The \u00a0Spanish Data Protection Agency (AEPD)\u00a0 has imposed a hefty \u00a0sanction of \u20ac96,000\u00a0 on the gym chain SIDECU following violations of customer data protection standards. This enforcement action stems from allegations that the gyms utilized \u00a0facial recognition technology\u00a0 as the only method of access, compromising \u00a0privacy rights\u00a0 without proper notification or consent. The reports of this misconduct were initially lodged by the consumer advocacy group \u00a0Facua\u00a0 in \u00a02023\u00a0, bringing to light critical issues surrounding data privacy in the fitness industry.<\/p>\n
<\/p>\n
The controversy unfolded on \u00a0August 4, 2023\u00a0, when a complaint was filed against SIDECU, a gym operator based in \u00a0A Coru\u00f1a\u00a0, Spain. The claim specifically pointed out that the \u00a0Entrepuentes Sports Center\u00a0 in \u00a0Seville\u00a0 was denying patrons access unless they used the new facial recognition system implemented by the chain. The complainant described the system as not just \u00a0invasive\u00a0, but also \u00a0excessive\u00a0 for its intended purpose\u2014accessing a gym.<\/p>\n
Previously, patrons could enter the facilities with a traditional membership card, a method that respected user privacy. However, the sudden implementation of facial recognition left customer no option but to comply, leading to two more complaints being added before Facua officially escalated the matter to the AEPD in \u00a0September 2023\u00a0.<\/p>\n
<\/p>\n
In its defense, SIDECU argued that it did not \u00a0store images\u00a0 of users. Instead, the platform generated a \u00a0facial pattern\u00a0 using an algorithm developed by the system\u2019s creators\u2014claims that the company believed would satisfy the requirements of the \u00a0General Data Protection Regulation (GDPR)\u00a0. The gym chain reassured users that these \u00a0templates\u00a0 did not allow for personal identification or reveal any physical attributes.<\/p>\n
However, this position appears fundamentally flawed when examined against the stipulations of the \u00a0GDPR\u00a0. Article 4.14 categorizes \u00a0biometric data\u00a0\u2014including facial images and fingerprints\u2014as personal data, and Article 9 expressly prohibits the processing of biometric information intended for unique identification. By failing to grasp these regulations, SIDECU appears to have contravened the law significantly.<\/p>\n
<\/p>\n
The first major error<\/strong> noted was a blatant disregard for Article 9 of the GDPR. SIDECU’s facial recognition system unequivocally collects biometric data aimed at uniquely identifying individuals, constituting a serious breach of legal boundaries.<\/p>\n Image | Ryan Hoffman<\/span>\n <\/div>\n<\/p><\/div>\n<\/div>\n The second major error<\/strong> involved imposing this facial recognition system without prior notification to users, which violates Article 13 of the GDPR. Not only was there no advance warning, but this system was the \u00a0sole option\u00a0 for accessing the gym, thereby nullifying any possibility of *freely given consent.* Although SIDECU introduced an alternative access method at a later stage (showing an ID), this change came only after user complaints.<\/p>\n <\/p>\n The third major error<\/strong> was failing to perform a required risk assessment, violating Article 35 of the GDPR. According to the AEPD\u2019s findings, SIDECU did not sufficiently justify the necessity of the facial recognition system when less invasive, equally effective alternatives existed. The AEPD criticized the gym chain for neglecting to conduct an \u00a0impact assessment\u00a0 regarding personal data protection, deeming its actions negligent rather than fraudulent.<\/p>\n <\/p>\n The final outcomes of the investigation led to three distinct sanctions against SIDECU for violating specific articles of the GDPR: \u00a0\u20ac80,000\u00a0 for violating Article 9, \u00a0\u20ac30,000\u00a0 for failing to inform users as required by Article 13, and \u00a0\u20ac50,000\u00a0 for neglecting the necessary risk assessment as stipulated in Article 35. Although these violations could have resulted in a total fine of \u00a0\u20ac160,000\u00a0, the amount was reduced to \u00a0\u20ac96,000\u00a0 due to SIDECU’s acknowledgment of its \u00a0responsibility\u00a0 and prompt actions to remediate the situation.<\/p>\n <\/p>\n This case showcases significant concerns regarding user consent and data privacy within the fitness industry, as \u00a0technological advancements\u00a0 continue to challenge traditional privacy boundaries. The AEPD’s rulings send a clear message: compliance with data protection laws is mandatory, and any failure to do so can result in severe financial penalties.<\/p>\nSanction and Accountability<\/h2>\n