The Norwegian Data Protection Authority has decided to issue a fine of EUR 10 000 (NOK 100,000) to Lindstrand Trading AS for conducting a total of four credit ratings of individuals and sole proprietorships without a legal basis.
This fine was issued in response to a complaint filed by an individual who discovered she had been subjected to credit ratings without having any form of customer relationship or other association with Lindstrand Trading.
The General Data Protection Regulation requires that all processing of personal data must have a legal basis. Credit ratings are a type of personal data subject to special protections.
“As a credit rating includes detailed information about one’s personal financial situation, it feels very intrusive when an organization unlawfully gains access to this information,” says Bjørn Erik Thon, Director-General of the Norwegian Data Protection Authority.
Directly linked to the owner’s personal financial situation
Credit ratings of a sole proprietorship are also considered personal data, as this type of business enterprise is directly linked to the owner and thereby also the owner’s personal financial situation. This means that a legal basis is required to subject sole proprietorships to a credit rating.
A credit rating compiles personal data from many different sources and estimates how likely it is that a person will be able to pay what they owe. A credit rating will also include detailed information concerning the personal financial situation of individuals, such as any payment defaults, debt-to-income ratio and whether the person has any mortgages.
The Data Protection Authority finds that these credit ratings were conducted for personal purposes, completely disconnected from the organization’s business activities. On this basis, we have concluded that the credit ratings were conducted without a legal basis, thus constituting a violation of the provisions of the General Data Protection Regulation.
“We receive many complaints concerning credit ratings, and we see that many organizations have insufficient knowledge of the rules that apply. These types of cases are serious offences, and we normally issue fines for such violations,” Bjørn Erik Thon concludes.
Lindstrand Trading AS has appealed the fine.
For further information, please contact the Norwegian DPA: firstname.lastname@example.org