Miljø- og Kvalitetsledelse AS – €3,045 Fine (Norway, 2021)

The company Miljø- og Kvalitetsledelse operates a car wash facility, where a payment terminal was vandalised. Since the company had CCTV/camera surveillance, they were able to determine who the culprit was and, consequently, reported the incident to the police (and also to the culprit/data subject himself). However, the company went on to disclose the footage to the data subject's employer, as they considered him to be "out of balance" because the data subject had also contacted a lawyer. The data subject was not notified of, nor consented to this disclosure. The DPA held that the company lacked legal basis for the disclosure to the data subjects's employer and was therefore in violation of Articles 5(1)(a) and 6(1) GDPR. The recordings had already been handed over to the police and the further disclosure to the data subject’s employer was unnecessary for the (legitimate) purpose of preventing vandalism or resolving the case.