Datatilsynet (Denmark) — Sporting Health Club
Datatilsynet held a fitness centre could obtain valid consent for facial-recognition access control because alternatives existed, but criticised the specific consent obtained from a complainant wrongly told no alternative existed.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text (in DA, the document's language).
- Decided by
- Datatilsynet
- Parties
- Datatilsynet v. Sporting Health Club
- Decision date
- August 20, 2024
- Remedy
- Datatilsynet expressed formal criticism regarding the specific consent Sporting Health Club attempted to obtain from the complainant.
- Appeal
- Appeal status not stated
Key holdings
Datatilsynet determined that a fitness center can legally collect valid consent for facial recognition access if members are offered real alternative entrance methods and the consent is properly informed.
“Datatilsynet fandt – efter at sagen har været behandlet på et møde i Datarådet – at SHC kan indhente et gyldigt samtykke, der kan udgøre en undtagelse”
Datatilsynet criticized the fitness center in this specific instance because the complainant was wrongly informed that no alternatives to facial recognition existed.
“Datatilsynet fandt imidlertid grundlag for at udtale kritik af det samtykke, som fitnesscentret konkret havde forsøgt at indhente fra klager” — Datatilsynet udtaler kritik
In plain English
The Danish Data Protection Authority, Datatilsynet, issued a decision regarding the fitness center Sporting Health Club following a complaint from a citizen concerning the center's use of facial recognition for access control. The complainant alleged that there were no adequate or equivalent alternatives available to members who did not wish to submit to facial recognition. In its evaluation, Datatilsynet noted that users who do not consent to facial recognition could be admitted by reception staff during manned operating hours. Outside of manned hours, users could contact round-the-clock support, which could either open the door remotely or generate a door access code. Referencing an earlier case involving FysioDanmark Hillerød, Datatilsynet reaffirmed that using facial recognition for access to fitness facilities is not inherently contrary to general data protection principles or proportionality requirements. After consulting the Data Council, Datatilsynet concluded that Sporting Health Club can legally collect valid consent to process biometric data if the center ensures the consent is properly obtained and fully informed. However, in this specific instance, Datatilsynet expressed formal criticism toward Sporting Health Club because the complainant had been incorrectly informed that no alternatives to facial recognition existed, invalidating the consent provided.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.