for analytical purposes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
