- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 20/03771 – Violation Found (Norway, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Norwegian data protection authority found that Telenor ASA did not properly assess the risks of transferring personal data to the US. This is important because it shows that companies must carefully evaluate data transfer agreements to protect users' privacy.
What happened
Telenor ASA was found to have inadequate risk assessments for transferring personal data to the US.
Who was affected
Users whose personal data was potentially transferred without proper safeguards.
What the authority found
The authority determined that Telenor did not conduct a thorough review of the legal implications of transferring data to the US.
Why this matters
This ruling emphasizes the need for companies to conduct comprehensive assessments when transferring data internationally. It serves as a reminder of the ongoing challenges in ensuring data privacy in a global context.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Following the Schrems II ruling of 16 July 2020 ([https://gdprhub.eu/index.php?title=CJEU_-_C-311/18_-_Schrems_II CJEU case C-311/18)] the European Center for Digital Rights (noyb) lodged 101 complaints to several data protection authorities in the European Economic Area (EEA). All complaints concerned the use of Google Analytics or Facebook Connect on websites in the EEA. In accordance with Article 80(1) GDPR, noyb lodged a complaint on 17 August 2020 with the Austrian DPA against Telenor ASA (the controller) for their use of Google Analytics on their website and alleged transfer of a data subject's personal data to the US in violation of Article 44 GDPR. The data subject provided the DPA with a HTTP Archive format (HAR) data of the website, i.e., a JSON-formatted archive file format for logging a web browser’s interaction with a website, as proof of US-transfers being made. As per Article 4(16)(a) GDPR, Telenor’s main establishment is in Norway. Consequently, the Austrian DPA transferred the complaint to the Norwegian DPA in accordance with Article 56(1), who proceeded to investigate the case. The controller informed the DPA that they in late August 2020 initiated a review project to assess relevant agreements in light of the Schrems II ruling. They found this to apply to their use of Google Analytics since the agreement was with Google as a US processor of their. With the Privacy Shield now invalidated, the controller entered into standard contractual clauses (SCCs) Module Two with Google on 12 August 2020 for data transfers to the US. However, the controller did not carry out a thorough review of potential third country legislation (a "transfer impact assessment"), as it, according to information from Google, was not possible to determine the exact location of processing. The decision, however, refers to a statement by Google informing that Google Analytics data is stored in the US. The parties still agreed supplementary measures. First, Google has established
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 20/03771 in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 20/03771 - Norway (2023). Retrieved from cookiefines.eu
Last updated: