Datatilsynet (Norway) - 23/00435-62
Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and non-cooperation.
Norway's Data Protection Authority (Datatilsynet) fined pharmaceutical company Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired without a valid legal basis. The company also failed to cooperate with the DPA's investigation, leading to additional penalties.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Datatilsynet?
Get an email when a new story names Datatilsynet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLab Pharma AS continued to process an influencer's personal data after their contractual relationship ended, without establishing a valid legal basis under GDPR — a fundamental violation of the data minimisation and purpose limitation principles. This case highlights how organisations frequently overlook data lifecycle management, failing to implement processes that automatically restrict or delete personal data when its legal justification lapses. Compounding the violation, the company's non-cooperation with the Datatilsynet investigation resulted in additional penalties, demonstrating that regulatory obstruction carries its own serious consequences. For any organisation using influencer or third-party marketing contracts, the expiry of an agreement must trigger immediate data governance actions, not passive inaction.