Enforcement · Norwegian Supervisory Authority (Datatilsynet) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
NORWAY DPA: Insufficient legal basis for data processing
The Norwegian DPA (Datatilsynet) fined a company NOK 250,000 (EUR 24,400).
Full text
The Norwegian DPA (Datatilsynet) fined a company NOK 250,000 (EUR 24,400). The controller ordered an employee to set up an automatic forwarding of his/her employee email account to a shared company account. The reason given for this was to improve the company's operations. The DPA found that the controller had no legal basis to order such automatic forwarding. It therefore acted unlawfully.
Industry: Employment
How it connects
Related across sources
Guidelines 8/2022 identifying a controller or processor's lead supervisory authority Guidelines for identifying a controller or processor’s lead supervisory authority Guidelines ·EDPB Apr 17, 2023 Supervision Controllers Supervisory Authorities
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
Opinion 22/2023 Controller Binding Corporate Rules for employee data of the UPS Group ·Opinion ·EDPB Nov 16, 2023 International Transfer Codes of Conduct Controllers
Opinion 12/2025 ASML Group Adopted on — controller BCRs EDPB, Opinion 12/2025 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the ASML Group Adopted on, 2025. ·Opinion ·EDPB Jun 6, 2025 International Transfer Codes of Conduct Controllers
Opinion 01/2019 draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 01 /201 9 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the… Opinion ·EDPB Jan 23, 2019 DPIA Supervision Supervisory Authorities