Gym can frame its own rules and regulations to permit access to its gym
2) it is for security purposes
3)discontinue your membership
One of the famous gyms forcing me put biometric otherwise we don't allow you saying is this legal
One of the famous gym forceing me put biometric othewise we dont allow you saying is this legal ? they remove my face id asking me to this after 5 months i am not willing to give biometric how to handle this ?
Asked 1 year ago in Consumer Law
6 Answers
What are the terms and conditions of the gymnasium?
Have you signed the application form to join the gym accepting the conditions ?
If not then you can question them about it and issue a legal notice demanding them the legal validity of their demand?
If there are no such rules and if they are introducing anything now, then you can always question their authority to introduce them and make it applicable to the existing members.
If they refuse to give any reason and they threaten to prevent your entry, you can drag them to consumer forum for deficiency in service as well as for creating mental agony/harassment and seek suitable compensation too.
In India, biometric and digital personal data are forms of sensitive data requiring heightened levels of protection and consent. Historically, the Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Privacy Rules) governed the collection, storage, and handling of such data. More recently, the Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA-2023) has come into play.
According to both the Privacy Rules and the DPDP Act, any person or entity that collects, receives, possesses, stores, deals, or handles biometric or digital personal data must obtain prior consent from the person providing such data. A comprehensive privacy policy must be disclosed, outlining the purpose of collection, intended usage, retention period, security practices, and grievance redressal mechanisms.
Obligations and Rights under the DPDP Act:
- Data principals (the individuals whose data is being collected) have the right to access, correct, erase, port, and restrict their digital personal data.
- Data fiduciaries (the entities processing the data) have obligations to classify their data into general, sensitive, and critical categories and abide by varying rules for each.
- Data fiduciaries are mandated to conduct data protection impact assessments, appoint data protection officers, and conduct periodic audits.
- They must notify the Data Protection Authority (DPA) and the affected data principals in case of a data breach.
- Data fiduciaries must also adhere to the codes of practice, standards, and regulations issued by the DPA.
- Explicit consent is required for processing sensitive digital personal data, and additional conditions must be met for cross-border data transfer.
- For processing critical digital personal data, prior approval from the DPA is mandatory, and a copy of such data must be stored within India.
If your gym or any other entity violates these conditions, you have the right to lodge a complaint with the relevant authority (under the IT Act) or the Data Protection Authority (under the DPDP Act), and you may also seek legal remedies. For further information, you may refer to the DNA Technology Regulation Bill, which pertains to the use of DNA information in particular cases but has sparked some privacy debates, as well as the official website of the Ministry of Electronics and Information Technology for guidelines on the DPDP Act.
Dear Client
Review the Gym Membership Agreement:
Carefully review the terms and conditions of your gym membership agreement. This document should outline the rights and responsibilities of both you and the gym. Look for any clauses related to biometric data collection, privacy, and membership requirements.
Seek Legal Advice:
Consult with a lawyer who specializes in privacy and data protection laws in India. They can provide you with advice on whether the gym's demand for biometric data is in compliance with Indian laws.
Check Privacy Laws:
India has enacted the Aadhaar Act, which regulates the collection and use of biometric data. Determine whether the gym's actions are in violation of this or other applicable privacy laws.
Negotiate with the Gym:
Attempt to negotiate with the gym management to find an alternative solution. Explain your concerns and try to reach a mutually acceptable agreement that doesn't involve providing biometric data.
Raise a Complaint:
If negotiations fail and you believe your rights are being violated, you can consider filing a complaint with the appropriate regulatory authorities. In India, the Unique Identification Authority of India (UIDAI) oversees Aadhaar-related matters, and you can file a complaint with them if necessary.
Consider Legal Action:
If you believe your rights have been infringed upon, you may choose to take legal action against the gym. Consult with your lawyer to determine the best course of action, which may include filing a lawsuit or seeking an injunction to prevent the gym from enforcing the biometric requirement.
You can oppose it on privacy aspect but it’s better if you change the gym if the same is it’s policy
- As per UIDAI , sharing or using core biometrics for any reason is prohibited without getting consent.
- Further, the Supreme Court in its order on Aadhaar barred all private companies from seeking the 12-digit identity number.
- Hence, the said gyms cannot force you to put biometric , you can file a complaint against the said gym
