The Norwegian Data Protection Authority issued a reprimand to the SATS group for imposing the taking of photographs of its members based on an incorrect legal basis and without clearly informing them of their right to object.

Facts and context

The Norwegian Data Protection Authority published a decision issuing a reprimand against the SATS group, which operates the ELIXIA fitness centers among others, for breaches related to the collection of photographs of its clients.

The case originated from several complaints from clients of the group's fitness centers, who were required, following a policy change in August 2025, to provide a photograph for their file under threat of being denied access to the facilities.

Reasons for the decision

• Choice of legal basis (Article 6 of the GDPR): The authority considered that the processing of photographs, intended to prevent abuse, could not be based on the performance of the contract. It judged that this collection was not necessary for the main purpose of the contract, namely providing access to sports facilities, since access was possible via a membership card and the photograph was not systematically checked. The appropriate legal basis should have been the legitimate interest of the controller, which would have allowed the right to object.
• Information obligation (Article 13 of the GDPR): The SATS group failed in its transparency obligation by not clearly informing its clients of their right to object to the collection of their photograph. The authority emphasized that this information is an essential prerequisite to enable data subjects to effectively exercise their rights, notably the right to object.

Authority's decision

Consequently, the authority issued a reprimand to the SATS group.

Furthermore, the authority ordered the SATS group to bring its practices into compliance with the legislation before 11 September 2026. It must notably respond to any person objecting to the taking of their photograph, either by granting their request or by justifying its refusal based on legitimate and compelling grounds.

Lessons learned

This decision reminds that:

• The legal basis of contract performance can only be invoked for data processing strictly necessary to achieve the main purpose of the contract.
• When processing is based on legitimate interest, information about the right to object must be provided explicitly and clearly to data subjects so that this right can be exercised.
• Any objection request made by a data subject must receive a reasoned response, whether the controller grants or rejects it.
• The exercise of the right to object is not subject to any formal requirement, and the controller cannot impose excessive formalities on the data subject.