- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Norwegian State Pension Fund (SPK) – €98,000 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Norwegian State Pension Fund, also known as SPK, was fined for unlawfully collecting personal data. They gathered unnecessary income information related to disability pensions, affecting around 24,000 individuals. This case serves as a reminder for organizations to ensure they only collect essential data.
What happened
SPK unlawfully collected unnecessary health-related information about disability pensions since 2016.
Who was affected
About 24,000 individuals whose personal data was collected by SPK were affected.
What the authority found
The Norwegian Data Protection Authority found that SPK violated GDPR by failing to implement proper data review and deletion routines.
Why this matters
This case highlights the need for organizations to have clear data management practices. Companies should ensure they only collect data that is necessary for their operations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 10 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Norwegian DPA has imposed a fine of EUR 98,000 on the Norwegian State Pension Fund (SPK). The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The DPA found that the controller had unlawfully collected certain income information since 2016. For example, the controller had collected health-related information on disability pensions, although this was not required. Approximately 24,000 individuals were affected by these incidents. In addition, the DPA found that SPK did not implement routines to review and delete excessive information collected until 2019.
Related Enforcement Actions (0)
No other enforcement actions found for Norwegian State Pension Fund (SPK) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
24 November 2021
Authority
Datatilsynet (Norway)
Fine Amount
€98,000
About this data
Cite as: Cookie Fines. Norwegian State Pension Fund (SPK) - Norway (2021). Retrieved from cookiefines.eu
Last updated: