Ålesund municipality fined for use of Strava

Strava is a fitness app, which logs users’ training sessions and enables them to analyse and compare their data with their own previous performance or others’ training logs. Strava, Inc. stores the data generated by the app. This data must be considered personal data.

We underline that the problem is not Strava itself, but rather Ålesund municipal council’s procedures for the app’s use in schools.

Background

At two schools in Ålesund, teachers required pupils to download the fitness app Strava for use during physical education lessons. The pupils were then given tasks, while the teachers used the app’s tracking function to check that all the pupils had completed the tasks set.

Downloading the app was mandatory, and it was downloaded to the pupils’ private mobile phones. The use of the tracking function must be considered processing of personal data relating to the individual pupil. 

Strava was used in a situation where the teachers had to go to extraordinary lengths to provide appropriate teaching in a pandemic situation. However, this is no excuse for the council’s inadequate control of the use of various apps in school.

Our assessment

The fitness app Strava started being used without a risk assessment having been carried out. The Data Protection Authority considers that use of the fitness app Strava will involve activities requiring a Data Protection Impact Assessment (DPIA) to be performed.

Use of the fitness app involves the processing of the pupils’ location data. Particular categories of personal data may also have been processed, if the pupils themselves have entered such data into the app. Furthermore, the fitness app will process personal data by systematically monitoring physical exertion and performance. The purpose of using the fitness app was to see whether pupils performed the tasks, but it can also measure performance levels against those of others.

This case shows that the council does not have procedures in place to determine which apps are to be used for school-related purposes. Nor are there clear procedures for the downloading of apps, such as a requirement for a risk assessment before they start being used.