SATS Norway AS – €870,000 Fine (Norway, 2023)

The company SATS ASA (the controller) is a provider of fitness and training services. It has its headquarters in Norway and is also active in Denmark, Finland and Sweden. The company has over 270 clubs, about 9,000 employees and more than 700,000 members. According to one of these members (data subject 1), the controller had transferred their personal data to other companies within its corporate group in May 2018. The controller had also transferred data to Facebook, which was located outside the EU/EEA, without a proper legal ground. This data subject further claimed that an access request, submitted on 29 August 2018, had remained unanswered. Data subject 1 filed a complaint at the Norwegian DPA (Datatilsynet) on 2 October 2018. Another member (data subject 2), who had already terminated their membership, claimed that the controller had not responded to an access request (Article 15 GDPR), which was submitted on 25 February 2019. The controller had also refused to comply with an erasure request (Article 17 GDPR) submitted on the same date. Data subject 2 filed a complaint at the DPA on 1 March 2019. Another member (data subject 3), who had also terminated their membership, claimed that the controller had refused to comply with an erasure request (Article 17 GDPR), which was submitted on 05 October 2019. Data subject 3 filed a complaint at the DPA on 07 October 2019. On 7 September 2021 and 5 October 2021, the DPA formally approached the controller and asked the company to express its views on the issues raised in Complaint No 2 and Complaint No 3. The controller replied on 1 December 2021. On 8 December 2021, the DPA received yet another complaint from a member (data subject 4) concerning the controller’s refusal to comply with an erasure request (Article 17 GDPR), submitted on 6 August 2021. On 23 March 2022, the DPA sent further questions to the controller on all of the above complaints and received the controller’s response on 28 April 2022. Despite receivi