Why it matters
Why this page matters in the wider system.
Fit data is personal data, the legal rights exist, and the infrastructure gap prevents people from exercising them in any practical sense. That gap is not neutral in its effects. A right that exists but cannot be exercised functions, in the market, exactly like no right at all: brands keep the records, customers keep re-measuring, and nothing about the arrangement is challenged because nobody can point to a moment where the law was broken. Closing the gap is therefore less a compliance exercise than a redistribution — it moves an asset that the law already assigns to the individual into a form the individual can actually hold.
GDPR Article 20 gives individuals the right to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Articles 17 and 18 give rights to erasure and to restriction of processing, which matter most when a commercial relationship ends.
Article 15 access is the practical first step: it establishes whether an operator admits to holding an inferred body profile at all, which is the prerequisite for an Article 20 request.
In practice, fashion brands rarely provide structured data export for measurement records, so the legal right resolves into an unusable file.
Customer-owned infrastructure is the only model that makes these rights exercisable by default rather than on request, because the record is already in the individual's hands.