- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Ultra-Technology AS – €10,875 Fine (Norway, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Norway's Data Protection Authority fined Ultra-Technology AS €10,875 for conducting an unlawful credit rating. This ruling is significant because it reinforces that companies must have a valid reason for credit assessments.
What happened
Ultra-Technology AS conducted a credit rating on a person without a legal basis.
Who was affected
The person who felt their credit was unlawfully rated by Ultra-Technology AS.
What the authority found
The authority found that Ultra-Technology AS did not have a valid legal basis for the credit rating under GDPR.
Why this matters
This case stresses the necessity for companies to establish clear policies and legal grounds for credit ratings to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 14 March 2026.
Processing notes: articles corrected, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A person lodged a complaint to the Norwegian DPA (Datatilsynet) for having been subject to what they felt was an unlawful credit rating by the company Ultra-Technology AS. The company claimed legal grounds for this in Article 6(1)(f) GDPR, pursuing a third party's legitimate interest. After receiving the DPA's notification of a fine, the company claimed they had other internal policies and procedures in place which would be sufficient for credit ratings. They also claimed that the intended fine was too high. The Norwegian DPA (Datatilsynet) held that Ultra-Technology AS had no legal basis as per Article 6(1)(f) GDPR to conduct the credit rating, because the legitimate interest must be based on the company's requirement and interest. Consequently, the DPA fined the company €12,785 (NOK 125,000), reduced from NOK 175,000, however only due to the long case processing time (in line with the Norwegian Privacy Appeal Board's latest decisions) and not the company's request for a reduced fine. The DPA also held that company must create a company policy and implement internal controls of their credit rating process, in line with Article 24.
Related Enforcement Actions (1)
Other enforcement actions involving Ultra-Technology AS in NO
Details
Fine Date
21 September 2021
Authority
Datatilsynet (Norway)
Fine Amount
€10,875
125,000 NOK
About this data
Cite as: Cookie Fines. Ultra-Technology AS - Norway (2021). Retrieved from cookiefines.eu
Last updated: