The Norwegian Supervisory Authority has fined the Norwegian Labour Inspection Authority

Background information

• Date of final decision: 16 May 2022       
• Cross-border case or national case: National
• Controller: The Norwegian Labour Inspection Authority (Arbeidstilsynet)            
• Legal Reference: Lawfulness of processing (Art 6), Right of access by the data subject (Art. 15)
• Decision: Infringement of the GDPR and fine imposed, Reprimand
• Key words: Credit rating

Summary of the Decision

Origin of the case

The background for this case is a complaint from the owner of a sole proprietorship (ENK), who was providing services to another enterprise, including assistance with a so-called postal inspection by the Labour Inspection Authority (request for information). Some days after the complainant had contacted the Labour Inspection Authority in this regard, he received a notice informing him that his ENK had been the subject of a credit rating by the Labour Inspection Authority.

This credit rating had been performed because the complainant’s ENK had assisted and sold services to a company the Labour Inspection Authority was monitoring and wanted to investigate further.

Key Findings

The Norwegian Supervisory Authority, SA concluded that the complainant was not “subject to inspection”. The Norwegian SA therefore found that Section 18-5 of the Norwegian Working Environment Act, does not apply and concluded that the Labour Inspection Authority had no basis for performing a credit rating.

Further, credit ratings in cases like this collect personal data from a third party. According to Article 15 of the General Data Protection Regulation, a data subject has the right to confirmation as to whether or not personal data concerning them are being processed. In this case, however, the complainant did not receive any confirmation as to whether or not a credit rating had been performed in his subsequent communication with the Labour Inspection Authority. The Norwegian Supervisory Authority therefore concluded that a violation has taken place.

Decision

The Norwegian Supervisory Authority has fined the Norwegian Labour Inspection Authority EUR 15.000 (NOK 150,000) for performing an unwarranted credit rating on a private individual. The Labour Inspection Authority is also reprimanded for lack of disclosure.

For further information:

• Labour Inspection Authority fined (EN), Datatilsynet, Norwegian SA
• Gebyr til Arbeidstilsynet (NO), Datatilsynet, Norwegian SA