Datatilsynet (Norway) - 20/02225

Datatilsynet - 20/02291
Authority:	Datatilsynet (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 5(2) GDPR Article 6(1)(f) GDPR Article 24 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:
Fine:	300000 NOK
Parties:	n/a
National Case Number/Name:	20/02291
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Norwegian
Original Source:	Datatilsynet (in NO)
Initial Contributor:	n/a

Datatilsynet held that a credit rating of the complainant, initiated by the company Aquateknikk, did not satisfy the requirements under Article 6(1)(f) GDPR. In addition, the company was required to evaluate and improve their internal guidelines for initiating credit ratings, pursuant to Article 24 GDPR.

English Summary

Facts

The company Aquateknikk AS credit rated the complainant without any connection between the company and the complainant. According to the complainant, this was done due to the fact that the complainant operates a competing business. Aquateknikk stated that the credit rating of the complainant was a mistake, as the intended target of the credit rating was the complainant's business.

Datatilsynet decided to issue a request for the logs of the company's credit rating history to Bisnode, the company issuing the credit ratings. In the logs it was clear that both the complainant and the complainant's company was credit rated by Aquateknikk.

Dispute

The issue at hand was whether Aquateknikk had a legitimate interest in rating the credit worthiness of the complainant, pursuant to Article 6(1)(f) GDPR.

Holding

Datatilsynet held that Aquateknikk did not have a legitimate interest in rating the credit worthiness of the complainant. In particular, Datatilsynet highlighted that there were no prior existing relationship between the company and the complainant. On the contrary, the complainant operated a competing business. As such, the complainant could also not have any reasonable expectations that the company would process his personal credit rating.

In addition to a breach of Article 6(1)(f) GDPR, the lack of organisational measures pursuant to Article 5(2) GDPR was weighted when concluding on the size of the fine.

Comment

The controller was fined on the basis of breaches to Articles 6(1)(f) and 5(2) GDPR.

While it was not done in this particular case, Norwegian implementation of the GDPR also allows for fining controllers based on breaches of Article 24, unlike the GDPR cf. personopplysningsloven § 26. Personopplysningsloven § 26 refers to Article 83(4) GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.