Norwegian DPA issues fine to Coop Finnmark

Feb 10, 2021

Source: European Data Protection Board

The Norwegian Data Protection Authority has issued a fine in the amount of EUR 40 000 (NOK 400,000) to Coop Finnmark SA. The case concerns unlawful distribution of a camera recording from a shop.

The manager of the shop in question made a recording of surveillance footage with their phone and distributed the recording. The recording quickly spread.

The amount of the fine has not changed since our first notice in this case.

Lacked legal basis

All processing of personal data requires a legal basis in order to be lawful. After reviewing the case, the Data Protection Authority finds that Coop Finnmark lacked a legal basis for the shop manager’s distribution of the surveillance footage.

“The requirement for a legal basis is a basic principle of the General Data Protection Regulation, and any violation of this principle is considered serious,” Bjørn Erik Thon, Director-General of the Norwegian Data Protection Authority, explains.

This case was reported as a personal data breach notification from Coop Finnmark AS on April 10th 2019, and the Data Protection Authority issued a notice of fine in March 2020. Coop Finnmark has submitted comments to the notice, which the Data Protection Authority now has considered.

Responded with a fine

The Data Protection Authority finds that this case is so severe that a fine is the appropriate corrective measure. The Authority has given weight to the fact that the camera footage showed children, and that the distribution potentially entailed a major risk to their privacy.

The fine amount was calculated on the basis of an overall assessment of the severity of the violation and the financial situation of the organization, among other things.

“This case is a textbook example of how easy it is to lose control of personal data once shared — these things spread quickly,” says Bjørn Erik Thon 

For further information, please contact the Norwegian DPA: international@datatilsynet.no
 

The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA’s website or other channels of communication, the news item is only available in English or in the Member State’s official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.

Recent news

Norwegian DPA issues fine to Aquateknikk AS

The Norwegian Data Protection Authority has fined Aquateknikk AS EUR 10,000 (NOK 100,000) for having performed a credit rating on a private individual without legal basis. This case came in response to a complaint from a person who discovered that Aquateknikk had...

read more

Swedish DPA: Police unlawfully used facial recognition app

The Swedish Authority for Privacy Protection finds that the Swedish Police Authority has processed personal data in breach of the Swedish Criminal Data Act when using Clearview AI to identify individuals. Upon news in the media of the Swedish Police Authority using...

read more