Datatilsynet (Norway) - 23/00435-62

The DPA found that pharmaceutical company unlawfully continued using an influencer’s personal data after their contract expired and fined it NOK 205,000 for breaching its duty to cooperate under Article 31 GDPR. English Summary. Facts. Lab Pharma AS, the controller, is a Norwegian manufacturer of dietary supplements which markets and sells its products online. In 2016, an influencer, the data subject, entered into an agreement with the controller under which she would promote its products on her blog and social media profiles. The agreement also allowed the controller to use excerpts of her posts, including images, audio and text, in its own marketing. After the agreement had expired, the controller continued using the data subject’s name, photographs and comments about its products on its websites. In February 2023, the data subject requested the erasure of her personal data under Article 17 GDPR. The controller rejected the request, claiming that the agreement entitled it to continue