Based on an investigation of Telenor ASA, we have issued an order and administrative fine for inadequate organisation of the role of the data protection officer (DPO) and lack of internal control.
Our main findings are that Telenor ASA had not carried out all necessary assessments and documentation on the role of DPO, including the DPO’s independence and possible conflict of interest. A direct and documented reporting line for the DPO to the highest level of management had not been established. The company also had inadequate internal control.
Following our advance notification the company announced the termination of the DPO role. Therefore, Telenor ASA is ordered to assess and document whether they are obligated to have a DPO and to review and ensure an up-to-date and correct records of processing activities. In the event that the company finds that they are obliged to have a DPO, they must implement relevant organizational measures. The Norwegian Data Protection Authority also issues a reprimand for inadequate reporting line for the DPO to the highest management level.
Furthermore, we impose an administrative fine of four million Norwegian kroner for the lack of suitable organizational measures and suitable guidelines for the role of the DPO. We consider it a mitigating factor that no specific damage has been identified to the data subject’s privacy. We have also taken into account the long handling time when assessing the size of the fine.
The case was handled as a cross-border case, where the data protection authorities in Sweden and Denmark considered themselves as concerned supervisory authorities. They were given the opportunity to provide comments on the draft decision. The decision was thus made according to the cooperation and consistency mechanism in the General Data Protection Regulation. This entails that the decision cannot be appealed to the Norwegian Privacy Appeals Board. However, the decision can be brought before the Oslo District Court.
Mona Naomi Lintvedt.
Telephone: +47 481 51 418
E-mail: