Cybersecurity Policy Report, Norwegian DPA Fines Fitness Company Over GDPR Violations, (Feb 22, 2023)
By Tony Foley
Datatilsynet, the Norwegian data protection authority, issued a fine of 10 million Norwegian kroner ($971,000) earlier this month against fitness center company SATS ASA based on a finding of multiple violations of the European Union’s General Data Protection Regulation (GDPR).
The Datatilsynet decision, issued Feb. 6, was based on a series of complaints received by the agency against SATS alleging improper transfers of data and failure to respond to data subject rights requests. The complaints were combined into a single investigation by Datatilsynet, which it conducted in 2021 and 2022. The investigation found that SATS violated the following articles of the GDPR:
Arts. 12(3) and 15, based on its failure to respond to two separate data subject access requests;
Arts. 5(1)(e), 12(3), and 17, based on its failure to appropriately respond to data subject requests to erase personal data;
Arts. 5(1)(a), 12(1), 13(1)(c), and 13(2)(a), based on its failure to inform its terminated customers concerning its data retention policies relative to their information and the legal basis for the data processing; and
Arts. 5(1)(a) and 6(1), based on its failure to justify its legal basis for the processing and storage of training history data.
In imposing the fine, Datatilsynet applied the usual factors outlined in Art. 83(2) of the GDPR and noted that did not identify aggravating or mitigating factors in relation to the fine. It did not investigate claims made by complainants concerning alleged improper processing that occurred prior to the May 2018 effective date of the GDPR. SATS has the right to appeal the decision to the Oslo District Court.
News: LitigationEnforcement DataPrivacy GDPR