The Norwegian Data Protection Authority has decided to fine the Norwegian Public Service Pension Fund (SPK) NOK 1 million. The background for the decision is that SPK has collected unnecessary income data on approximately 24,000 individuals.
SPK sent a discrepancy notification to the Data Protection Authority in September 2019. SPK had collected income data from the Tax Administration since 2016. They identified that some of this data was excess data that should not have been collected, as the data was not necessary for the purpose of conducting a post-settlement for disability pension. The data had been collected by means of a pre-defined data set from the Tax Administration. Until 2019, SPK had no procedures for reviewing and deleting excess data from the data sets collected.
- Approximately 24,000 individuals collecting disability pension were affected by the discrepancy, and the discrepancy includes special categories of personal data, in the form of information about disability pension from a third party beyond SPK and national insurance. We concluded that SPK breached the fundamental principles for the processing of personal data, Director General Bjørn Erik Thon said.
SPK was originally given notice of a NOK 1.5 million fine. Based on SPK’s response to the notice, the fine amount was reduced in the final decision. The Data Protection Authority’s overall processing time was also taken into account.