- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Bodø Kommunale Pensjonskasse (BKP) – Violation Found (Norway, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Bodø Kommunale Pensjonskasse was found to have mishandled sensitive personal data, including health information. The authority discovered that the pension fund shared this data without a proper legal reason. This case emphasizes the need for strict data handling practices.
What happened
Bodø Kommunale Pensjonskasse processed and shared sensitive personal data without a valid legal basis.
Who was affected
Customers of Bodø Kommunale Pensjonskasse whose sensitive personal data was improperly processed and shared.
What the authority found
The Norwegian data protection authority found that the pension fund violated GDPR by processing personal data without a legal basis.
Why this matters
This ruling serves as a reminder for companies to ensure they have a valid reason for processing sensitive data. Organizations should review their data handling practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Datatilsynet received a notification that Bodø Kommunale Pensjonskasse (BKP), a Norwegian pension fund, would obtain unnecessary medical certificates, lack control over archives and share special categories of personal data with third parties. Based on this notification, the Datatilsynet started an independent investigation in November 2019. The Datatilsynet found two violation of Article 6 and 9 GDPR in that the BKP *has processed special categories of personal data in statistics that do not appear to be necessary and *has transferred special categories of personal data to Bodø Municipality without a legal basis und Article 6 and 9 GDPR. In essence, the Datatilsynet considered it very problematic that the BKP had a practice of creating statistics, that still contained personal data of the BKP's customers under Article 4(1) GDPR. These statistics even included health data which qualify as a special category of personal data under Article 9(1) GDPR. The Datatilsynet considered, that such processing might be based on Article 6(1)(f) GDPR (legitimate interest) and - regarding health data - on Article 9(2)b) GDPR (fulfilling obligations under social security law). However, the Datatilsynet was not convinced that statistics containing personal data were truly necessary and whether the BKP could not have compiled the statistics in a manner that would result in anonymised data. With regard to the transmission of this statistics that still contained personal data to Bodø Municipality , the Datatilsynet held that there is no legal basis under Article 6 and 9 GDPR and that such processing should be stopped. The alleged obtaining of unnecessary medical certificates in order to assess a person's entitlement to a disability pension was not considered to amount to a GDPR violation as these certificates might indeed be necessary for purpose achievement. Regarding the access of the BKP's board to data about the BKP's customers (e.g. gender, year of birth, position, informatio
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Bodø Kommunale Pensjonskasse (BKP) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
21 August 2020
Authority
Datatilsynet (Norway)
About this data
Cite as: Cookie Fines. Bodø Kommunale Pensjonskasse (BKP) - Norway (2020). Retrieved from cookiefines.eu
Last updated: