[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3z8VIuuUfIoy9lDhcN4BNzDgGQfPUbd0vIxomeJ5DIA":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"129d3558-8a0a-4598-9147-16bbbe2272ea","Datatilsynet (Norway) - 23\u002F00435-62","datatilsynet-norway-23-00435-62-34df75","Show changes","Norway's Data Protection Authority (Datatilsynet) has fined pharmaceutical company Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired. The company also breached its duty to cooperate with the DPA during the investigation, refusing to provide requested information and even making threats against DPA employees. The influencer had requested erasure of her data under Article 17 GDPR, which Lab Pharma AS rejected.","Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and non-cooperation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_23\u002F00435-62&diff=52754&oldid=52749","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-08-21T13:54:44+00:00","2026-08-21T14:00:15.462815+00:00",7,[17,20],{"name":18,"type":19},"Datatilsynet","vendor",{"name":21,"type":22},"Lab Pharma AS","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"pharma-company-fined-for-ignoring-gdpr-erasure-rights-and-obstructing-dpa-investigation","Pharma Company Fined for Ignoring GDPR Erasure Rights and Obstructing DPA Investigation","Lab Pharma AS continued to process an influencer's personal data beyond the contractual period and refused to honour a valid Article 17 GDPR erasure request, representing a fundamental failure in data lifecycle management. Compounding the violation, the company refused to cooperate with Norway's Datatilsynet and reportedly threatened DPA employees, escalating a compliance failure into active obstruction of a regulatory investigation. This case illustrates that data subjects' rights are legally enforceable obligations, not optional courtesies, and that non-cooperation with supervisory authorities carries its own significant penalties. Organizations must have clear, documented processes for managing personal data tied to third-party contracts and for responding lawfully to data subject requests within statutory timeframes.",[56,57,58,59,60,61,62,63,64],"GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 31 – Cooperation with the supervisory authority","GDPR Article 5(1)(e) – Storage limitation principle","GDPR Article 58 – Powers of the supervisory authority","NIST Privacy Framework PR.DS-P4 – Data retention and disposal","NIST SP 800-53 IP-3 – Redress (individual rights management)","CIS Control 3 – Data Protection (data retention and disposal)","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL Service Management – Supplier and contract lifecycle management",{}]