Norwegian State Pension Fund (SPK) – €98,000 Fine (Norway, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Norway's Datatilsynet fined the Norwegian State Pension Fund EUR 98,000 for collecting unnecessary personal data. They gathered health information on disability pensions without needing it and failed to delete excess data. This affects how organizations should handle personal data responsibly.
What happened
The Norwegian State Pension Fund collected unnecessary income and health-related information from individuals since 2016.
Who was affected
Around 24,000 individuals whose income and health-related data were collected without proper justification.
What the authority found
The Norwegian DPA found that the Pension Fund unlawfully collected personal data and failed to delete excess information, violating GDPR rules.
Why this matters
This case highlights the importance of collecting only necessary personal data and maintaining proper data deletion practices. Organizations should ensure they have clear processes for data handling to avoid similar fines.
GDPR Articles Cited
The Norwegian DPA has imposed a fine of EUR 98,000 on the Norwegian State Pension Fund (SPK). The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The DPA found that the controller had unlawfully collected certain income information since 2016. For example, the controller had collected health-related information on disability pensions, although this was not required. Approximately 24,000 individuals were affected by these incidents. In addition, the DPA found that SPK did not implement routines to review and delete excessive information collected until 2019.
Related Enforcement Actions (0)
No other enforcement actions found for Norwegian State Pension Fund (SPK) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
24 November 2021
Authority
Datatilsynet (Norway)
Fine Amount
€98,000
Enforcement Tracker ID
ETid-948
About this data
Cite as: Cookie Fines. Norwegian State Pension Fund (SPK) - Norway (2021). Retrieved from cookiefines.eu
Last updated: