- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 20/02058 - Smittestopp – Violation Found (Norway, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Norway's data protection authority found that the Smittestopp app, designed to track COVID-19, had serious privacy issues. This is crucial because it shows that even during a pandemic, user privacy must be respected. The authority noted that the app did not adequately protect personal data and lacked proper consent mechanisms.
What happened
The authority ruled that the Smittestopp app violated privacy rules by not properly analyzing risks and using personal data.
Who was affected
The users of the Smittestopp app, who had their location and contact data tracked, were affected.
What the authority found
The authority determined that the app's data processing methods were not compliant with GDPR's principles of data minimization and user consent.
Why this matters
This ruling serves as a warning that privacy protections cannot be overlooked, even in emergency situations. Companies developing apps should prioritize user privacy and ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The temporary ban has its background from Datatilsynet’s decision to control the tracking app “Smittestopp”. Datatilsynet commented earlier on a lacking analysis of the risks and vulnerabilities connected to the use of the app. Datatilsynet decided to evaluate the app after receiving answers by the Institute of Public Health to an order of information connected to questions regarding the usefulness of the app, and if the interference to users privacy was proportional. Unlike many other apps, Smittestopp use location data (to track movement) in addition to Bluetooth (to track whom the users’ were in contact with). The personal data is first stored locally, but approximately once an hour it is sent to an Azure server located in Ireland. The app would try to send the data for seven days provided it did not manage to connect to the server. The data was stored centrally for a maximum of 30 days. It was later planned that the data should be stored for a maximum of ten days. The personal data uploaded was used for two purposes, tracking and limiting the spread of covid-19, as well as being used for research and analysis on aggregated and anonymised data. Notification of covid-19 infections were only implemented in three (test) municipalities. A way to analyse, aggregate and anonymise the data was not in place at the time of the decision. The users could not choose to share the data for one or both purposes. The question for Datatilsynet was if the way the app was implemented and processed data was in line with the legal requirements under GDPR, mainly data minimization. Datatilsynet highlighted that the app is a big interference in users’ privacy, even during the threat of a pandemic, which entails that the processing of personal data is necessary and proportional. Part of this evaluation considered the social benefit of the app. According to the latest numbers, around 50-550 people in Norway was/is infected – approximately 0.01 % of the population. Existing measure
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 20/02058 - Smittestopp in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 20/02058 - Smittestopp - Norway (2020). Retrieved from cookiefines.eu
Last updated: