With smart technology on the rise, many businesses, including gyms and leisure facilities, are now harvesting vast quantities of data from customers – something that can benefit both customers and businesses. However, new European data protection rules could potentially necessitate a wholesale review of data policies.
In December 2015, the European Parliament, Commission and Council announced new legislation governing data protection. This new General Data Protection Regulation (or GDPR), replaces the outdated data protection laws that have been in place since 1995 and, from 2018, will apply to all businesses that process in any way the data of EU citizens.
Data portability
One of the key elements of the new rules is the right of ‘data portability’. Essentially, this means individuals will have the right – albeit a limited right – to require a business to transfer personal data directly to another business, even where that other business is a competitor.
Gyms, for example, hold individual details such as name, address, contact details, date of birth and bank details. They might also hold data on customers’ weight, height and limited medical information, and possibly even details of the kinds of activity they want to do or the results they want to achieve. The gym may hold other data too, including dates and times of all the customer’s visits and, potentially, detailed exercise plans produced with a PT.
All of this is personal data – but, importantly, not all of it is portable data in the legal sense. Any data not actually provided by the individual to the gym – which would potentially include any exercise plans and usage logs – would be exempt from the portability rule. It will, however, still be covered by the less potent ‘right of access’, which will only require the operator to provide the data to the customer, on request, in electronic format – without the obligation to provide the data direct to another business.
So, the customer’s right to data portability only applies to data that he or she has actually provided to the data controller – in this case the gym.
The customer will have the right to demand that this data be transmitted directly to another operator should they decide to switch gyms.
The legislation does provide that this obligation will only be imposed where such transmissions are ‘technically feasible’, but what this will mean in practice is far from clear at present. The guidance on this should be forthcoming.
New technology
The GDPR also requires a privacy impact assessment (PIA) to be carried out where the introduction of a new process or technology is likely to cause a high risk to personal rights or freedoms. As more fitness operators introduce wearables and other connected devices, they will have to consider carefully whether they first need to conduct a PIA.
The key message for gyms and leisure facilities is that they must endeavour to understand the types of personal data they process, and what regulations currently, and will shortly, apply. There’s no need to worry unduly but, as 2018’s implementation date draws closer, operators should begin to plan now.