521.11505 / 631.189
CR: 117817
IMI RD 164070
Berlin, 02 June 2022
Final Decision
Preliminary remarks
The complaint (ref. no. 521.11505 / 631.189) was raised before the Berlin DPA in June 2019. It
was transferred to the supervisory authority Netherlands, which is the Lead Supervisory Authority
(LSA) for the cross-border processing carried out by Nike European operations Netherlands B.
V., in accordance with Article 56 GDPR. The LSA Netherlands conducted the investigation and
the cooperation procedure with all concerned supervisory authorities in accordance with Article
60 GDPR. Following an objection to the Draft Decision, the LSA Netherlands proposed a Re-
vised Draft Decision and thereby the complaint was rejected. In accordance with Article 60 (8)
GDPR, the Berlin DPA as the supervisory authority with which the complaint was lodged, hereby
adopts the decision as it was agreed upon in the cooperation procedure and is included below:
With regard to the abovementioned cases and pursuant to Article 60(3) of the General Data
Protection Regulation (GDPR), the Autoriteit Persoonsgegevens (Dutch Data Protection Au-
thority, hereafter: NL SA) has issued the following revised draft decision:
Summary
Berlin Commissioner for Data Protection Phone: (030) 13889-0 Mail: [email protected]
and Freedom of Information (BlnBDI) Fax: (030) 215 50 50 Web: www.datenschutz-berlin.de
Friedrichstr. 219, 10969 Berlin Office hours: Daily from 10 am to 3 pm,
Visitors‘ entrance: Puttkamerstr. 16–18 Thursdays from 10 am to 6 pm
The NL SA has received the following complaint about the "Nike Run Club" app. According to
the complainant the app does not allow to transfer his user data to another service (right of
data portability).
On 26 June 2019, a complaint was filed with the Berliner Beauftragte für Datenschutz und
Informationsfreiheit (hereafter Berlin SA) against Nike European Operations Netherlands B.V.
The complainant would like to exercise his right to data portability by transferring his user
data from the “Nike Run Club” app to another service. Allegedly the app this is not possible
and the lack of this option was confirmed by the controller via phone on 26.06.2019. As the
main establishment of Nike European Operations Netherlands B.V. is in the Netherlands, the
NL SA is competent to act as the lead authority.
The Berlin SA forwarded this complaint to the NL SA.
Preliminary vetting by the Berlin SA
On 30 July 2019 the Berlin SA sent a request for information to Nike to inquire which DPA is
competent for the processing of data portability requests. The request was answered by letter
dated on 30 September 2019. In the reply Nike wrote that the right to data portability can be
exercised and that in the previous four month, Nike had received 127 data portability re-
quests and that no issues or complaints were known in connection with the requests for data
portability.
Norm allegedly infringed
Article 12 (2) GDPR states that the controller shall facilitate the exercise of data sub-
ject rights under Articles 15 to 22 GDPR.
Article 20 (1) GDPR states that the data subject shall have the right to receive the per-
sonal data concerning him or her, which he or she has provided to a controller, in a
structured, commonly used and machine-readable format and have the right to trans-
mit those data to another controller [...].
The complainant states that he could not exercise this right.
Investigation by the NL SA
The information collected by the vetting action of the Berlin SA was assessed by the NL SA.
The NL SA then investigated the websites related to the Nike Run Club. According to page 5
2
of the privacy policy of the app, under the header “PROTECTION and MANAGEMENT of your
Personal Data” >> “Managing your personal data”, the user does have the option to receive
an electronic copy of his personal data (data portability). The website has a web form to exer-
cise this right.
http://agreementservice.svs.nike.com/rest/agreement?agreementType=privacyPol-
icy&uxId=com.nike.commerce.nikedotcom.web&country=UK (replace UK with DE for the same
page in German).
On 30 September 2020 the NL SA sent an information request to Nike to inquire (1) since
when Nike’s German website has been offering the right to data portability, and (2) whether
this service suffered any interruptions during the month of June 2019. On 15 October 2020
Nike replied that (1) the German website offers the right to data portability using the web form
since 4 June 2018, and (2) that in June 2019 no planned or unplanned service interruptions
occurred that might hinder German data subjects in exercising their right to data portability.
Nike shared screenshots that show the exact number of request regarding the right to data
portability in the European Union in the period 29 April 2019 to 5 August 2019. The screen-
shots show a consistent pattern of requests, without descending or overflow that could indi-
cate disturbances.
Additionally the Dutch DPA has not received any complaints about Nike regarding the right to
data portability. Also desk research did not reveal any issues with functioning of the data port-
ability of this app.1
Proposed action by the NL SA
Based on the privacy police that the NL SA found on the app, in addition to the information
provided by Nike to the Berlin SA, and the information provided by Nike to the NL SA, the NL
SA conclude that Nike does facilitate that a data subject is able to receive his personal data
in a structured, commonly used and machine-readable format pursuant to Art. 20 (1) GDPR.
Therefore the NL SA did not identify any infringement of the obligations set out in the GDPR.
The complaint has only a limited personal impact, and the NL SA has no indication of struc-
tural short comings of the company. In view of the above, appropriate action has been under-
taken and no further action is required.
E.g. the Google search with key words nike run club data portability reveals many articles and tutorials
1
on the functionality.
3
Henceforth, the cross-border complaint case (national reference 521.11505 / 631.189)
should be closed.
Appeal Notice to the complainant
Against this decision a lawsuit before the Verwaltungsgericht Berlin (administrative court of Ber-
lin), Kirchstraße 7, 10557 Berlin is admissible. The lawsuit needs to be filed in written form within
one month after the notification of this decision, it can also be filed as an electronic document
with a qualified electronic signature (QES) or for the record of the clerk of the court. Please, note
that in case of filing the lawsuit in writing the legal deadline is only met if the lawsuit reaches the
administrative court within the deadline.
The Berlin Commissioner for Data Protection
and Freedom of Information
4