The Norwegian Data Protection Authority has fined Krokatjønnvegen AS NOK 300,000 (EUR 30,000) for performing two credit ratings without legal basis. The company has also been instructed to establish written procedures for credit ratings.
The background for the fine is a complaint from two private individuals who were subjected to credit ratings without any form of customer relationship or other connection to the company.
The General Data Protection Regulation (GDPR) requires all processing of personal data to have a legal basis. Credit information is a type of personal data that is especially worthy of protection.
A credit rating is the result of a compilation of personal data from many different sources and shows the likelihood of a person being able to pay an outstanding claim. A credit rating will also reveal details about the person’s financial status, such as any payment remarks, voluntary mortgages/liens and debt-to-income ratio.
After further investigation of the case, the Norwegian Data Processing Authority has concluded that the credit ratings were performed without legal basis. The company did not have a legitimate interest in performing credit ratings on the complainants.
The Norwegian Data Protection Authority’s 2020/2021 survey showed that people consider information about their personal finances to be especially worthy of protection.
- Because a credit rating contains details about personal finances, it is considered to be unacceptably intrusive when a business uses this information without any legal basis, says Line Coll, Director of the Norwegian Data Protection Authority.
- We receive many complaints concerning credit ratings, and we see that many organisations are not sufficiently aware of the rules. It follows from a long-standing practice at the Norwegian Data Protection Authority and the Privacy Appeals Board that CEOs may not use their company’s credit rating tools for private purposes. We take these matters very seriously and normally issue fines for this type of infraction, says Coll.