Miljø- og Kvalitetsledelse AS
Insufficient legal basis for data processing
Decision Date
April 9, 2021
Authority
Norwegian Supervisory Authority (Datatilsynet)
NO
Sector
Industry and Commerce
Country
NO
Law
GDPRStatus
FINALDescription
The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 3,400 on Miljø- og Kvalitetsledelse AS. At one of the carwashes operated by the controller, incidents of vandalism had occurred at the payment terminal. The controller thereupon sent footage of the incident from a surveillance camera to the employer of the alleged vandal. The Norwegian DPA concluded that the sharing of the video footage had taken place without a legal basis and the controller had thus violated Art. 6 (1) GDPR and Art. 5 (1) a) GDPR. Furthermore, the DPA emphasizes that the disclosure of the recordings was not necessary to clarify the incident, as the recordings had already been provided to the police.