View source for Datatilsynet (Norway) - 21/02455

== English Summary ==

=== Facts ===
In 2021, a data subject lodged a complaint with the Norwegian DPA (Datatilsynet) against "Shinigami Eyes" after they had been marked through the application. Shinigami Eyes is a browser addon that highlights transphobic and trans-friendly social network pages and users with different colors.

Consequently, the DPA launched an investigation and sent a request for information to the developer of the extension, who failed to reply. The DPA sent several requests and reminders and, finally, an advance notification of a decision, but the developer never replied back. The data subject, however, provided further comments to the complaint and, following this, the DPA found that they had enough information to be able to issue a final decision.

=== Holding ===
First, the DPA assessed the territorial scope of the GDPR. They were not able to identify an “establishment” of Shinigami Eyes within the EEA as per [[Article 3 GDPR#1|Article 3(1) GDPR]], but found that the GDPR is applicable to their processing activities as per [[Article 3 GDPR#2b|Article 3(2)(b) GDPR]] - monitoring data subjects' activities.

Second, the DPA assessed the material scope and found that Shinigami Eyes processes several types of personal data as per [[Article 4 GDPR#1|Article 4(1) GDPR]], including the name or online identifier of social network users, their posts/behaviour and the color indicating whether they are transphobic or trans-friendly.

Third, the DPA found that Shinigami Eyes is the controller for this processing as they determine the purpose of the extension, as well as the means to be utilised and implemented.

Next, the DPA assessed the lawful basis of the processing. As they never got a reply from the controller, the DPA considered this themselves and found legitimate interest as per Article 6(1)(f) to be the most prospective legal basis. 

=== The legitimate interest assessment ===
First, the DPA assessed the condition of “legitimate interest” and concluded that the controller indeed has such an interest, as they claim to want to protect people from harm, like discrimination. 

Second, the DPA assessed whether the processing was necessary for the purposes of the legitimate interests pursued. Although this was more difficult because of the lack of information from the controller, the DPA concluded that this criteria was also fulfilled. 

Third, the DPA conducted the balancing test to determine whether the data subjects’ fundamental rights and freedoms precedes the controller’s legitimate interest. The DPA found, amongst other things, that data subjects have no knowledge about the processing taking place, no relationship with the controller and, thus, have no way of expecting such processing to take place. The DPA also mentions several potential negative consequences for the data subjects, including losing their job, friendships and being a target of hate and mistreatment - regardless of what they are categorised as (trans-friendly or transphobic). Finally, the DPA mentions the chilling effect such applications can have on the public discourse. In conclusion, the DPA found that the data subjects’ interests, rights and freedoms outweigh the controller's interest in providing their application. The processing of personal data does not meet the third condition in [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] and, consequently, the controller lacks a legal basis for the processing.

Following from the above, the DPA has banned the use of Shinigami Eyes on Norwegian territory after determining violations of [[Article 6 GDPR#1|Article 6(1) GDPR]], [[Article 12 GDPR#2|Article 12(2) GDPR]] and [[Article 14 GDPR|Article 14 GDPR]].