Lab Pharma AS – €17,835 Fine (Norway, 2026)

Lab Pharma AS, the controller, is a Norwegian manufacturer of dietary supplements which markets and sells its products online. In 2016, an influencer, the data subject, entered into an agreement with the controller under which she would promote its products on her blog and social media profiles. The agreement also allowed the controller to use excerpts of her posts, including images, audio and text, in its own marketing. After the agreement had expired, the controller continued using the data subject’s name, photographs and comments about its products on its websites. In February 2023, the data subject requested the erasure of her personal data under Article 17 GDPR. The controller rejected the request, claiming that the agreement entitled it to continue using the data and stating that it would not respond to further inquiries. The data subject lodged a complaint with the DPA arguing that the controller lacked a legal basis for the processing and requesting the erasure of her personal data. In July 2024, the DPA initiated an investigation and ordered the controller to provide information concerning the processing. The controller challenged the DPA’s competence and refused to provide the agreement underlying the processing, arguing that it was confidential. The Privacy Appeals Board subsequently upheld the DPA’s information order. During the investigation, the controller repeatedly delayed providing requested information and documentation and its CEO sent numerous communications seeking to have the investigation discontinued, including threats of legal action and police reports against DPA employees. The DPA held that the controller processed the data subject’s personal data without a valid legal basis under Article 6(1) GDPR and failed to comply with its obligations under Articles 17, 21 and 31 GDPR. Regarding Article 6(1)(b) GDPR, the DPA rejected the controller’s argument that the processing remained necessary for the performance of the agreement. The agreement