The SATS Case Shows Why Privacy Must Be Built into SportsTech

12 October 2026

When Norway's Data Protection Authority publicised orders and a reprimand to SATS in August, the case concerned photographs used for membership verification. But the decision illustrates a broader challenge for the SportsTech industry. Digital systems must do more than collect and process personal data. The organisations using them must also be able to justify the processing, inform users and handle their rights in practice. For providers of access control, membership management and training apps, these requirements can influence how products are designed.

When Norway's Data Protection Authority publicised orders and a reprimand to SATS in August, the case concerned photographs used for membership verification. But the decision illustrates a broader challenge for the SportsTech industry. Digital systems must do more than collect and process personal data. The organisations using them must also be able to justify the processing, inform users and handle their rights in practice. For providers of access control, membership management and training apps, these requirements can influence how products are designed. By Håvard K. Bjor, Chair of Norwegian Sport Tech. News analysis, 12 October 2026. <h2>A membership photograph became a GDPR case</h2> <a href="https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2026/palegg-og-irettesettelse-til-sats/">The authority's account</a> appeared in August. The <a href="https://www.datatilsynet.no/contentassets/eae270ba69d844a3bf87f6a7edbfb4de/vedtak-om-palegg-og-irettesettelse---sats-asa.pdf">decision itself</a> is dated 15 July 2026; <a href="https://rett24.no/articles/datatilsynet-irettesetter-sats-for-krav-om-bilde-av-kundene">Rett24/NTB reported it on 14 August</a>. This is not a new regulatory decision. The question in October is what it teaches developers and buyers of sports technology. The case followed 26 complaints received between May and November 2025. Norway was the lead supervisory authority in the cross-border proceeding, with Sweden, Denmark and Finland as concerned authorities. The reprimand concerned Article 13(1), for incorrect information about the legal basis; Article 13(2), for insufficient information about the right to object; and Article 21(1), for rejecting objections without demonstrating compelling legitimate grounds. SATS received orders and a reprimand, not a fine in this decision. The compliance deadline was 11 September. The decision also describes SATS's revised procedures for assessing objections individually and acknowledges its willingness to take corrective action. It does not establish that a particular IT system or software provider caused the infringements. Nor did the authority investigate whether the photograph processing met security requirements. <h2>The authority did not ban membership photographs</h2> SATS argued that photographs were necessary to perform the membership contract: If somebody else could use a membership, the company would be delivering a different service from the one agreed. The authority distinguished the contract's core service from additional identity checks. Access was granted through membership cards or QR codes, and photographs were not checked on every visit. Photograph processing was therefore not necessary for contractual performance under Article 6(1)(b). However, the authority recognised SATS's interests in preventing misuse and maintaining safety. Legitimate interests under Article 6(1)(f) was the appropriate basis to consider. It requires a legitimate interest, necessary processing and a balance against members' rights. This is not a ban on membership photographs, and consent is not always required. The decision expressly does not conclude whether SATS actually meets all the conditions for legitimate interests. The organisation must document its assessment and fulfil its other obligations. <h2>A user right must work in practice</h2> <a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng">GDPR Article 21(1)</a> gives individuals a right to object, on grounds relating to their particular situation, to processing based on legitimate interests, among other grounds. The organisation must then stop processing unless it demonstrates compelling legitimate grounds overriding the person's interests, rights and freedoms, or the processing concerns the establishment, exercise or defence of legal claims. The right to object is therefore not an unconditional opt-out button, but neither can it be dismissed with a standard response. The general balancing assessment cannot replace consideration of the particular objection. Information about the right must also be presented clearly and separately from other information. In <a href="https://sandtro.no/artikkel.php?id=168">his analysis of 2 October</a>, lawyer Jan Sandtrø highlights precisely this distinction. For a membership management system, it means one user may need a different verification procedure from others. Someone must own the request, the decision must be reasoned, and it must take effect in operations. <h2>From privacy notice to product design</h2> Three levels must remain distinct: The organisation needs a lawful basis for processing. It needs procedures that implement its obligations. And the technology must be able to support those procedures. None can, on its own, compensate for the others. The examples below illustrate general product choices, not incidents or system failures at SATS. An access control system might use membership cards, QR codes or visual identity checks. These approaches have different data requirements; fewer photographs can mean less storage, but may also require a different verification process. A QR code is not automatically anonymous or privacy-friendly: Check-in logs may still identify members and require their own purpose and retention rules. When a member objects to photograph storage, the system can support recording the request, restricting access to case information, documenting the assessment and implementing the decision. An alternative verification procedure may be appropriate if photograph processing must stop. A product should not automatically exclude a member simply because a photograph field is empty; the organisation must be able to implement the assessment it has actually made. A booking system can separate information needed for a class reservation from data used for other purposes. A digital membership credential can limit which details are displayed. A training app can distinguish access to the service from optional analytics features. The user journey must show relevant information where data are collected, rather than merely linking to a lengthy notice. These are possible solutions, not new feature requirements imposed by the SATS decision. Article 25 on data protection by design and by default requires appropriate technical and organisational measures, not one particular interface. An ordinary photograph is not automatically biometric data either; that depends on the specific technical processing. A data controller determines the purpose and essential means of processing. A data processor processes information on its behalf. A provider does not automatically become responsible for its customer's choice of lawful basis, but has its own obligations in its role. If it uses data for its own purposes, it may be an independent controller. Roles must be assessed case by case. Software alone cannot guarantee compliance. <h2>SATS's own website shows why clear information matters</h2> NST checked the public pages on 12 October. The <a href="https://www.sats.no/legal/generelle-vilkar">membership terms</a>, marked last updated on 1 August 2026, state in section 2.2 that SATS normally takes a photograph during identity verification. They refer to legitimate interests and the right to object. The date precedes the August announcement; it does not establish when those particular formulations changed. The <a href="https://www.sats.no/legal/personvernerklaring">privacy notice</a> distinguishes membership administration based on contractual performance from photographs based on legitimate interests. Meanwhile, a <a href="https://www.sats.no/kundeservice/medlemskap/ovrige-sporsmal/hvorfor-trenger-sats-et-bilde-av-meg-for-medlemskapet-mitt">customer-service page dated 2 December 2025</a> says all members need a check-in photograph. It is not established whether the older wording reflects current practice. The observation demonstrates neither an ongoing GDPR infringement nor failure to comply with the orders. It illustrates why terms, customer-service guidance and product information should be aligned. <h2>Could privacy become a competitive advantage?</h2> Three possible developments may matter to Norwegian SportsTech providers: Customers might request better documentation, prefer solutions needing fewer personal details, and value support for user rights. These are analytical possibilities, not documented market effects of the decision or guaranteed new revenue. For a chain operating across Nordic countries, shared documentation and clear responsibilities could reduce friction between venues, customer service and providers. GDPR offers a common European framework, but the particular processing and operational procedures still need assessment. <a href="https://www.edpb.europa.eu/public-consultations/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en">EDPB's consultation material on legitimate interests</a> offers supplementary guidance, not a new order to the SportsTech industry. The lesson is not that digital identification systems should stop using photographs. It is that functionality, lawful bases and user rights must work together. Handling data responsibly could become just as important as collecting ever more of it. Source-based news analysis. The image illustrates digital access control, not SATS software or premises.