Getaround Norway AS (formerly Nabobil.no AS) – Dismissed (Norway, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint against Getaround Norway AS for conducting a credit check on a user was dismissed. The company argued that checking credit was necessary to manage financial risks when renting cars. This decision supports the use of credit assessments for legitimate business interests.
What happened
Getaround Norway AS conducted a credit assessment on a user who wanted to rent a car through their platform.
Who was affected
A person who attempted to rent a car and was subjected to a credit check by Getaround Norway AS.
What the authority found
The Norwegian Privacy Appeals Board agreed that the credit check was justified by the company's legitimate interest in managing financial risks.
Why this matters
This ruling supports the idea that businesses can use credit checks to protect themselves from financial risks, as long as they have a legitimate interest. Companies should ensure their practices align with this standard.
GDPR Articles Cited
After the Norwegian DPA rejected a data subject’s complaint regarding alleged unlawful credit assessment, the case was forwarded to the Norwegian Privacy Appeals Board (PAB) to conclude an assessment. The data subject complained about the fact that a company operating a car rental platform (the controller) credit assessed them when the data subject wanted to rent a car through the company's platform. The car rental platform in question connects users wanting to rent out their car, and users who want to rent someone else's car. The car rental platform has committed to cover any possible additional expenses (such as tolls, extra kilometers driven, parking fees, compensations) to car owner(s), as well as, deductibles to the insurance company in cases of damage. Thereafter, the car rental platform claims the expenses form the car renter. Regarding a deposit, the car rental platform consideres a deposit inadequate, since a deposit high enough to cover the financial risks would make the rental price unacceptably high. This said, the controller argued that it is necessary to credit assess renters. The controller carried out a credit assessment on the data subject when the data subject wanted to rent a car through its platform. Due to a payment notice, the data subject was prohibited to rent a car through the platform. The controller relied on legitimate interests under Article 6(1)(f) GDPR when it processed personal data for these credit assessment purposes. The Norwegian Privacy Appeals Board (PAB) took the view that the car rental platform assumes a considerable financial responsibility when a rental agreement is entered into through its platform, and that therefore, the controller depends on renters having ability to cover possible addtitional expenses. The PAB took in consideration that the controller had stated that its commitments have caused the company large expenses as a result of non-payment. Additionally, the PAB did not disagree with the controller regar
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Getaround Norway AS (formerly Nabobil.no AS) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Getaround Norway AS (formerly Nabobil.no AS) - Norway (2023). Retrieved from cookiefines.eu
Last updated: