The Norwegian Data Protection Authority has fined the Norwegian Labour Inspection Authority NOK 150,000 (EUR 15,000) for performing an unwarranted credit rating on a private individual. The Labour Inspection Authority is also reprimanded for lack of disclosure.
The background for this case is a complaint from the owner of a sole proprietorship (ENK), who was providing services to another enterprise, including assistance with a so-called postal inspection by the Labour Inspection Authority (request for information). Some days after the complainant had contacted the Labour Inspection Authority in this regard, he received a notice informing him that his ENK had been the subject of a credit rating by the Labour Inspection Authority.
This credit rating had been performed because the complainant’s ENK had assisted and sold services to a company the Labour Inspection Authority was monitoring and wanted to investigate further.
A credit rating is the result of a compilation of personal data from many different sources and shows the likelihood of a person being able to pay an outstanding claim. A credit rating will also reveal details about the person’s financial status, such as any overdue payments/defaults on loans, mortgages and debt-to-income ratio.
In this case, the question was whether the Labour Inspection Authority had a legal basis for the credit rating, especially considering Section 18-5 (1) of the Working Environment Act, which reads:
“1) All persons subject to inspection pursuant to this Act shall, when so demanded by the Labour Inspection Authority and notwithstanding the duty of secrecy, provide information deemed necessary for performance of the inspection. The Labour Inspection Authority may decide the form in which the information shall be provided. [...]”
The Data Protection Authority concluded that the complainant was not “subject to inspection”. We therefore found that Section 18-5 does not apply and concluded that the Labour Inspection Authority had no basis for performing a credit rating.
Credit ratings in cases like this collect personal data from a third party. According to Article 15 of the General Data Protection Regulation, a data subject has the right to confirmation as to whether or not personal data concerning them are being processed.
In this case, however, the complainant did not receive any confirmation as to whether or not a credit rating had been performed in his subsequent communication with the Labour Inspection Authority. The Data Protection Authority therefore concluded that a violation has taken place and issues a reprimand to the Labour Inspection Authority for failing to inform.