Cybersecurity Policy Report, Norway Fines Electronics Retailer Over Privacy Violations, (Jun 5, 2026)
By Tony Foley
The Norwegian data protection authority, Datatilsynet, has fined consumer electronics retailer Elkjøp 20 million kroner ($1.83 million) over violations of the European Union’s General Data Protection Regulation (GDPR), including processing the personal data of members of its customer club without consent.
Datatilsynet conducted an inspection of Elkjøp in June 2022 after receiving several reports of breaches of personal data security, complaints, and tips about the customer club, according to yesterday’s press release announcing the sanctions. Elkjøp stated during the inspection that the purpose of the customer club was to market products and services, asserting that consent of club members constituted the legal basis for processing of their personal data.
In its decision, which may be downloaded from the press release but is available only in Norwegian, Datatilsynet found multiple violations of the GDPR, including the following:
Failure to obtain valid consent to process personal data in the customer club;
(2) Necessary assessments regarding the use of data for new purposes were not made;
Failure to make good enough assessments of legitimate interest as a legal basis for processing; and
Rights requests from customers were not responded to within the timeframes established under the GDPR.
Datatilsynet said the case against Elkjøp provided lessons about what businesses must consider when processing personal data in customer clubs. Noting that more than 6 million members of Elkjøp’s customer club were affected by the breaches alleged in the case, Datatilsynet said the fine was appropriate and based on the annual revenue of the group of which Elkjøp is a part. The opinion further notes that data protection authorities from Sweden, Iceland, Finland, and Denmark were part of the cross-border case and that the decision was made in accordance with the GDPR’s one-stop-shop enforcement mechanism.
The press release concludes by outlining data protection issues for retail businesses with customer clubs or loyalty programs.
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR