Elkjøp Nordic AS
Postboks 4303 Nydalen, Exempt from public
NO-0402 OSLO disclosure:
Offl. § 20 første ledd B
IMI Case Rep. reference Our reference Date
304618 20/02353-17 17.06.2021
Closure of case
We refer to our latest order to provide information dated 9 February 2021 and your letter
dated 30 March 2021 concerning the data protection complaint that has been raised with the
Norwegian Data Protection Authority (DPA).
We are the leading supervisory authority as Elkjøp Norway AS is a Norwegian registered
organization with your main establishment in Norway.
The complaint relates to how Elkjøp Norge AS (hereinafter “Elkjøp”) has processed
(hereinafter "complainant") personal data. The complainant believes that
there has been a breach of the Norwegian Personal Data Act, including the General Data
Protection Regulation (GDPR), as you have sent personal data to the wrong e-mail address,
by mixing up two customer accounts. Elkjøp is said to have sent the complainant's receipt,
information and payment information to another customer, without the complainant's consent.
The e-mail address of the complainant and the person who has received the complainant's
emails are identical before the alpha curl, but the two accounts use different e-mail services
("Hotmail" and "Gmail" respectively). The information was supposed to be sent to
, but has been sent to .
According to the complainant, there is probably a fault in your systems for costumer
registration. The complainant has repeatedly contacted you to correct the error, the first time
on 22 April 2020.
On 9 February 2021 the Norwegian DPA sent an order to provide information to your
organization (see attachment 1).
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
Your organization’s response
In your reply, you advise that it is your organization’s understanding that the complainant
accidentally entered the wrong e-mail address when he was making a purchase on your online
store. As a result, the wrong costumer began to receive e-mails on the complainant’s orders.
The complainant contacted you on several occasions to raise concerns about this situation and
to ask for his e-mail address to be corrected. You state that unfortunately, in this case, you’ve
had poor follow-up whereby it took a while for the correction of the customer's information,
i.e. to create a new customer “card” with the correct e-mail address. The complainant’s e-mail
address was corrected on 27 November 2020.
You inform us that you are currently working on a new solution to more easily correct this
type of errors, which will be launched in April. We refer to attachment 2 for your response in
full.
Our view
The Norwegian DPA have considered the information available to us in relation to this
complaint and we are of the view that the fault for registering the wrong e-mail address lies
with the complainant. We therefore conclude, based on a prima facie assessment of the
information you have provided us, that you have adequate procedures and measures in place
to ensure that personal data is correctly registered.
You acknowledge that you have had poor follow-up of the complainant’s request of
correction of his personal data. Given that it took more than 6 months to correct the e-mail
address, the Norwegian DPA is not minded to believe you have met the requirement to handle
requests pursuant to Article 15-22 in the GDPR "without undue delay and no later than within
one month", cf. Article 12 (3). The Norwegian DPA recognizes that Elkjøp’s standard
operating policies and procedures in relation to handling costumer GDPR-requests do not
seem to have initially been followed in this case.
We also note that you have provided us with the information that you are currently working
on a new solution to more easily correct wrongly registered personal data, and that you have a
new updated training created for employees with the topic GDPR and handling of customer
data.
In light of this, we do not currently intend to take any regulatory action on this complaint.
However, you should know that we keep a record of all the complaints raised with us about
the way organizations process personal information. The information we gather from
complaints may form the basis for action in the future where appropriate.
Next steps
Our website contains significant advice and guidance about the processing of personal data
and an organization’s obligations under data protection law, which may help to inform any
decisions you make about the processing of personal data in the future.
Should you wish to discuss this case any further, or require any clarification, please do not
2
hesitate to contact us.
Kind regards
Tobias Judin
Head of Section
Tanja Czelusniak
Legal advisor
This letter has electronic approval and is therefore not signed
Attachments:
(1) Norwegian DPA’s order to provide information
(2) Elkjøp’s reply to the order to provide information
In copy:
- The complainant
3