IMV.
1(10)
Swedish Authority
for Privacy Protection
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection's
decision.
COMPLAINANT
See appendix
Swedish ref no:
DATA CONTROLLER
DI-2021-6211
Fitness24Seven AB
Finnish ref no:
4934/157/19
IMI case register:
184302 Decision under the General Data
Date of the decision:
2024-06-10 Protection Regulation
Fitness24Seven AB
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Fitness24Seven AB
(org.nr: 556635-4626) has failed to fulfil its obligation under
• Article 12(2) of the GDPR 1 by not facilitating the exercise of the right of the
complainant to object to direct marketing;
• Article 13(1 )(c) GDPR by not having properly informed the complainant of the
legal basis for the processing when the personal data were collected; and
• Article 21 (4) of the GDPR, by not expressly notifying her of the right to object
to the processing for direct marketing purposes at the time of the first
communication with the complainant.
IMY issues Fitness24Seven AB a reprimand pursuant to Article 58(2)(b) GDPR for the
infringement of the above provisions regarding the present complainant (complaint 3).
The supervisory case has previously been closed in the parts relating to Complaint 12 ,
Complaint 23 and Complaint 44 . By this decision, the case is closed.
Presentation of the supervisory case
Handling of the case
Postal address:
Box 8114 IMY has received a complaint against Fitness24Seven AB (hereinafter the company)
104 20 Stockholm from the Finnish Data Protection Authority (Dataombudsmannens byra) in accordance
Website:
www.imy.se 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
E-mail: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
[email protected] Directive 95/46/EC (General Data Protection Regulation).
2 Registration number of the Finnish Data Protection Authority: 477/161/20.
Telephone: 3 Registration number of the Finnish Data Protection Authority: 1006/182/19.
4 Registration number of the Finnish Data Protection Authority: 1221/182/19.
08-657 61 00
Page 1 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 2(10)
Protection
Date: 2024-06-10
with the provisions on the competence of the lead supervisory authority in Article 56 of
the GDPR. In this connection, IMY received three further complaints from the Finnish
Data Protection Authority against the same company.
On 16 July 2021, IMY decided to initiate supervision against the company in order to
review the personal data processing covered by the complaints. However, the above
decision covers only the present complaint, referred to in the investigation as
Complaint 3.
The supervision at IMY has been handled through written procedure. The company
has had the opportunity to comment on IMY's draft decision. Due to the cross-border
nature of the supervisory case, IMY has made use of the cooperation and consistency
mechanisms provided for in Chapter VII of the GDPR. The relevant supervisory
authorities have been the data protection authorities of Finland, Denmark and Norway.
What the Complainant states
The complainant states, in essence, as follows.
She joined Fitness24Seven in Finland in April 2019. There was no box in the contract
where she could object to direct marketing. She signed the contract in writing at the
gym. On the back page of the contract, it was stated that she accepts that personal
data may be used for the marketing of products and services. At the time of the
contract, she objected orally to direct marketing, the customer service employee
replied that it was impossible to object to this. The customer service employee referred
her to contacting the company by e-mail instead. The complainant contacted the
company by e-mail, who replied that her objection was noted. She has concerns about
direct marketing because it was not possible to object to this at the time of the
contract.
What the company states
The company states, in essence, the following with regards to the controller's
responsibility for the data processing in question.
The company is jointly responsible, together with Fitness24Seven OY (hereinafter the
Finnish company), for the processing operations referred to in the complaints
submitted to IMY. The companies' main business activities consist of gyms and group
training. All members have access to all Fitness24Seven facilities in Sweden, Finland
and Norway, regardless of which company the member in question has entered into an
agreement with. The companies in these countries have a common customer register
in order to manage permissions for access to the company's premises.
As joint controllers, the company and the Finnish company have entered into an
agreement on the joint responsibility of personal data. According to the contract, each
contracting party is responsible for the data subjects that the contractor in question has
entered in the common customer register. The parties decide together on the
processing of personal data, but have also divided certain responsibilities between
them. Examples of such responsibilities are the handling of requests for access to
information received from data subjects. Liability depends on which contractor has
registered the person who has sent the request. The same principle of shared
responsibility also applies to requests concerning the register from data protection and
other supervisory authorities. In the light of the abovementioned agreement and the
fact that the complainants are Finnish it is primarily up to the Finnish company to
Page 2 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 3(10)
Protection
Date: 2024-06-10
answer the questions raised by IMY, from the perspective of the Fitness24Seven
group.
The company states, in essence, the following with regards to the handling of the
complainant's objection to direct marketing and the information provided to her.
On the basis of the correspondence in the case, a mistake undoubtedly appears to
have been occurred in the present case. Unfortunately, the complainant appears to
have been wrongly informed by the staff of one of the companies' gyms. The current
employee has terminated his employment for several years and therefore it is difficult
to lead in evidence what has actually been communicated and not at the time.
However, the complainant claims that she is satisfied with the handling of the case and
the problems that have arisen with regard to the issue of marketing and the possibility
of objecting to this.
The privacy policy is, and always has been, available on the company's websites in
Swedish, Finnish and English. All members also have the opportunity to receive the
policy in paper format when they visit any of the companies' facilities. In addition, the
Privacy Policy is expressly referred to when a member chooses to join. Section 12 of
the membership agreement states that personal data may be used to inform the
complainant about services provided by the company (marketing). This consent may
be revoked by the complainant at any time by e-mail to [email protected] or when
contacting their nearest gym. The complainant should therefore have been able to
withdraw her consent on the spot in accordance with the information she received at
the time of signing the contract (agreement, terms and conditions and privacy policy).
The company has ensured that there have been good conditions for the employee to
inform the complainant of how to exercise her rights and also to object to marketing
(withdrawal consent). The Company works actively with further training of staff to
ensure that we have proper procedures regarding our marketing and the consent
obtained from our members. The Membership Agreement and its terms have changed
in order to comply with the clarifications provided by the European Data Protection
Board (EDPB) regarding communication in relation to the processing of personal data.
The company has, among other things, submitted the Group's joint personal data
liability agreement, the membership agreement signed by the complainant, the privacy
policy in force at the time of the complaint, an updated member agreement with the
associated privacy policy and extracts from the company's internal instructions.
Reasons for the decision
Generally
It follows from Article 57(1 )(f) of the GDPR that the IMY shall handle complaints from
data subjects who consider that their personal data are being processed in a manner
contrary to the Regulation. It also follows from that provision that, where appropriate,
IMY must examine the subject matter of the complaint.
The present decision concerns only the handling of the complainant's personal data by
the company in the context of the present complaint. IMY interprets that the complaint
covers, on the one hand, the company's handling of the complainant's objection to the
processing for direct marketing purposes and, on the other hand, the information
received at the time of the contract concerning the legal basis for the processing of
Page 3 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 4(10)
Protection
Date: 2024-06-10
personal data and the right to object to it. IMY interprets that the complaint does not
cover the question of whether the company has a legal basis for processing the
complainant's personal data or which legal basis has been applicable for the
processing of the complainant's personal data for direct marketing purposes.
Therefore, these issues fall outside the scope of the supervision.
Controllersh ip
Applicable provisions, etc.
In accordance with Article 4(7) of the GDPR, the controller is the person who alone or
jointly with others determines the purposes and means of the processing of personal
data.
Where two or more data controllers jointly determine the purposes and means of the
processing, they shall be joint controllers, pursuant to Article 26(1) GDPR. Article 26(3)
provides that, irrespective of the modalities of the arrangement referred to in
paragraph 1, the data subject may exercise his or her rights under the GDPR in
respect of and against each of the controllers.
The European Data Protection Board (EDPB) has adopted guidelines on the concepts
of controller and processor in the GDPR. 5 The guidelines are not binding but may be
relevant to the interpretation of the provisions of the GDPR. 6
The EDPB has stated that the controllership can be defined by law or may stem from
an analysis of the factual elements or circumstances of the case. 7 The Court of Justice
has held that a natural or legal person who, for his own purposes, exercises influence
over the processing of personal data, and thereby participates in the determination of
the purposes and means of the processing, may be regarded as a controller for the
processing of the personal data in question. 8
Several different entities may act as controllers for the same processing, with each of
them then being subject to the applicable data protection provisions. 9 Moreover, in
order for several operators to be regarded as having joint responsibility for the same
processing, it is not necessary for each of them to have access to the personal data in
question. 10
A data subject is not bound by the terms of the arrangement between the joint
controllers and may exercise their rights under the GDPR regarding and against each
of them. Nor are the supervisory authorities bound by the terms of the arrangement,
either as regards the question of the qualification of the parties as joint controllers or
any designated contact point. Therefore, authorities may contact either of the joint
controllers in order to exercise their powers under Article 58 in relation to the joint
processing. 11
5 European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the
GDPR, version 2.0, adopted on 7 July 2021.
6 See Article 70 of the GDPR and the Administrative Court in Stockholm's judgment of 16 September 2022 in case No
7837-21.
7 EDPB, Guidelines 07/2020, paragraph 20.
8 Judgment of the Court of Justice of 5 December 2023, Nacionalinis visuomenes sveikatos centras, C-683/21,
paragraph 30 and the case-law cited therein.
9 EDPB, Guidelines 07/2020, paragraph 31.
°
1 C-683/21, paragraph 42 and case-law cited therein.
11 EDPB, Guidelines 07/2020, paragraph 186-191.
Page 4 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 5(10)
Protection
Date: 2024-06-10
IMY's assessment
The complaint shows that the establishment of which the complainant became a
member is located in Finland. The investigation shows that the membership
agreement has been signed between the complainant and the Finnish company. The
company states that the questions asked by IMY should have been addressed to the
Finnish company instead. Thus, IMY has to decide, first of all, whether the company is
the controller of the personal data processing covered by the complaint. For that to be
the case, the company alone or jointly with others must have determined the purposes
and means of the complainant's personal data.
The joint personal data liability agreement between the company and the Finnish
company states that the companies jointly determine the purposes and means for the
processing of personal data of existing and potential customers. The agreement also
states that the companies are to be considered jointly responsible for such personal
data under Article 26 of the GDPR. IMY considers that the content of the agreement is
confirmed by the company's information to IMY.
Before submitting the complaint to IMY, the Finnish Data Protection Authority sent a
letter to the Finnish company. The letter contained, among other things, the question
of who is the controller of the personal data processing operations that were referred
to in the complaints received by the Finnish Data Protection Authority concerning the
company.
The Finnish company has stated to the Finnish Data Protection Authority, among other
things, the following: The Finnish company is responsible for the personal data of its
customers together with the company. The company has had overall responsibility for
managing data protection related issues within the Fitness24Seven group and (by
managing the information requirements in the GDPR) has developed the current
procedures. The company has also had these procedures translated into the
respective languages. It is the company that makes decisions regarding the
processing of members' personal data relating to the whole group and that manages
the entire group's membership system. The company owns 100 % of the shares in the
Finnish company.
IMY finds that the case material provides support that the company exercises influence
over the personal data processing covered by the complaint for its own purposes and
thereby participates in the determination of the purposes and means of the processing.
In this assessment IMY considers, among other things, the Finnish company's
information on the company's actual tasks and responsibilities. The company's role as
controlling company in the group is further supported by its influence over the
determination of the purposes and means of the complainant's personal data.
Admittedly, it is clear from the joint controller agreement that each contracting party is
responsible for the data subjects entered by that party in the common customer
register. However, it has not come to light any factual evidence that the Finnish
company alone determined the purposes and means of the processing in question.
IMY is also not bound by the terms of the agreement when assessing the parties'
personal data responsibilities.
Overall, IMY considers that the company, alone or together with the Finnish company,
is the data controller for the personal data processing covered by the present
complaint. Any liability of the Finnish company for the processing covered by the
complaint falls outside the scope of the current supervision. In this respect, IMY notes
that the company is subject to the applicable data protection regulations regardless of
Page 5 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 6(10)
Protection
Date: 2024-06-10
whether the liability has been solely or jointly with the Finnish company. This also
applies to the obligation to handle requests from data subjects to exercise their rights
under the GDPR.
Obligation to facilitate the exercise of rights
Applicable provisions, etc.
According to Article 21 (2) of the GDPR, the data subject shall have the right to object
at any time to the processing of personal data for direct marketing purposes
concerning him or her. When the data subject objects to processing for direct
marketing purposes, the personal data referred to in Article 21 (3) shall no longer be
processed for such purposes.
According to Article 12(2) GDPR, the controller shall facilitate the exercise of the data
subject's rights in accordance with Articles 15-22 and 34.
IMY's assessment
The next question to be considered by IMY is whether the company has dealt with the
complainant's objection to direct marketing in accordance with its obligations under the
GDPR.
The complainant states that, at the time she entered into the membership agreement,
she objected orally to direct marketing, but that she received the reply that it was
impossible. The customer service employee referred her to contacting the company by
e-mail instead. Her objection to direct marketing was met only when she contacted the
company in writing. The company admitted that the handling was wrong.
IMY notes that the complainant's right was met but that she had to object twice. IMY
therefore considers that the company has failed to fulfil its obligation under Article
12(2) of the GDPR by not facilitating the complainant's exercise of its right to object to
processing for direct marketing purposes.
Information to the complainant
Applicable provisions, etc.
It follows from Article 5 of the GDPR that personal data must be processed in a
transparent manner in relation to the data subject (principle of transparency). 12
According to Article 13(1 )(c) of the GDPR, at the time when personal data are obtained
from the data subject, the controller must provide the data subject with information of
the legal basis for the processing.
The legal bases are set out in Article 6 of the GDPR. Article 6(1 )(a) specifies that
processing is lawful if the data subject has given their consent to the processing of his
or her personal data for one or more specific purposes.
Article 4(11) GDPR defines consent of the data subject as any freely given, specific,
informed and unambiguous indication of the data subject's wishes by which he or she,
12 See also recital 39, which states that the principle of transparency requires that all information and communication
relating to the processing of these personal data is easily accessible and easily understandable and that clear and
clear language is used.
Page 6 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 7(10)
Protection
Date: 2024-06-10
by a statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her
Article 7 of the GDPR lays down, inter alia, the following conditions for valid consent.
Where the consent of the data subject is given in the context of a written declaration
which also concerns other matters, the request for consent shall be presented in a
manner which is clearly distinguishable from the other matters, in an intelligible and
easily accessible form, using clear and plain language. When assessing whether
consent is freely given, utmost account shall be taken of, inter alia, whether the
performance of a contract, including the provision of a service, is conditional on
consent to the processing of personal data that is not necessary for the performance of
that contract.
According to Article 21 (4) GDPR, at the latest at the time of the first communication
with the data subject, the right to object to direct marketing shall be explicitly brought to
the attention of the data subject and shall be presented clearly and separately from
any other information.
It follows from Article 12(1) of the GDPR that the controller shall take appropriate
measures to provide the data subject with all communications under, inter alia, Article
21 (4) in a concise, transparent, intelligible and easily accessible form, using clear and
plain language. The information shall be provided in writing, or by any other means,
including, where appropriate, by electronic means.
IMY's assessment
Obligation to inform the data subject
The next question to be considered by IMY is whether the company has fulfilled its
obligation to provide information to the complainant. According to IMY, the issue
should be assessed in the light of the principle of transparency set out in Article 5.
The EDPB has adopted guidelines on consent. In those guidelines, the EDPB states
the following. A service may include multiple processing operations for more than one
purpose. In such cases, data subjects should be free to choose which purpose they
accept instead of having to consent to a package of several. There is no freedom of
choice if the controller has combined several purposes of the processing and has not
attempted to obtain separate consent for each of these. 13
By recital 43 of the GDPR follows that Consent is presumed not to be freely given if it
does not allow separate consent to be given to different personal data processing
operations despite it being appropriate in the individual case. Recital 32 states that
Consent should cover all processing activities carried out for the same purpose or
purposes. When the processing has multiple purposes, consent should be given for all
of them.
Information referred to in Article 13
IMY has read the membership agreement signed by the complainant and the privacy
policy in force at the time. Both the Membership Agreement and the Privacy Policy
state that the processing for direct marketing is based on the consent of the
complainant. Section 12 of the membership agreement states that, by signing the
agreement, the complainant accepts that contact information can be used for
marketing services. However, the contract was designed in such a way that, by
13 European Data Protection Board (EDPB), Guidelines 05/2020 on consent pursuant to Regulation (EU) 2016/679,
version 1.1, adopted on 4 May 2020, paras 42-44.
Page 7 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 8(10)
Protection
Date: 2024-06-10
entering into membership, the complainant also automatically admits that her personal
data are processed for direct marketing purposes. The agreement did not allow the
complainant to give a separate consent to processing for direct marketing purposes.
In view of the nature of the contract, IMY considers that the complainant cannot be
regarded as having given a free and specific consent to the processing for direct
marketing purposes within the meaning of Article 4(11) and Article 7 of the GDPR. The
processing of the complainant's personal data therefore cannot have been based on
consent in so far as the processing concerned direct marketing. The company has
therefore stated an incorrect legal basis for the complainant's personal data in the
membership agreement and in the related personal data policy.
In the light of the foregoing, IMY considers that the company has failed to fulfil its
obligation under Article 13(1 )(c) of the GDPR by failing to properly inform the
complainant of the legal basis for the part of the processing relating to direct marketing
when the complainant's personal data were collected.
Information referred to in Article 21(4)
The complainant states that, when she became a member, she was told that she did
not have the right to object to direct marketing on the spot. The company states that
the complainant appears to have received incorrect information from the staff of one of
the Finnish company's gyms, but that the privacy policy is expressly referred to when a
member chooses to join.
The Privacy Policy states, inter alia, under the heading 'Marketing Communication':
»Your consent is required for F24S to be able to send important information and for
you to participate in any surveys. You can give your consent in connection with the
registration, either online or at one of our offices. If you do not wish to receive such
information, you may withdraw your consent at any time at our office or by e-mail to
[email protected].' 14
IMY considers that the parties are agreed on what oral information the complainant
received at the time of the contract concerning the right to object to direct marketing.
Since she is in fact entitled to object to such processing at any time under Article 21 (1)
and (2) of the GDPR, the information she received orally was incorrect. It is true that
the Privacy Policy contained information that in practice enabled her to oppose to
processing for direct marketing purposes, and there is no reason to doubt that she had
access to the policy in writing at the time of the contract. However, the policy lacked
explicit information about the right to object to processing for direct marketing
purposes. By referring instead to the right to withdraw consent, the company has
formulated the information in an unclear manner in relation to the terminology of the
GDPR. 15 The membership agreement completely lacked information about the right to
object.
IMY finds that the incorrect oral information provided to the complainant and the
information in the protection policy and the membership agreement considered
together leads to the conclusion that, the company has not expressly informed the
complainant of the right to object to processing for direct marketing purposes in a clear
manner, at the first contact with her. The information received by the complainant,
14 Translated by IMY from Finnish to Swedish.
15 See the Stockholm Administrative Court of Appeal's judgment of 11 March 2024 in case No 2829-23, p. 8, in which
the Administrative Court of Appeal presents a similar reasoning with regards to the corresponding requirements of
Article 12 of the GDPR.
Page 8 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 9(10)
Protection
Date: 2024-06-10
altogether, may be regarded as having limited her ability to assert her right of
objection. The company has thus failed to fulfil its obligation under Article 21 (4) of the
GDPR.
Choice of corrective power
IMY has stated above that the company has failed to fulfil its obligations under Article
12(2), Article 13(1)(c) and Article 21(4) of the GDPR. The last question that IMY has to
consider is what action to be taken in response to the infringement.
In case of breaches of the GDPR, IMY has a number of corrective powers, including
reprimand, injunction and fines. This follows from Article 58(2)(a) to U) of the GDPR.
According to Recital 129 of the GDPR, IMY shall take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the
power to impose administrative fines pursuant to Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as orders and
prohibitions. In the case of a minor infringement, the IMY may, as stated in recital 148
of the GDPR, instead of imposing an administrative fine, issue a reprimand pursuant to
Article 58(2)(b). Account must be taken to aggravating and mitigating circumstances of
the case, such as the nature, gravity and duration of the infringement as well as
previous relevant infringements.
IMY notes the following relevant circumstances for the choice of intervention. The
supervision is based on an individual complaint and refers to deficiencies in the
processing of data concerning an individual data subject. There has been no
processing of sensitive personal data. The complainant's objection to direct marketing
has been met. As a result, the expiry date of the company's handling of the
complainant's objection is less serious than if the opposition had been left
unanswered. The request had also been met even before IMY commenced the
supervision in question. It has been about four years since the date of the
complainant's membership. The investigation shows that the privacy policy has been
updated since the time of the complaint and the company states that it has improved
its work and internal guidelines since then, which IMY has no reason to doubt. The
company has not previously been found to have infringed the GDPR.
After an overall assessment of the above facts, IMY considers the infringement to be
minor in accordance with recital 148 of the GDPR. The company shall therefore be
given a reprimand pursuant to Article 58(2)(b) of the GDPR.
This decision has been taken by Head of Unit, after presentation by
legal advisor,
Appendix
The complainant's personal data
Copy to:
The company's DPO
Page 9 of 10
The Swedish Authority for Data Ref no: Dl-2021-6211 10(10)
Protection
Date: 2024-06-10
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority's contact information is shown in the first page of the
decision.
Page 10 of 10