Posted by Thomas Bjorn, Consultant
On 1 September 2016 Withy King LLP merged with Royds LLP. The trading name for the merged firm is Royds Withy King. All content produced prior to this date will remain in the name of the firms pre-merger.
Dutch Data Protection Authority investigates data processing in Nike Running App
The Dutch Data Protection Authority (DDPA) has issued a report of its investigations into the processing of the personal data of the users of the Nike+ Running App.
The app helps the users to keep track of their running activities by recording distance, speed, time and number of calories burned and to improve their performance through the use of personal training programmes within the app and the users are required to create a Nike+ account and to enter various information including full name, country, postcode, height, body weight and gender.
Based on the collection of these data (which, according to the report is stored for an indefinite period of time), Nike is capable of drawing conclusions about the health status and possible health risks of the users of the app and the DDPA therefore found that that the data amounted to sensitive personal health data.
The DDPA pointed out that Nike, prior to any processing, had a legal duty to inform the users of the purposes of such processing, in particular the tracking (on Nike’s servers) of (developments in) the sporting performance of the individual, the comparison of the individual sporting performance against the average of a comparable group of users and the research and analysis purposes.
Since Nike does not inform data subjects, or informs them insufficiently, about the types of personal data it collects and processes and about the purposes of the data processing, Nike cannot rely on consent from the data subjects for the two purposes for which Nike processes health data.
Although the investigation relates to Dutch law, the findings will be of interest to data processors and developers of similar apps across Europe.
The conclusions of the DDPA are in line with the guidance issued in 2015 by the Article 29 Working Party, see the article published by Thomas Bjørn (Royds Solicitors) and David Hobson (Mathys & Squire) in a recent edition of Copenhagen Life Science Magazine.
Article in Copenhagen Life Science http://www.royds.com/wp-content/uploads/2015/07/Health-Data-2015.pdf
Extract of the Dutch investigation report (in English) https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/conclusions_dpa_investigation_nike_running_app.pdf
For more information on legal issues relating to the life sciences sector, please contact Thomas Bjorn.