This is a generic opinion about IoT that's woefully misapplied to sports tech.

If users care about that, they'll go to a vendor that gives them access to the data. No need to legally mandate anything.

No, they won't, because of many reasons - it's a well-known market failure mode.

Importantly, to pick just one of the reasons, you can't expect users to accurately judge complex technological product, especially when facing marketers who will lie to them. When you're shopping for food or medicine, you're not expected to understand biochemistry or technicalities of randomized control trials - you expect the things you buy to not poison you. Plenty of vendors would be happy to sell you literal poison - and they did, in the past - but we've regulated that possibility away. Similarly, for technology, some of the abuses need to be regulated away, because you can't expect regular people to avoid the traps, and the vendors to not be abusive without external pressure.

Sometimes users are dumb, sometimes users are manipulated. Data privacy is a discussion that's been slowly growing and now has been picked up by the general public in some places.

There are some public policies that need incentives to go against the market, because market forces are not inherently good.

Sometimes there is a need to legally mandate something, or are you also against environmental protection laws? By this logic, f people really care about the environment, would it solve itself then?

There are no vendors that do it; it's in their best interest to keep data locked down. You can't vote with your wallet when your candidate isn't running.

That's not true. If you buy a fitness tracker from Garmin you can download FIT files with all your data either directly from the device or through their free online service. The format is documented and you're allowed to use your own data however you like.

Isn't my workout data covered under GDPR? Not that I'd bother trying to enforce it against the likes of Huawei.

That depends. It probably is, to some extent, but you either consented to this or it qualifies as essential to deliver the service. I suspect you could get it from the vendor by sending them a strongly worded letter, but a DSAR (data subject access request) isn't exactly an API call. GDPR cares about how your data is being collected and processed, not about interoperability. We need separate regulation to force service interoperability and a separation between hardware and services, so that they can be interchangeable.