Who was sanctioned, and for what?

Datatilsynet (Norwegian Data Protection Authority) fined the online dietary supplement retailer Lab Pharma AS NOK 205,000 for breaching its duty to cooperate with the supervisory authority (Art. 31 GDPR): the company had threatened case handlers with police reports and lawsuits in order to end the investigation of a complaint, and submitted requested documents late. The authority also ordered the company to delete the name and images of a former advertising partner (an influencer) from all its websites and to stop using her data for marketing until it can demonstrate a legal basis, as the underlying contract had already expired in March 2017.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 31, Art. 58 Abs. 2 lit. f, g und i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Liability of senior managers

Datatilsynet attributed the intentional conduct of the company's management to the company.

Published

17 Aug 2026

Original amount 205,000 NOK, converted at the ECB reference rate of 12 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined Elkjøp Nordic AS and Elkjøp Norge AS NOK 20,000,000. Following an on-site inspection in June 2022, the authority found that consent for the customer club was neither informed nor specific nor freely given, that club data had been reused without a legal basis for the 'kundematch' (customer match) tool, that the lawfulness of so-called offline conversions had not been assessed and documented, and that rectification requests had not been handled within the deadlines. The decision was adopted under the cooperation mechanism with the supervisory authorities of Sweden, Iceland, Finland and Denmark; more than six million club members across the Nordic countries were affected.

Authority / court

Datatilsynet

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 i. V. m. Art. 4 Nr. 11, Art. 6 Abs. 4, Art. 5 Abs. 2 i. V. m. Art. 5 Abs. 1 lit. a, Art. 12 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Improvements made after the inspection, Datatilsynet's long case-handling time and the lack of evidence that sensitive data were processed; the amount is well below the starting point in the EDPB guidelines (0.4–0.8% of group turnover).

Published

4 Jun 2026

Original amount 20,000,000 NOK, converted at the ECB reference rate of 1 Jun 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the time-recording system provider Timegrip AS NOK 250,000 because, after a retail chain went bankrupt, the company refused 80 former employees access to their clock-in data, which they needed to document their wage claims. The authority treated Timegrip as controller, since after the bankruptcy the company alone in fact decided on storage, use and access, and found a breach of the right of access under Art. 15(1) and (3) GDPR. A fine of NOK 750,000 had been notified; the authority took into account, among other things, the confused situation and its own long case-handling time.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 15 Abs. 1 und 3, Art. 58 Abs. 2 lit. i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

The confused situation after the customer's bankruptcy (given only limited weight) and Datatilsynet's long case-handling time; NOK 750,000 had been notified.

Published

20 Jan 2026

Original amount 250,000 NOK, converted at the ECB reference rate of 16 Jan 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Following an inspection, Datatilsynet (Norwegian Data Protection Authority) fined Telenor ASA NOK 4,000,000 because the group parent had not put in place appropriate organisational measures and policies for the position of its data protection officer (Art. 24(1) and (2) GDPR). The authority also issued a reprimand because for about one year there was no reporting line from the data protection officer to the highest management level, and ordered the company to carry out a documented assessment of whether it must designate a data protection officer and to revise its record of processing activities. According to Datatilsynet, the decision has been appealed and a ruling by the Personvernnemnda (Privacy Appeals Board) is expected in autumn 2026. The decision is not final.

Authority / court

Datatilsynet

Area of law

Data protection

Legal basis

Art. 24 Abs. 1 und 2, Art. 30, Art. 37 Abs. 7, Art. 38 Abs. 2 und 3, Art. 58 Abs. 2 lit. b, d und i DSGVO; § 26 personopplysningsloven

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

No specific harm to data subjects was identified; the long case-handling time was taken into account when setting the amount.

Published

14 Mar 2025

Original amount 4,000,000 NOK, converted at the ECB reference rate of 10 Mar 2025.

Checked against the official source on 28 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined a US medical device manufacturer NOK 2,500,000 because it notified a cyber incident affecting the data of all its European employees (including one person in Norway) only 67 days after becoming aware of it instead of within 72 hours (Art. 33(1) GDPR). Under its internal rules, the manufacturer intended to notify only once the incident had been fully investigated. Following the company's appeal, the fine was reduced to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda (Privacy Appeals Board); the Personvernnemnda upheld the decision at that amount.

Authority / court

Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 33 Abs. 1, Art. 58 Abs. 2 lit. i, Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Reduction to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda.

Published

16 Mar 2023

Original amount 1,500,000 NOK, converted at the ECB reference rate of 8 Mar 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 8 Mar 2025 · Direct link