SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. – €36,000 Fine (Spain, 2025)

The data subject was a gym member at a fitness franchise (School Fitness), which allegedly acted as a joint controller together with the local gym. On 7 February 2021, the data subject filed a complaint through the controller’s website as they were unhappy about being filmed during fitness classes without consent. In its reply, the controller asserted that the data subject had given consent by signing the membership contract. The contract contained a clause stating that by signing, the member authorised the company to use all images, photographs, videos, voice recordings, graphics, etc., in which they appeared. On 9 May 2023, the data subject noticed that a phone was recording the class, despite their repeated objections to being filmed. The data subject believed that the contractual clause referred to in the email exchange was abusive and, on 30 May 2023, filed a complaint with the AEPD (Spanish DPA). Upon receiving the claim from the DPA, the controller denied the allegations. It asserted that members who signed the contract expressly consented to being recorded and to the dissemination of the recorded material for promotional purposes. It also claimed that verbal consent was obtained during classes. During the investigation, three main issues arose: first, whether the clause in the membership contract validly obtained consent for recording; second, whether the controller complied with the GDPR principles for processing images; and third, whether there was a properly formalised data processing agreement between the franchise and the local gym concerning the handling of images. Additionally, the data retention policy indicated that images would be kept indefinitely. The DPA found that the combination of a clause in a subscription contract and verbal consent did not meet the standards under Article 7(1) GDPR. Freedom of consent could not be demonstrated through the contracts signed by data subjects. It lacked a specific, clearly separated clause dedicated to the use of images. The acceptance of image processing was not distinguishable from acceptance of general and specific contractual terms. Furthermore, the administrative file contained no evidence to demonstrate that such verbal consent had been effectively requested and obtained. The DPA held that the controller thereby violated Article 7(1) GDPR. Furthermore, the DPA found that the controller breached the principle of storage limitation. The company's internal records indicated that images and videos were retained indefinitely. They did not give a specific storage period nor assessed the necessity based on the original purpose. They thereby failed to establish and observe a defined data retention period. Therefore, the DPA also found a breach of Article 5(1)(e) GDPR Finally, the DPA was critical of the arrangement between the fitness franchise and its local gym operator. They claimed to function as joint controllers, but this was not the case in actuality. According to [https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-072020-concepts-controller-and_en EDPB Guidelines 07/2020], joint controllership must be based on a factual analysis of actual influence over the processing purposes and means. In practice, the fitness franchise exclusively determined the way in which personal data was processed. The local gym carried out instructions without real decision-making power. Since the local gym did not share control over the data processing operations, it should have been qualified as a processor rather than a joint controller. Accordingly, the DPA ruled that the fitness franchise violated Article 28(3) GDPR Consequently, the DPA imposed a fine of €36,000 on the controller. Following recognition of responsibility and prompt payment, this amount was reduced to €21,600. The controller was also ordered to implement corrective measures. They needed to ensure that the recording and publication of images and videos of data subjects is carried out with a correct legal basis. Second, comply with data retention periods, and to formalise a compliant processor agreement.