Norway's data protection authority ordered gym chain SATS to stop treating mandatory check-in photos as necessary for the membership contract.
Why It Matters
Datatilsynet's 15 July ruling found SATS could not rely on "contract performance" to justify mandatory check-in photos, and gave the company until 11 September 2026 to rewrite its privacy notices and let members object. Any SMB that photographs or ID-checks visitors for access control (a coworking space, a construction site, a showroom) faces the same test: if the service still works without the photo, the photo is not contractual and needs its own legal basis plus a working opt-out.
What To Do About It
List every place the business photographs, films or ID-checks someone before granting access, then confirm each privacy notice names a lawful basis other than "contract" and offers a genuine way to object. Datatilsynet's order reads like a template other regulators will reach for next: fixing the notices now costs an afternoon, a formal order later costs a rewrite under deadline pressure.
Related Signals
Sąd potwierdził karę prawie 52 tys.
31 Aug 2026
Norweski regulator ochrony danych nakazał sieci siłowni SATS zaniechać obowiązkowego fotografowania klientów przy wejściu -- zdjęcie nie było warunkiem koniecznym umowy członkowskiej.
28 Aug 2026
Wyciek z platformy MyDr ujawnił dane niemal 19 mln pacjentów -- kary grożą nie tylko dostawcy oprogramowania, ale każdej z około 12 tys.
28 Aug 2026