The Norwegian SA imposes fine against Elektro & Automasjon Systemer AS

13 December 2021

Background information

  • Date of final decision: 13 December 2021
  • Cross-border case or national Case: National case
  • Controller: Elektro & Automasjon Systemer AS
  • Legal Reference: Legal basis (Article 6)
  • Decision: Infringement of the GDPR declared and fine imposed, order to establish procedures
  • Key words: Credit rating

 

Summary of the Decision

 
Origin of the case

Elektro & Automasjon Systemer AS (EAS) performed a credit rating on a part-owner in another company without any collaboration, customer relationship or other connection to EAS as a basis for the credit rating.

EAS has emphasized that the credit rating was accidental, and the company agrees that it had no relation to complainant that would justify the credit rating in this case.

 
Key Findings

A credit rating is the result of a compilation of personal data from many different sources and shows the likelihood of a person being able to pay an outstanding claim. A credit rating will also reveal details about the person’s financial status, such as any overdue payments/defaults on loans, mortgages and debt-to-income ratio.

The General Data Protection Regulation requires all processing of personal data to have a legal basis. The Norwegian Supervisory Authority (SA) found that EAS performed a credit rating on a private individual without any legal basis.

 
Decision

The Norwegian SA has fined EAS EUR 20,000 for performing a credit rating on a private individual without any legal basis. EAS was also ordered to establish procedures for performing credit ratings, to prevent further unlawful credit ratings in the future.

 

For further information:

 

The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.