Students at two schools in a Norwegian municipality were instructed to use the fitness tracking app Strava as part of their school activities. The municipality failed to maintain control over how the students’ personal data was processed within the app, violating GDPR. Consequently, the Norwegian Data Protection Authority issued a 50,000 NOK fine to the municipality.