- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Public Roads Administration (Statens vegvesen) – €87,000 Fine (Norway, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Norwegian Public Roads Administration failed to delete old toll road crossing logs that contained personal data. This situation shows the importance of properly managing and deleting personal data when it is no longer needed. The authority found that the agency did not follow the rules for data retention.
What happened
The Norwegian Public Roads Administration did not delete toll road crossing logs containing personal data after the retention period expired.
Who was affected
Individuals whose personal data was stored in the toll road crossing logs, including car tag numbers and locations.
What the authority found
The authority ruled that the agency did not implement necessary measures to delete personal data, violating Article 17(1) of GDPR.
Why this matters
This case highlights the need for organizations to have clear data retention and deletion policies. Other agencies should ensure they comply with data deletion requirements to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 10 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject lodged a complaint against the Norwegian Public Roads Administration (the controller) for failing to delete toll road crossings logs, which included personal data related to the car tag number, location and time of crossing. The data subject demonstrated that the controller still (at the time of the complaint) stored personal data about their place of residence dating back to 2008 and 2010. The controller may legally store personal data related to toll road crossings for accounting purposes, but when the purposes have been fulfilled (storage for 5 years as per Norwegian accounting rules), the personal data must be deleted in line with Article 17(1) GDPR. However, the system used for keeping this data, lacked deletion functionality and the DPA found that the controller had not assessed, nor implemented, technical and organisational measures as required by the GDPR. The Norwegian DPA's investigation revealed a complex situation of several involved parties and confusion around roles and responsibilities. The DPA, however, reasoned that the Norwegian Public Roads Administration was the controller for the personal data concerned. Other parties involved were toll operators and a software supplier. The involved parties had argued amongst themselves who were to blame for the violations of the GDPR, with letters dating back to May 2017. The controller claimed they could not delete the personal data in question since the software system (where the toll road crossings logs were kept) lacked deletion functionality. As the DPA had reasoned that the Norwegian Public Roads Administration was the controller and thus ultimately responsible for the processing of the personal data, the decision was made against them and not the other parties involved. The Norwegian DPA instructed the controller to, without undue delay, delete the personal data related to the toll road crossings logs where the purpose for storing has been fulfilled. For the violations described abov
Related Enforcement Actions (0)
No other enforcement actions found for Public Roads Administration (Statens vegvesen) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
25 February 2020
Authority
Datatilsynet (Norway)
Fine Amount
€87,000
1,000,000 NOK
About this data
Cite as: Cookie Fines. Public Roads Administration (Statens vegvesen) - Norway (2020). Retrieved from cookiefines.eu
Last updated: