[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7JmcXqPzoq1zGhzTpXVlbcQkUiICrCr52QioTbU3mkc":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"051f9940-5210-49db-82ae-a8abc5e6f1e1","Datatilsynet (Norway) - 23\u002F00435-62","datatilsynet-norway-23-00435-62-6f4335","← Older revision Revision as of 10:39, 26 August 2026 Line 100: Line 100: }} }} The DPA found that pharmaceutical company unlawfully continued using an influencer’s personal data after their contract expired and fined it NOK 205,000 for breaching its duty to cooperate under [[Article 31 GDPR]]. The DPA found that a pharmaceutical company unlawfully continued to use an influencer’s personal data after their promotional cooperation ended. Also, the DPA fined the company NOK 205,000 (€18,825.20) for breaching its duty to cooperate under [[Article 31 GDPR]]. == English Summary == == English Summary ==","Norway's Data Protection Authority (Datatilsynet) fined pharmaceutical company Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired without a valid legal basis. The company also failed to cooperate with the DPA's investigation, leading to additional penalties.","Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and non-cooperation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_23\u002F00435-62&diff=52804&oldid=52754","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-08-26T10:39:40+00:00","2026-08-26T12:00:30.416979+00:00",7,[17,20],{"name":18,"type":19},"Datatilsynet","vendor",{"name":21,"type":22},"Lab Pharma AS","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":62},"pharma-company-fined-for-retaining-influencer-data-beyond-contract-expiry","Pharma Company Fined for Retaining Influencer Data Beyond Contract Expiry","Lab Pharma AS continued to process an influencer's personal data after their contractual relationship ended, without establishing a valid legal basis under GDPR — a fundamental violation of the data minimisation and purpose limitation principles. This case highlights how organisations frequently overlook data lifecycle management, failing to implement processes that automatically restrict or delete personal data when its legal justification lapses. Compounding the violation, the company's non-cooperation with the Datatilsynet investigation resulted in additional penalties, demonstrating that regulatory obstruction carries its own serious consequences. For any organisation using influencer or third-party marketing contracts, the expiry of an agreement must trigger immediate data governance actions, not passive inaction.",[54,55,56,57,58,59,60,61],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 5(1)(e) – Storage Limitation","GDPR Article 6 – Lawfulness of Processing","GDPR Article 31 – Cooperation with Supervisory Authority","NIST Privacy Framework PR.DS-P4 – Data Retention and Disposal","CIS Control 3 – Data Protection","ISO\u002FIEC 27001 Annex A.8.10 – Information Deletion","ITIL Service Management – Service Transition \u002F Data Lifecycle Management",{}]