Norsk Helseinformatikk AS – Violation Found (Norway, 2025)

Following media reports about online tracking, the DPA started several ex officio investigations over the use of tracking tools on websites. Among others, the DPA investigated www.nhi.no, a website providing information about medical topics. The website included many subpages providing information on specific health conditions. The website was published by the company Norsk Helseinformatikk AS (the controller). The investigation found that the website presented visitors with a cookie banner provided by the cookie management platform Cookiebot. The banner offered visitors three options: “Only necessary cookies”, “Customize”, and “Allow all cookies”. The “Only necessary cookies” button was somewhat visible but featured less prominent colors than the others. The investigation found that the website implemented the Meta pixel. The Meta pixel is not a cookie and is not stored client-side. The pixel tracked information about actions taken by the user on the website and shared it with Meta. In addition, the pixel stored a tracking cookie (-fbp) on the users’ browser. The website implemented the pixel on both the home page and subpages, which made it possible to track an individual user’s journey through the website. The website forwarded other information to Meta, including IP addresses, fingerprints for the user’s device, and the unique identifier from the _fbp cookie. The investigation found that the controller implemented other trackers. However, the DPA decided to limit the scope of the proceedings to the use of the Meta pixel. The DPA held that the controller unlawfully processed sensitive data via the Meta pixel, in violation of Articles 6 and 9 GDPR. The DPA held that Norsk Helseinformatikk was only a controller for the initial data processing via the pixel. So, the DPA did not examine the subsequent processing of these data after their disclosure to Meta. The DPA issued a warning against the controller. The DPA clarified that an injunction to remove the pixel was not needed, as the controller already did so during the procedure. The DPA did, however, order the controller to collect explicit consent to the processing of sensitive data, should it implement the pixel again in the future. = The DPA held that the data forwarded by the Meta pixel could identify a data subject when combined with the other information forwarded to Meta by the website. For this reason, the DPA held that the controller processed personal data via the pixel. The controller did not challenge the conclusion. = The Meta pixel tracked visits to individual subpages. The DPA observed that this made it possible to infer information about the health status of individual users: if a user visited pages about a specific health condition, it was likely that they suffered from it. On this basis, the DPA preliminarily held that the pixel processed sensitive data. During the procedure the controller challenged this conclusion based on a restrictive reading of CJEU case law on sensitive data. The DPA rejected NHI’s arguments and stated that CJEU case law set a low threshold for what is to be considered sensitive data. In particular, the DPA clarified that for data to be sensitive according to CJEU case lawCJEU, cases C-184/20, Vyriausioji tarnybinės etikos komisija; C-252/21, Bundeskartellamt, 4 July 2023; C-21/23, Lindenapotheke, 4 November 2024., there was no requirement: * for information to be directly linked to a person’s health condition; * for information to allow for accurate inferences (because inaccurate personal data are nonetheless protected by the GDPR); * for information to be linked with additional information, in order to infer sensitive data more reliably (which Meta could do but NHI could not). For these reasons, the DPA confirmed that the controller processed personal and sensitive data by implementing the Meta pixel on its website. = The DPA clarified that the Meta pixel processed personal data exclusively for advertising purposes. The DPA also stated that the data subject’s consent was the only legal basis for processing sensitive data for advertising purposes. In this regard, the DPA clarified that legitimate interest would generally not be a valid legal ground, as data subjects’ rights to the protection of their sensitive data will typically outweigh a data controller’s interest in advertisingThe DPA based this conclusion entirely on Article 6(1)(f) GDPR and the requirement for legitimate interest to be balanced against the rights and freedoms of data subjects. The DPA did not rule Article 6(1)(f) out based on the consent requirements of the Electronic Communications Act, which the DPA did not enforce in the case at hand (and was not competent to enforce at the time, as the DPA itself pointed out in the motivation).. For these reasons, the DPA examined whether the controller collected valid consent from visitors in light of the requirements of the GDPR. In this regard, the DPA decided to limit its investigation to two specific requirements for valid consent under Article 4(11): “freely given” and “informed”. The DPA found that neither requirement was fulfilled and held that sensitive data were processed without consent. == The DPA observed that the less prominent color of the “Only necessary cookies” button on the cookie banner, amounted to a dark pattern and nudged users towards accepting non-necessary cookies and trackers from the website. For this reason, the DPA held that the users’ consent was not freely given. Contrary to the controller’s arguments, it did not matter that all the buttons were clearly visible. In the DPA’s view, the more prominent color scheme of the “Accept all cookies” option was sufficient to nudge users towards accepting unnecessary trackers. In this regard, the DPA pointed out that there was no real reason to implement different levels of color contrast for different buttons, aside from manipulating user behavior. == The DPA considered that the website’s privacy policy explicitly stated that the website would not process sensitive data. The DPA pointed out that the statement was erroneous and, therefore, did not inform users that their sensitive data would be processed. For this reason, the DPA held that users’ consent was uninformed.