Spanish gym chain fined €96,000 for unlawful facial recognition access system
The Spanish data protection authority fined Sidecu SA €96,000 for deploying a mandatory facial recognition system at its Supera gym chain without member consent. The system violated GDPR biometric data processing rules, as the company made facial recognition the only access method without proper notification or alternatives.
What happened
Sidecu SA, owner of the Supera gym chain, implemented a facial recognition system as the sole method of access to its facilities across 30 locations in Spain, without notifying members or offering alternative access methods.
Facua-Consumidores en Acción filed a complaint in 2023 after members reported being denied access unless they submitted to facial recognition, which replaced the previous card-based system.
Reported impact
The system processed biometric data of gym members without explicit consent and made facial recognition mandatory with no alternative access options, violating members' data privacy rights.
Index analysis
The Agencia Española de Protección de Datos (AEPD) determined that Sidecu SA violated Articles 9 and 13 of the General Data Protection Regulation (GDPR) by processing biometric data without lawful basis and failing to inform users.
The company's defence that it generated facial patterns rather than storing full images did not satisfy GDPR requirements, as the system still qualified as biometric data processing subject to the biometric processing prohibitions.
Governance controls
The AEPD issued three fines totalling €160,000 that were reduced by 40% to €96,000 because Sidecu SA acknowledged the violation and paid voluntarily.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.