On 6 January 2021, the Norwegian DPA (“Datatilsynet”) announced its decision to fine a company in the e-commerce sector with approx. EUR 9,550 for conducting credit ratings without an appropriate legal basis for processing.
Datatilsynet concluded that credit information about a sole proprietorship represents personal information considering that in these circumstances, the owner’s personal finances are identified. In addition, the DPA found that the said credit assessments had been conducted for private purposes completely outside the business’s business area, and consequently, without complying with the legal basis requirement.
The press release is available here (only in Norwegian).
