SATS Norway AS – €870,000 Fine (Norway, 2023)

The company SATS ASA (the controller) is a provider of fitness and training services. It has its headquarters in Norway and is also active in Denmark, Finland and Sweden. The company has over 270 clubs, about 9,000 employees and more than 700,000 members. According to one of these members (data subject 1), the controller had transferred their personal data to other companies within its corporate group in May 2018. The controller had also transferred data to Facebook, which was located outside the EU/EEA, without a proper legal ground. This data subject further claimed that an access request, submitted on 29 August 2018, had remained unanswered. Data subject 1 filed a complaint at the Norwegian DPA (Datatilsynet) on 2 October 2018. Another member (data subject 2), who had already terminated their membership, claimed that the controller had not responded to an access request (Article 15 GDPR), which was submitted on 25 February 2019. The controller had also refused to comply with an erasure request (Article 17 GDPR) submitted on the same date. Data subject 2 filed a complaint at the DPA on 1 March 2019. Another member (data subject 3), who had also terminated their membership, claimed that the controller had refused to comply with an erasure request (Article 17 GDPR), which was submitted on 05 October 2019. Data subject 3 filed a complaint at the DPA on 07 October 2019. On 7 September 2021 and 5 October 2021, the DPA formally approached the controller and asked the company to express its views on the issues raised in Complaint No 2 and Complaint No 3. The controller replied on 1 December 2021. On 8 December 2021, the DPA received yet another complaint from a member (data subject 4) concerning the controller’s refusal to comply with an erasure request (Article 17 GDPR), submitted on 6 August 2021. On 23 March 2022, the DPA sent further questions to the controller on all of the above complaints and received the controller’s response on 28 April 2022. Despite receiving the complaints over a fairly long time period, the DPA decided to handle the complaints jointly, considering the fact that all of them concerned similar alleged infringements. Another reason the DPA opted to handle the complaints jointly was 'procedural efficiency'. On 26 September 2022, after their investigation, the DPA sent the controller an advance notification of their intention to issue an administrative fine of NOK10,000,000 (ten million) (Around €916,000) for violating several GDPR provisions. The controller responded to the DPA on 31 October 2022 and argued, among other things, that It was "arbitrary from the part of Datatilsynet (DPA) to [find] a violation of Article 12(3) GDPR and Article 15 GDPR due to a failure to respond to an access request that was submitted around a month after the GDPR became applicable in Norway, as at that time many companies experienced challenges in applying the new rules". The controller also stated that the DPA's conclusion that the controller violated both Article 12(3) GDPR and Article 15 GDPR would violate the principle of ne bis in idem. The controller also argued that the assessment of the necessity of a storage period is to a large extent discretionary, noting that the DPA was not in the position to do this and should refrain from questioning the assessment made by the controller. The controller made the same statement concerning the choice of legal bases. Despite the controller's arguments, the DPA submitted a draft decision on 30 December 2022 to the other supervisory authorities concerned in accordance with Article 60(3) GDPR, which was in line with the above advance notification. The DPA did not receive any relevant and reasoned objections and, consequently, upheld their advance notification. The DPA assessed the different arguments made by the controller. The DPA first assessed the argument that the DPA's decision was arbitrary, given the fact that the GDPR had only been applicable for one month, and that many companies had difficulties applying the law. The DPA found this argument of the controller untenable, because other companies' non-compliance was not a valid justification for a violation of the GDPR that started to occur in September 2018. Further, one of the violations was still ongoing (as per February 2023). The DPA also considered the controller's ne bis in idem argument. The DPA rejected this argument, recalling that "the principle ne bis in idem [...] do[es] not apply to a situation in which several penalties are imposed in a single decision, even if those penalties are imposed for the same actions. In fact, where the same conduct infringes several provisions punishable by fines, the question whether several fines may be imposed in a single decision falls not within the scope of the principle ne bis in idem”." Lastly, the DPA considered the controller's argument that the assessment of the storage period and the choice of legal bases were to a large extent discretionary. The DPA rejected this argument on both accounts, noting that the DPA was competent to review assessments made by a controller to ensure compliance with their obligations. Pursuant to Article 58(2)(i) GDPR, the DPA issued an administrative fine of NOK 10,000,000 (ten million) (Around €916,000) against SATS ASA for the following violations: First, the controller violated Articles 12(3) and 15 GDPR by failing to timely act upon two separate access requests. Second, the controller violated Articles 5(1)(e), ⁣12(3) and 17 GDPR by failing to take prompt action and erase certain personal data without undue delay pursuant to three separate erasure requests. Third, the controller violated Articles 5(1)(a), 12(1) and 13 GDPR by failing to duly inform data subjects about its data retention policy concerning the personal data of banned members, and the relevant legal basis for the processing. Fourth, the controller violated Articles 5(1)(a) and Article 6(1) GDPR, ⁣by failing to rely on a valid lawful basis to process the training history data of the members of its fitness centres.