Pharma Company Fined for Retaining Influencer Data Beyond Contract Expiry
Written by AI from the linked story. Not reviewed by an editor. How this works
Lab Pharma AS continued to process an influencer's personal data after their contractual relationship ended, without establishing a valid legal basis under GDPR — a fundamental violation of the data minimisation and purpose limitation principles. This case highlights how organisations frequently overlook data lifecycle management, failing to implement processes that automatically restrict or delete personal data when its legal justification lapses. Compounding the violation, the company's non-cooperation with the Datatilsynet investigation resulted in additional penalties, demonstrating that regulatory obstruction carries its own serious consequences. For any organisation using influencer or third-party marketing contracts, the expiry of an agreement must trigger immediate data governance actions, not passive inaction.
Tactical Insight
Immediate actions
- Audit all active and recently expired contracts to identify personal data still being processed without a valid legal basis.
- Implement a data deletion or anonymisation workflow triggered automatically upon contract expiry.
Long-term improvements
- Establish a data retention schedule aligned to contractual and legal obligations, reviewed at least annually.
- Train marketing and legal teams on GDPR lawful basis requirements, particularly for influencer and third-party partnerships.
- Integrate contract management systems with data inventory tools so data subjects are flagged when their processing justification expires.
Regulatory cooperation measures
- Designate a DPA liaison responsible for coordinating timely, complete responses to regulatory investigations.
- Document all data processing activities in a Records of Processing Activities (RoPA) register to facilitate rapid evidence submission during audits.