Datatilsynet (Denmark) — FysioDanmark Hilleroed
Datatilsynet warned a fitness centre that its planned facial-recognition access-control system would breach GDPR Article 9, as scanning non-consenting individuals and using biometric data for analytics lacked explicit consent.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-19. Every holding carries a short verbatim quote from that text (in DA, the document's language).
- Decided by
- Datatilsynet
- Parties
- Datatilsynet v. FysioDanmark Hillerød ApS
- Decision date
- March 17, 2022
- Remedy
- Datatilsynet issued two formal warnings under GDPR Article 58(2)(a) that processing biometric data for business statistics without explicit consent and scanning non-consenting individuals via an always-on entrance camera would violate data protection rules.
- Appeal
- Appeal status not stated
Key holdings
Processing customer biometric data collected via facial recognition for business statistics and optimization requires separate, explicit consent from the individual.
“Datatilsynet fandt imidlertid anledning til at advare virksomheden om, at det sandsynligvis ville være i strid med reglerne i databeskyttelsesforordningen, hvis virksomheden anvendte systemet uden samtykke fra virksomhedens kunder.” — Resume
Using facial recognition technology constitutes processing of biometric data for unique identification regardless of whether a database match actually occurs.
“Det er således uden betydning, om der sker et match, dvs. om der rent faktisk sker en entydig identifikation.” — 3.4. Behandling af personoplysninger om personer, herunder kunder og ansatte, som ikke ønsker at gøre brug af ansigtsken
Datatilsynet issued formal warnings pursuant to GDPR Article 58(2)(a) regarding the intended non-compliant operation of the facial recognition system.
“Advarslen meddeles efter databeskyttelsesforordningens artikel 58, stk. 2, litra a.” — 1. Afgørelse
In plain English
Datatilsynet, the Danish Data Protection Authority, launched an ex officio investigation on 7 July 2021 into FysioDanmark Hillerod regarding its planned deployment of a facial recognition system supplied by Justface. FysioDanmark planned to set up a camera at the entrance of its fitness center to scan faces for access control of customers and employees as a voluntary alternative to physical access cards. Additionally, FysioDanmark intended to process collected data to gather statistics and optimize business operations, such as staffing allocations. Datatilsynet evaluated the intended processing under data protection rules. The authority determined that using facial recognition based on explicit, voluntary, and granular consent for access control could comply with data protection regulations. However, Datatilsynet issued two formal warnings. First, processing biometric data for business statistics and optimization without separate explicit consent would violate the rules. Second, because the entrance camera would remain continuously active, it would scan and process biometric data of individuals who had not consented to facial recognition. The authority emphasized that whether a match actually occurs is irrelevant; processing biometric data with the purpose of unique identification constitutes biometric processing that requires consent. Therefore, operating an unassisted, continuously running scanner violates data protection law regarding non-consenting visitors unless triggered manually by the user.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.