Google must cut privacy risks on Fitbit deal, EU data regulators say