Coop Finnmark SA – Court Ruling (Norway, 2021)

This case is an appeal of the decision DT-20/01790 by the Norwegian DPA (Datatilsynet), in which it fined a store approximately €40,340 (NOK 400,000) for the unlawful disclosure of personal data from a surveillance footage, thus breaching Article 5(1)(a) GDPR and Article 6. The complainant argued that the size of the administrative fine imposed, was too high and therefore appealed the DPA's decision. After reviewing the complaint, the DPA decided to uphold it, and the case was therefore was submitted to the Privacy Appeals Board (Personvernnemnda) for consideration. Personvernnemnda (PVN) agreed with the DPA that the infringement in question was correctly defined as a breach of Article 5(1)(a) GDPR and Article 6(1)(f). However, the PVN did not agree that the infringement was as serious as interpreted by the DPA, quoting specifically the short duration of the footage (3 seconds), that it did not show any faces or the theft itself, did not concern any personal data as per Article 9 GDPR or Article 10 and was deleted after a few days. The PVN noted that forwarding the footage and the fact that it involves children, are aggravating circumstances, however there was no evidence that the data subjects were harmed in any way. After an overall assessment, the PVN concluded (under doubt) that an administrative fine for such a violation should be around €5042 (NOK 50,000), however they also removed the fine entirely due to the DPA's long case processing time (over two years). Following the PVN's decision, the complainant submitted a claim for coverage of their legal costs related to this case. The PVN agreed and awarded the complainant €6959 (NOK 69,000), cf. [https://www.pvn.no/pvn-2021-15 PVN-2021-15].