Our Findings
We exercised our rights to data portability (both Article 20(1) and 20(2)) against 4 large consumer service providers:
- Garmin read details
- Fitbit read details
- Google (Home) read details
- Amazon (Echo) read details
We found that a data subject can usually get their data out. But at this point, data subjects cannot expect much more.
| TL;DR - Our findings | |||||
|---|---|---|---|---|---|
| Service Provider | Method | Data received? | When? | Does this service provider take in data? | Does this service provider facilitate direct transmission? |
| Garmin | Online portal | Yes | >1 week | In limited circumstances | No |
| Fitbit | Online portal | Yes | 1 day | No | No |
| Google (Home) | Online portal | No "activity" history | Immediate | No | No |
| Amazon (Echo) | Online form | Yes | 30 days | No | No |
More details…
Garmin
How?
Garmin asks users to send a request through pushing a button in their Data Management Portal.
Additionally, users can download small snippets of specific types of activity in the Garmin Connect portal.
What?
Our experience was that, should you submit a request through the Data Management Portal, it takes Garmin around a week to send you back most of your data. This comes in a .zip file, with (in our case) several hundreds of files, not clearly labelled. The majority of the files were in JSON format. There did not appear to be any heart rate data.
The small snippets of information (e.g. 5 days of step data) in the Garmin Connect portal are in .csv format. The information is available immediately. While users may find this helpful, it is not sufficient under Article 20.
Import?
Garmin does allow Fitbit users to import small snippets of activity data, in .csv format, in the Garmin Connect portal. It gives no further instructions as to the required format of the file. We were unable to get the function to work.
Garmin does not facilitate direct transmission when asked directly by data subjects.
Fitbit
How?
Fitbit asks users to send a request through pushing a button on their Dashboard, in the “Data Export” tab. Once this button is pressed, the user must confirm they want to download their data by pressing a further link in an automatically generated e-mail. They refer to it as “downloading your archive”.
Additionally, users can download small snippets of specific types of activity in the Dashboard, in “Settings”, then the “Data Export” tab.
What?
Our experience was that, should you submit a request to download your archive through the Dashboard, it takes Fitbit about a day to send you back your data. This comes in a .zip file. The majority of the files were in JSON format.
The small snippets of information (e.g. 31 days of step data) in the Dashboard are in .csv format. The information is available immediately. While users may find this helpful, it is not sufficient under Article 20.
Import?
Data subjects cannot import any data manually into Fitbit’s systems. Furthermore, Fitbit does not facilitate direct transmission when asked directly by data subjects.
Fitbit suggested to us that import of user data should happen service to service where the other service has found a business reason for doing so. For instance: Strava, should they find their users want to import data into Fitbit, should work with Fitbit’s developer platform to make it happen.
Google (Home)
How?
Google asks users to download their data by using their Download Your Data portal. This portal houses all the Google services where download is possible. Google Home is one such option.
What?
Our experience was that, should you download your Google Home data through the Download Your Data portal, you will receive a single JSON file with core information that you have provided about the device (associated e-mail address, location of the device).
You will not receive any information about the accounts for other services that you may access through the Google Home (e.g. Spotify), or any “activity” that you perform on the device (e.g. voice searches). These are amalgamated with all your “activity” across Google.
Import?
Data subjects cannot import any data manually into Google’s systems. Furthermore, Google does not facilitate direct transmission when asked directly by data subjects.
Google suggested to us that import of user data should happen service to service where there is a business reason for doing so. To that end, Google are heavily involved in the Data Transfer Project, to facilitate the use of APIs for the sharing of specific information between services.
Amazon (Echo)
How?
Amazon asks users to contact customer services to exercise the right. Once you have lodged the request, you will be sent an e-mail where you must confirm you wish to exercise the right.
What?
Our experience was that, should you exercise your right, you will receive all your Amazon information - not just that provided to the Echo. This comes in a .zip file, with (in our case) several hundreds of files, not clearly labelled. In our experience, Amazon returns the data on the 30th day after you have made the confirmed the request (i.e. responded to their verification e-mail). You do not receive back any of the data generated in that 30 day period between request and receipt.
Import?
Data subjects cannot import any data manually into Amazon’s systems. Furthermore, Amazon does not facilitate direct transmission when asked directly by data subjects.
Page last updated: 17 November 2019