The Norwegian Data Protection Authority has decided to fine T. Stene Transport AS NOK 40,000 (EUR 4,000) after unlawfully performing a credit rating of a sole proprietorship. The company is also ordered to establish procedures for when it is appropriate to perform a credit rating.
A credit rating is a compilation of personal data from many different sources and shows the likelihood of a person or enterprise being able or willing to pay an outstanding claim.
A credit rating will also reveal details about the enterprise’s financial status, such as any payment remarks, its debt-to-income ratio and whether the enterprise has any mortgages.
Credit information about a sole proprietorship also constitutes personal data, as the owner is immediately identified with the enterprise, and the enterprise is directly linked to the owner’s personal finances.
This means that a valid legal basis is required to subject sole proprietorships to a credit rating.
In general, we believe procedures would create awareness and promote compliance with regulations. In this case, the company had not previously used the credit rating tool. Consequently, they were ordered to establish procedures, even though they did not routinely perform credit ratings.