The Norwegian Data Protection Authority has issued a fine in the amount of EUR 40 000 (NOK 400,000) to Coop Finnmark SA. The case concerns unlawful distribution of a camera recording from a shop.
The manager of the shop in question made a recording of surveillance footage with their phone and distributed the recording. The recording quickly spread.
The amount of the fine has not changed since our first notice in this case.
Lacked legal basis
All processing of personal data requires a legal basis in order to be lawful. After reviewing the case, the Data Protection Authority finds that Coop Finnmark lacked a legal basis for the shop manager’s distribution of the surveillance footage.
“The requirement for a legal basis is a basic principle of the General Data Protection Regulation, and any violation of this principle is considered serious,” Bjørn Erik Thon, Director-General of the Norwegian Data Protection Authority, explains.
This case was reported as a personal data breach notification from Coop Finnmark AS on April 10th 2019, and the Data Protection Authority issued a notice of fine in March 2020. Coop Finnmark has submitted comments to the notice, which the Data Protection Authority now has considered.
Responded with a fine
The Data Protection Authority finds that this case is so severe that a fine is the appropriate corrective measure. The Authority has given weight to the fact that the camera footage showed children, and that the distribution potentially entailed a major risk to their privacy.
The fine amount was calculated on the basis of an overall assessment of the severity of the violation and the financial situation of the organization, among other things.
“This case is a textbook example of how easy it is to lose control of personal data once shared — these things spread quickly,” says Bjørn Erik Thon
For further information, please contact the Norwegian DPA: international@datatilsynet.no