Datatilsynet (Norway) - 23/00435-62
Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and obstructing investigation.
Norway's Data Protection Authority (Datatilsynet) has fined Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired without a valid legal basis. The company also breached Article 31 GDPR by failing to cooperate with the DPA's investigation, obstructing it with threats and delays. The DPA ordered Lab Pharma AS to erase the data and cease unauthorized processing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Datatilsynet?
Get an email when a new story names Datatilsynet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLab Pharma AS failed to establish or maintain a valid legal basis for processing an influencer's personal data once their contractual relationship ended, a foundational GDPR requirement. This breach demonstrates a lack of data lifecycle management controls — organisations must ensure personal data is erased or anonymised when the original purpose for processing no longer exists. Compounding the violation, the company obstructed Datatilsynet's investigation through threats and delays, breaching the GDPR's cooperation obligation under Article 31. This behaviour escalated regulatory risk significantly, as non-cooperation with supervisory authorities is treated as a serious aggravating factor in enforcement decisions. The case serves as a stark reminder that both data handling practices and organisational conduct during investigations are subject to GDPR scrutiny.