The Latvian Data Protection Authority, the National Data Inspectorate (DVI), has issued an awareness communication on the risks related to publishing location data via sports activity tracking applications.

The DVI emphasizes that regularly publishing sports routes can reveal sensitive personal data, such as the place of residence, workplace, and daily habits of a user. Even if a single route may seem harmless, the accumulation of this data allows for the creation of a detailed profile of a person's habits. The authority reminds that location and travel routes constitute personal data within the meaning of Article 4, point 1 of the GDPR, as soon as they can be associated with an identifiable natural person.

Consequently, the DVI recommends that users carefully check the privacy settings of these applications before using them, ensuring the default visibility of the profile and recorded activities, in accordance with the data protection by design and by default principle of Article 25, paragraph 2 of the GDPR. It is advised to restrict the visibility of activities, to hide the start and end of routes if the option is available, and to verify that changes also apply to previous posts. The DVI specifies that it is the user's responsibility to manage their settings and decide what information they wish to share publicly.