Norway Data Protection Authority Reprimands Fitness Chain Sats Over Photo Policy

Norway's Data Protection Authority has issued a reprimand to the fitness chain Sats, ordering significant changes to its policy requiring members to register with a photo. The authority found three violations of the General Data Protection Regulation (GDPR) related to this practice.

“

Photo processing cannot be considered necessary to fulfill the agreement, as access is granted by scanning the membership card and the photo is not checked at every visit.

Sats implemented the photo requirement in 2025 to prevent membership sharing and ensure security. However, the authority noted that photo verification is not always performed at each visit, as access is granted by scanning membership cards. The Data Protection Authority stated that photo processing cannot be considered necessary to fulfill the membership agreement under these circumstances.

“

Several complainants state that they consider the processing mandatory, or that they are unsure what the protest arrangement entails.

The authority also found that Sats failed to provide sufficient information about the basis for collecting photos and how members could object. Many complainants reported feeling the photo requirement was mandatory or were unsure about the protest procedure. Sats is now obligated to inform members correctly about the practice, make them aware of their right to object, and respond to all outstanding protests.

“

We do not believe a regular member will consider the absence of extra identity verification as Sats not having fulfilled the contract.