The Norwegian Data Protection Authority has issued a reprimand and corrective injunctions against a gym chain for imposing the taking of a photograph of its members based on an incorrect legal basis and failing to respect the right to object.

Facts and context

The Norwegian Data Protection Authority (Datatilsynet) today published a decision of reprimand and injunction against SATS for breaches related to the obligation to record a photograph of members to access its facilities.

The case originated from 26 complaints received between May and November 2025 from Norwegian and Finnish members opposing this photography requirement, used by staff to verify members' identity upon check-in. The case was handled under the cross-border cooperation procedure, with the Norwegian authority acting as lead supervisory authority.

Reasons for the decision

• Obligation to provide transparent information on the legal basis of processing (Article 13(1) of the GDPR): SATS informed its members that the collection of their photograph was based on the necessity for the performance of the membership contract, pursuant to Article 6(1)(b) of the GDPR. The authority considered this legal basis incorrect, as the photograph is not indispensable to the main purpose of the contract, namely access to fitness centers. Since access is already granted by reading a membership card, processing the photograph could not be considered "necessary" in the strict sense. The authority concluded that the appropriate legal basis was legitimate interest (Article 6(1)(f) of the GDPR).
• Obligation to inform about the right to object (Article 13(2) of the GDPR): Based on an incorrect legal basis, SATS failed to clearly inform members of their right to object to processing, a right arising from the legitimate interest basis. The company communicated that the photograph was mandatory, except for very specific cases (such as police officers or persons with protected identity), which gave members the impression that their right to object was much more limited than provided by the GDPR.
• Obligation to respect the right to object (Article 21(1) of the GDPR): The authority noted that SATS had rejected opposition requests from its clients without providing proof, as required by the GDPR, of the existence of legitimate and compelling grounds for the processing to continue that override the interests, rights, and freedoms of the data subjects.

Authority's decision

Consequently, the authority issued a reprimand against SATS.

Furthermore, the authority ordered SATS to comply by 11 September 2026. The company must notably correctly inform its members of the legal basis for processing (legitimate interest), their rights, and in particular the right to object to processing, in a clear and distinct manner. It must also respond to all untreated objection requests and either cease processing or demonstrate the existence of legitimate and compelling grounds to continue.

Lessons learned

This decision reminds that:

• The notion of "necessity for the performance of a contract" (Article 6(1)(b)) must be interpreted strictly and limited to processing indispensable for the main service provided under the contract.
• When processing is useful to the activity but not indispensable to contract performance, legitimate interest (Article 6(1)(f)) constitutes a more appropriate legal basis, subject to a balancing of interests.
• The use of legitimate interest as a legal basis requires informing individuals clearly and visibly of their right to object to processing at any time.
• Rejection of an objection request must be justified and based on demonstrating "legitimate and compelling grounds" that override the individual's rights.
• Communication that gives data subjects the impression that their rights are more restricted than they actually are constitutes a breach of the transparency obligation.