- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 22/03622 – Violation Found (Norway, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Norway's data protection authority found that the national statistical institute's request for grocery purchase data could infringe on privacy rights. This matters because it raises questions about how personal data is collected and used by government entities. Companies should be aware of the implications of sharing data with such organizations.
What happened
The Norwegian DPA investigated a request for grocery purchase data from Statistics Norway, which could link data to individuals.
Who was affected
Consumers whose grocery purchase data could be linked to their personal information.
What the authority found
The DPA determined that the purchase data could be considered personal data due to its potential to be linked to individuals.
Why this matters
This case underscores the importance of understanding how data can be classified as personal and the responsibilities that come with collecting such data. Companies should be cautious when sharing data with government agencies.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In May 2022, the Norwegian DPA was approached by a grocery chain and a payment transaction provider regarding an instruction the former had received from the national statistical institute Statistics Norway (SSB), to submit purchase data ("bongdata" in Norwegian) to them. The DPA had also received several complaints and inquiries from private parties regarding this matter, and in June they asked SSB, by letter, to clarify. Following their reply, the DPA and SSB had a meeting in August. The various interactions clarified that SSB had instructed the main grocery chains in Norway (Rema 1000, NorgesGruppen, Coop and Bunnpris, accounting for about 99% of the Norwegian grocery market) to start submitting purchase data ("bongdata" in Norwegian) to them on a regular basis, including: * name of item * price per item* total amount of the receipt * payment method * amount per payment method * start and end time of the purchase * ID of returns * ID for terminated purchase * ID of offers/discounts The data would be reported directly from the point of sale systems so that SSB would receive the data continuously. Purchased items would be classified into product groups and consumers would be classified by size and type of household, income, level of education and country region. This would be contingent on a connection to transactional data/bank account number and then birth date. The purchase data do not in themselves contain any personal data. The intention is, however, to connect these with transactional data which then makes it possible to relate the data to an individual person. SSB will link these to transaction data quickly after continuously receiving them, and thus the DPA finds that it is correct to view the purchase data as personal data from the point of collection, and references Recital 26 GDPR. Because of this, the DPA assessed the interference the collection of purchase data represents. SSB's claimed legal basis for the processing was the Norwegian Statistics Act §
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 22/03622 in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 22/03622 - Norway (2023). Retrieved from cookiefines.eu
Last updated: