- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Miljø- og Kvalitetsledelse AS – €3,045 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Miljø- og Kvalitetsledelse AS, a car wash company in Norway, was fined for sharing CCTV footage of a vandalism incident with the perpetrator's employer without consent. This action violated data protection rules because the company did not have a valid reason to disclose the footage. The fine serves as a reminder for businesses to handle personal data carefully and respect privacy.
What happened
The company disclosed CCTV footage of a vandalism incident to the perpetrator's employer without the individual's consent.
Who was affected
The individual whose footage was shared, the vandal, was affected by this unauthorized disclosure.
What the authority found
The Norwegian data protection authority found that the company lacked a legal basis for sharing the footage, violating GDPR's requirements.
Why this matters
This ruling highlights the importance of obtaining consent before sharing personal data. Companies must ensure they have a valid reason for any data disclosures to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 15 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The company Miljø- og Kvalitetsledelse operates a car wash facility, where a payment terminal was vandalised. Since the company had CCTV/camera surveillance, they were able to determine who the culprit was and, consequently, reported the incident to the police (and also to the culprit/data subject himself). However, the company went on to disclose the footage to the data subject's employer, as they considered him to be "out of balance" because the data subject had also contacted a lawyer. The data subject was not notified of, nor consented to this disclosure. The DPA held that the company lacked legal basis for the disclosure to the data subjects's employer and was therefore in violation of Articles 5(1)(a) and 6(1) GDPR. The recordings had already been handed over to the police and the further disclosure to the data subject’s employer was unnecessary for the (legitimate) purpose of preventing vandalism or resolving the case.
Related Enforcement Actions (1)
Other enforcement actions involving Miljø- og Kvalitetsledelse AS in NO
Details
Fine Date
17 March 2021
Authority
Datatilsynet (Norway)
Fine Amount
€3,045
35,000 NOK
GDPRhub ID
gdprhub-3503About this data
Cite as: Cookie Fines. Miljø- og Kvalitetsledelse AS - Norway (2021). Retrieved from cookiefines.eu
Last updated: