# Miljø- og Kvalitetsledelse AS: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Norwegian Supervisory Authority (Datatilsynet)
- Date: 2021-04-09
- Original: https://www.enforcementtracker.com/ETid-628
- Canonical: https://overview.legal/posts/46743
- Topics: Controllers, Processing Agreement, Monitoring, Processing, Supervisory Authorities, Supervision, Law Enforcement, Data Controller

## Summary

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 3,400 on Miljø- og Kvalitetsledelse AS. At one of the carwashes operated by the controller, incidents of vandalism had occurred at the payment terminal. The controller thereupon sent footage of the incident from a surveillance camera to the employer of the alleged vandal. The Norwegian DPA concluded that the sharing of the video footage had taken place without a legal basis and the controller had thus violated Art. 6 (1) GDPR and Art. 5

## Full text

The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 3,400 on Miljø- og Kvalitetsledelse AS. At one of the carwashes operated by the controller, incidents of vandalism had occurred at the payment terminal. The controller thereupon sent footage of the incident from a surveillance camera to the employer of the alleged vandal. The Norwegian DPA concluded that the sharing of the video footage had taken place without a legal basis and the controller had thus violated Art. 6 (1) GDPR and Art. 5 (1) a) GDPR. Furthermore, the DPA emphasizes that the disclosure of the recordings was not necessary to clarify the incident, as the recordings had already been provided to the police.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/46743 · 2026-08-22