The Norwegian Data Protection Authority has fined Innovation Norway EUR 100,000 (NOK 1,000,000). The matter concerns a credit rating without a legal basis for processing.
“Innovation Norway has been unable to demonstrate a customer relationship or connection with the complainant and their enterprise, to justify these credit ratings,” says Data Protection Authority Director Bjørn Erik Thon.
The fine amount has not changed since the Authority’s first notice in this case.
Valid legal basis for processing required
A credit rating is a compilation of personal data from many different sources and shows the likelihood of a person or enterprise being able or willing to pay an outstanding claim. A credit rating will also reveal details about the enterprise’s financial status, such as any payment remarks, its debt-to-income ratio and whether the enterprise has any mortgages.
Credit information about a sole proprietorship also constitutes personal data, as the owner is immediately identified with the enterprise, and the enterprise is directly linked to the owner’s personal finances. This means that a valid legal basis is required to subject sole proprietorships to a credit rating.
Perceived as invasive
“Credit information about a sole proprietorship also speaks to the owner’s personal finances. This is private information, which cannot be accessed by others unless there is a legitimate reason for it,” says Bjørn Erik Thon.
“We can understand the complainant’s reaction when they have been subjected to credit ratings several times, and also that this could be perceived as invasive. We take these matters seriously, and normally issue fines for this type of violation,” says Bjørn Erik Thon.
For further information, please contact the Norwegian DPA: international@datatilsynet.no
The original press release is available in Norwegian here
The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.