[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLHDyS50YByHRaMwIm_Mj9hDOXAmM3y20C-orCV9KiEo":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"0c966d10-a1f5-4806-9b6d-684cc8d3db61","Datatilsynet (Norway) - 23\u002F00435-62","datatilsynet-norway-23-00435-62-80ab69","Created page with \"{{DPAdecisionBOX |Jurisdiction=Norway |DPA-BG-Color= |DPAlogo=LogoNO.png |DPA_Abbrevation=Datatilsynet |DPA_With_Country=Datatilsynet (Norway) |Case_Number_Name=23\u002F00435-62 |ECLI= |Original_Source_Name_1=Datatilsynet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.no\u002Fcontentassets\u002F8c9c5cceb6d14481ad668d222035cf83\u002F2026-08-12-vedtak---lab-pharma-offentlig.pdf |Original_Source_Language_1=Norwegian |Original_Source_Language__Code_1=NO |Original_Source_Name_2= |Origina...\" New page {{DPAdecisionBOX |Jurisdiction=Norway |DPA-BG-Color= |DPAlogo=LogoNO.png |DPA_Abbrevation=Datatilsynet |DPA_With_Country=Datatilsynet (Norway) |Case_Number_Name=23\u002F00435-62 |ECLI= |Original_Source_Name_1=Datatilsynet |Original_Source_Link_1=https:\u002F\u002Fwww.datatilsynet.no\u002Fcontentassets\u002F8c9c5cceb6d14481ad668d222035cf83\u002F2026-08-12-vedtak---lab-pharma-offentlig.pdf |Original_Source_Language_1=Norwegian |Original_Source_Language__Code_1=NO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started=02.02.2023 |Date_Decided=12.08.2026 |Date_Published= |Year=2026 |Fine=205000.0 |Currency=NOK |GDPR_Article_1=Article 6(1)(b) GDPR |GDPR_Article_Link_1=Article 6 GDPR#1b |GDPR_Article_2=Article 6(1)(f) GDPR |GDPR_Article_Link_2=Article 6 GDPR#1f |GDPR_Article_3=Article 17 GDPR |GDPR_Article_Link_3=Article 17 GDPR |GDPR_Article_4=Article 21 GDPR |GDPR_Article_Link_4=Article 21 GDPR |GDPR_Article_5=Article 31 GDPR |GDPR_Article_Link_5=Article 31 GDPR |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Lab Pharma AS |Party_Link_1=https:\u002F\u002Fwww.labpharma.no\u002F |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=bms | }} The DPA found that pharmaceutical company unlawfully continued using an influencer’s personal data after their contract expired and fined it NOK 205,000 for breaching its duty to cooperate under [[Article 31 GDPR|Article 31 GDPR]]. == English Summary == === Facts === Lab Pharma AS, the controller, is a Norwegian manufacturer of dietary supplements which markets and sells its products online. In 2016, an influencer, the data subject, entered into an agreement with the controller under which she would promote its products on her blog and social media profiles. The agreement also allowed the controller to use excerpts of her posts, including images, audio and text, in its own marketing. After the agreement had expired, the controller continued using the data subject’s name, photographs and comments about its products on its websites. In February 2023, the data subject requested the erasure of her personal data under [[Article 17 GDPR|Article 17 GDPR]]. The controller rejected the request, claiming that the agreement entitled it to continue using the data and stating that it would not respond to further inquiries. The data subject lodged a complaint with the DPA arguing that the controller lacked a legal basis for the processing and requesting the erasure of her personal data. In July 2024, the DPA initiated an investigation and ordered the controller to provide information concerning the processing. The controller challenged the DPA’s competence and refused to provide the agreement underlying the processing, arguing that it was confidential. The Privacy Appeals Board subsequently upheld the DPA’s information order. During the investigation, the controller repeatedly delayed providing requested information and documentation and its CEO sent numerous communications seeking to have the investigation discontinued, including threats of legal action and police reports against DPA employees. === Holding === The DPA held that the controller processed the data subject’s personal data without a valid legal basis under [[Article 6 GDPR|Article 6(1) GDPR]] and failed to comply with its obligations under Articles 17, 21 and 31 GDPR. Regarding [[Article 6 GDPR|Article 6(1)(b) GDPR]], the DPA rejected the controller’s argument that the processing remained necessary for the performance of the agreement. The agreement expressly had a duration of one year and expired in March 2017. Nothing in its wording established that the controller could continue using the data subject’s personal data after its expiry. Consequently, [[Article 6 GDPR|Article 6(1)(b) GDPR]] could no longer provide a legal basis for the processing. The controller also relied on legitimate interests under [[Article 6 GDPR|Article 6(1)(f) GDPR]]. The DPA noted that the fact that personal data had previously been made publicly available did not remove the requirement for a legal basis. Moreover, the data subject’s request to stop the processing constituted an objection under [[Article 21 GDPR|Article 21(1) GDPR]]. Since the controller failed to demonstrate compelling legitimate grounds overriding the data subject’s interests, it was required to cease the processing. As the processing was unlawful, the controller was also required under [[Article 17 GDPR|Article 17 GDPR]] to erase the personal data without undue delay. The DPA therefore ordered the controller to delete the data subject’s personal data from all websites it operated and to cease using her personal data for marketing purposes unless it obtained a lawful basis for doing so. Regarding [[Article 31 GDPR|Article 31 GDPR]], the DPA held that the duty to cooperate requires controllers to facilitate supervisory investigations and comply with lawful information requests and deadlines. Attempts to delay or halt an investigation may breach [[Article 31 GDPR|Article 31 GDPR]] even where the supervisory authority is ultimately able to complete its investigation. The controller had intentionally attempted to obstruct the investigation through threats and pressure on DPA employees and had also negligently failed to comply with several deadlines for providing requested documentation. The DPA considered these circumstances sufficiently serious to warrant an administrative fine and imposed a fine of NOK 205,000 for the infringement of [[Article 31 GDPR|Article 31 GDPR]]. The decision cannot be appealed to the Privacy Appeals Board but may be challenged before the Oslo District Court. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.","Norway's Data Protection Authority (Datatilsynet) has fined Lab Pharma AS NOK 205,000 for continuing to use an influencer's personal data after their contract expired without a valid legal basis. The company also breached Article 31 GDPR by failing to cooperate with the DPA's investigation, obstructing it with threats and delays. The DPA ordered Lab Pharma AS to erase the data and cease unauthorized processing.","Norway's Datatilsynet fines Lab Pharma AS NOK 205,000 for unlawful data use and obstructing investigation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_23\u002F00435-62&diff=52749&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-08-21T12:34:00+00:00","2026-08-21T14:00:15.462815+00:00",7,[17,20],{"name":18,"type":19},"Datatilsynet","vendor",{"name":21,"type":22},"Lab Pharma AS","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"lab-pharma-fined-for-retaining-influencer-data-after-contract-expiry-and-obstructing-dpa-investigati","Lab Pharma Fined for Retaining Influencer Data After Contract Expiry and Obstructing DPA Investigation","Lab Pharma AS failed to establish or maintain a valid legal basis for processing an influencer's personal data once their contractual relationship ended, a foundational GDPR requirement. This breach demonstrates a lack of data lifecycle management controls — organisations must ensure personal data is erased or anonymised when the original purpose for processing no longer exists. Compounding the violation, the company obstructed Datatilsynet's investigation through threats and delays, breaching the GDPR's cooperation obligation under Article 31. This behaviour escalated regulatory risk significantly, as non-cooperation with supervisory authorities is treated as a serious aggravating factor in enforcement decisions. The case serves as a stark reminder that both data handling practices and organisational conduct during investigations are subject to GDPR scrutiny.",[56,57,58,59,60,61,62,63,64],"GDPR Article 5(1)(e) – Storage Limitation Principle","GDPR Article 6 – Lawfulness of Processing","GDPR Article 17 – Right to Erasure","GDPR Article 31 – Cooperation with Supervisory Authority","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 PM-25 – Minimization of Personally Identifiable Information","CIS Control 3 – Data Protection (Data Retention and Disposal)","ISO\u002FIEC 27001:2022 Annex A 5.33 – Protection of Records","ITIL Service Value Chain – Engage (Stakeholder\u002FRegulatory Communication)",{}]