The Norwegian SA imposes fine on SATS for violating several provisions of the GDPR

11 December 2023

Background information

  • Date of final decision: 06 February 2023
  • Cross-border case
  • One-Stop-Shop Procedure: the decision was taken by national supervisory authorities following the One-Stop-Shop cooperation procedure.
  • LSA: Norway SA
  • and CSAs: Sweden SA, Denmark SA and Finland SA
  • Controller: SATS ASA
  • Legal Reference (s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 5 (Principles relating to processing of personal data), Article 17 (Right to erasure (‘right to be forgotten’)), Article 13 (Information to be provided where personal data are collected from the data subject), Article 6 (Lawfulness of processing)
  • Decision: Administrative fine
  • Key words: Administrative fine, Data subject rights, Right of access, Right to be informed, Right to erasure

 

Summary of the Decision

 

Origin of the case  

The Norwegian Supervisory Authority (SA) received several complaints about SATS during the period 2018 to 2021. The complaints concerned alleged infringements of the complainants’ rights under the General Data Protection Regulation as customers of the fitness chain. The complaints concerned the company’s failure to comply with access and erasure requests. As the complaints against SATS were similar in many respects, The Norwegian SA chose to consider all the complaints together as one case.
 

Key Findings 

The Norwegian SA’s conclusion is that SATS has violated several provisions of the General Data Protection Regulation that apply to the data subjects’ right to information, access and erasure, as well as the company’s lack of a legal basis for processing certain personal data. 

 

Decision 

The Norwegian SA has fined SATS NOK 10 million (approx. EUR 850.000). 

 

For further information: 

•  Decision in national language. 
•  Decision in English. 

 English translation of Norwegian original text first published on 8 February 2023

 

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.