Datatilsynet (Norway) - 23/00435-62
Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and non-cooperation.
Norway's Data Protection Authority (Datatilsynet) has fined pharmaceutical company Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired. The company also breached its duty to cooperate with the DPA during the investigation, refusing to provide requested information and even making threats against DPA employees. The influencer had requested erasure of her data under Article 17 GDPR, which Lab Pharma AS rejected.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Datatilsynet?
Get an email when a new story names Datatilsynet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLab Pharma AS continued to process an influencer's personal data beyond the contractual period and refused to honour a valid Article 17 GDPR erasure request, representing a fundamental failure in data lifecycle management. Compounding the violation, the company refused to cooperate with Norway's Datatilsynet and reportedly threatened DPA employees, escalating a compliance failure into active obstruction of a regulatory investigation. This case illustrates that data subjects' rights are legally enforceable obligations, not optional courtesies, and that non-cooperation with supervisory authorities carries its own significant penalties. Organizations must have clear, documented processes for managing personal data tied to third-party contracts and for responding lawfully to data subject requests within statutory timeframes.