In short
Three findings: Art. 13(1) (legal basis stated incorrectly), Art. 13(2) (insufficient information on the right to object), Art. 21(1) (objections rejected without demonstrating compelling legitimate grounds). Twenty-six complaints between May and November 2025, from Norwegian and Finnish members. Deadline: 11 September 2026.
The processing
SATS asks members for a membership photograph. The image stays in the membership management system and staff use it at entry to check that whoever passes the turnstile is the person enrolled. This is not video surveillance: it is an identifying detail used by hand, at the desk.
The first mistake produces a second
The notice stated a legal basis that was not the right one. A mistake that looks formal — the photo gets collected either way — and instead changes the person's rights.
If the processing rests on performance of the contract, the right to object under Article 21 does not exist. If it rests on legitimate interests, it very much does, and a controller receiving an objection must stop unless it demonstrates compelling legitimate grounds overriding the person's interests.
Hence the other two findings. The notice did not properly explain the right to object — consistently with the wrong legal basis, because under contract there would have been nothing to explain. And when members objected, the objections were rejected without demonstrating those compelling grounds.
Why this is a lesson rather than a news item
Whoever declares «contract» does not build the machinery for handling objections, because in their account those objections cannot exist. Then they arrive anyway, and at that point there is neither the procedure nor the documented balancing. These are not two independent defects: the second follows from the first.
Twenty-six complaints between May and November 2025, from Norwegian and Finnish members. Datatilsynet imposed no fine: it issued an order and a reprimand, requiring members to be given correct information on the legal basis and the legitimate interests by 11 September 2026.
Two questions to put to a client
For every processing based on legitimate interests: where is the balancing written down, and who redoes it when an objection arrives? And for every processing declared «necessary for the performance of the contract»: is it really necessary to perform it, or merely convenient? The gym works without the photo — less well, but it works. That is exactly the difference Article 6(1)(b) asks you to measure.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
