Sanction of 10,000 euros to Gymoogymnasios by the AEPD for forcing its clients to transfer their health data

Sanction of 10,000 euros to Gymoogymnasios by the AEPD for forcing its clients to transfer their health data

In the digital age, the preservation of personal information becomes a crucial issue as we live in an increasingly interconnected world. The privacy and security of personal data stand as fundamental pillars in this context.

Recently, Gymoogimnasios, a well-known gym chain, was fined 10,000 euros by the AEPD due to its practice of requiring customers to share personal data about their health as a requirement for booking activities and accessing gym facilities.

To fulfill this request, they were required to accept a box, without which it was not possible to complete the registration process through the application used to make reservations.

The AEPD has concluded that this action constitutes unnecessary and disproportionate data processing.

This case illustrates the legal keys to data protection and the serious consequences of not complying with current regulations.

Legal keys to data protection

Compliance with the legal keys of data protection is essential not only to avoid this type of sanctions, but also to protect people’s privacy, maintain a solid reputation and compete effectively in today’s market.

It is not only a matter of legal compliance, but also a demonstration of responsibility and respect for the fundamental privacy rights of people in the digital age.

In this sense, the most important legal aspects or keys to take into account when processing personal data are the following:

• Informed consent: Companies must obtain informed consent from individuals before collecting their personal data. This consent must be specific and free, meaning that people must have the option to refuse without consequences.
• Limited purpose: Personal data may only be collected and processed for specific and legitimate purposes. In the case of Gymoogymnasios, the collection of customer health data must have a clear and legal justification, such as ensuring safety during physical exercise.
• Data minimization: Only data necessary for the intended purpose should be collected. Individuals cannot be required to provide additional information that is not relevant to the activity.
• Data security: Companies have an obligation to protect personal data from unauthorized access or disclosure. This involves the implementation of appropriate security measures.

Consequences of transferring personal health data

The GDPR thoroughly regulates the processing of health data. This is mainly carried out in its article 9. Health data is of a particularly sensitive nature, and the aforementioned article establishes that, in principle, the processing of health data is prohibited unless one of the specific conditions is met. listed therein.

These conditions include the explicit consent of the data subject, the need for medical treatment, the management of insurance claims and other special circumstances.

When companies like Gymoogimnasios force or induce their clients to give up this type of data without complying with the provisions of data protection laws, they face serious consequences, as evidenced in this case.

Significant fines, damage the reputation and criminal sanctions

On the one hand, it is clear that data protection authorities, such as the AEPD in Spain, can impose significant fines on companies that violate data protection laws.

This type of action can result in companies that do not adequately protect the personal data of their customers suffering damage to their reputation. Customers may lose trust in the company, leading to long-term loss of business.

Additionally, individuals whose health data is collected illegally may themselves take legal action against the company. This can result in costly litigation and damage to the company’s image. And, in extreme cases, serious violations of the principles enshrined in the protection of personal data can lead to criminal sanctions, including the possibility of imprisonment for those responsible for companies that fail to comply.

Ultimately, the Gymoogimnasios case and the sanction imposed by the AEPD highlight the critical importance of complying with data protection laws.

Forcing customers to give up their personal health data without their proper consent and clear legal justification can have significant financial and legal consequences for companies.

In the era of digital privacy, personal data protection must be a priority for all organizations that handle sensitive personal information.

At Letslaw by RSM we are experts in Data Protection and we can advise you on everything you need.