KOMPLETT BANK ASA
Postboks 448
1327 LYSAKER
Your reference Our reference Date
20/02319-8 11.11.2021
FINAL DECISION – COMPLIANCE ORDER AND REPRIMAND
We refer to our advance notification of 16 December 2020 and previous correspondence. We
also refer to the answer to the advance notification from Komplett Bank ASA (Komplett
Bank) of 22 January 2021 and to the e-mail with additional comments from the complainant
of 10 January 2021.
1. Compliance Order and Reprimand
The Norwegian Data Protection Authority issues the following decision to Komplett Bank:
1. Komplett Bank ASA must implement measures to ensure that requests from data
subjects that constitute objections against direct marketing pursuant to Article 21(3)
GDPR, leads to the personal data in question no longer being processed for such
purposes.
2. Komplett Bank ASA must implement measures to ensure that requests from data
subjects under Articles 15–22 GDPR are answered within the time limits set forth in
Article 12(3) GDPR.
3. Collectively, for having processed personal data in breach of Articles Art. 6(1), 12(1)
and (3), 13(1) and (2), 21(3) and (4) GDPR, Komplett Bank ASA is given a
reprimand.
We are competent to issue corrective measures pursuant to Article 58(2) GDPR.
2. Case Background
The complainant states that he has been a customer of Komplett Bank since 2016. He argues
that his personal data has been processed unlawfully, as he has received direct marketing by
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum T relastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
e-mail without having the possibility to opt out from this upon registration of his e-mail
address.
The complainant further states that he, after having received the first e-mail containing direct
marketing in September 2018, contacted Komplett Bank to object to this use of his personal
data. Still, he again received an e-mail containing direct marketing in November 2019.
The complainant has been in contact with the Data Protection Officer of Komplett Bank on
several occasions, and has documented that, on some of the occasions, more than one month
elapsed before his requests was answered.
Based on information available online and provided in the initial e-mail correspondence with
the Data Protection Officer, the complainant was of the understanding that the legal basis for
Komplett Bank’s processing his personal data was consent. When the complainant expressed
this understanding in an e-mail, the Data Protection Officer wrote in response that the legal
basis was not consent, but rather necessity for the performance of a contract pursuant to
Article 6(1)(b) GDPR. Later, in an e-mail from the Data Protection Officer of 26 June 2020,
the legal basis for processing was reported to be Article 6(1)(f) GDPR for the purpose of
marketing the bank’s products within the same product category towards customers, and
Article 6(1)(b) GDPR for the purpose of marketing in relation to the customer benefit
program for Komplett Bank Mastercard.
From the documentation we have received from the complainant, there does not seem to be a
designated opt out possibility for marketing from Komplett Bank. Conversely, under the tab
called ‘My Consents’, there is a possibility to ‘approve’ digital marketing via e-mail and
SMS.
In a letter of 18 June 2020, Komplett Bank answered questions from the Norwegian Data
Protection Authority regarding the case. Also in this letter, the legal basis for processing of
personal data relevant for the case is stated to be Articles 6(1)(f) and (b) for the two above-
mentioned purposes. Routines for handling access requests and the balancing of interests
assessment pursuant to Article 6(1)(f) was attached.
In the letter, you write that customers who wish to opt out from direct marketing can do so by
changing their consents when logged into the bank’s online banking service, or by contacting
customer service.
The routines for handling requests for access to personal data, attached in the letter from
Komplett Bank, state that a weekly meeting is held to go through access requests. Access
requests are said to be answered within one month. Further, it is stated that in some cases the
time limit can be extended. Which cases that qualify for extension is not specified.
In an e-mail with additional comments from the complainant of 10 January 2021, he raises
questions on compliance with Article 15(3) of the Marketing Practices Act:
2
‘Article 15(3) of the Marketing Practices Act and Article 15(2) ePrivacy both sets a
condition that the customer must be given a possibility to object against such
marketing when the electronic address is gathered. In other words, it will not be
sufficient to give access to object at a later stage, e.g., on a “My Page”, as this does not
fulfil the condition of simultaneousness.’
These are questions for which the Consumer Agency is competent authority (see Section 3.1
below).
In Komplett Bank’s answer to the advance notification of 22 January 2021, you have given
your comments to the assessment by the Norwegian Data Protection Authority. We have
implemented the comments in our assessment (see Section 4 below).
3. Legal Background
Personal data shall be processed in a lawful, fair and in a transparent manner pursuant to
Article 5(1)(a) GDPR, cf. Article 1 of the Personal Data Act.
Pursuant to Article 5(2) GDPR, the controller has an independent responsibility to be in, and
must be able to demonstrate, compliance with the principles relating to processing of personal
data in Article 5(1) (the accountability principle).
3.1. Lawful processing of personal data
The Norwegian Data Protection Authority is not the competent authority for issues
specifically regulated by the Marketing Practices Act. Pursuant to Article 15(3) of the
Marketing Practices Act, consent is required in some situations. However, consent is not
required for direct marketing via e-mail in existing customer relationships, on certain
conditions. The Consumer Agency is competent authority for the control of companies’
compliance with the provision. Nonetheless, companies must still ensure that the processing
of personal data is also in compliance with the GDPR.
To be lawful, the processing of personal data must have a basis in one of the alternatives in
Article 6(1)(a)–(f) GDPR.
If a contract with the data subject is to be used as basis for the processing of personal data, the
processing must be necessary for the performance of the contract to be lawful, cf. Article
6(1)(b) GDPR. The European Data Protection Board (EDPB) has stated that the processing
must be objectively necessary. This means that the controller should be able to demonstrate
how the main subject-matter of the specific contract with the data subject cannot be
performed if the specific processing of the personal data in question does not occur. 1 The fact
that a processing of personal data is written in the contractual terms, is neither sufficient, nor
necessary for Article 6(1)(b) GDPR to be applicable.
1
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, Version 2.0, para. 30.
3
Pursuant to Article 6(1)(f) GDPR a processing of personal data can be done lawfully if based
on a balancing of interests. The processing must be necessary for the purposes of the
legitimate interests pursued by the controller, which can be pursued if the interests or
fundamental rights and freedoms of the data subject override these interests. This basis for the
processing is divided into three. The controller must have a legitimate interest, the processing
must be necessary to be able to achieve the legitimate purpose, and a balancing of this interest
against, i.e., the data subjects’ right to privacy must be done in the specific case.
3.2. Retroactive change of legal basis for the processing
A controller that has used one basis for their processing of personal data, cannot at a later
stage go back and base an already executed processing on a different basis. If the basis that
the processing originally was based on turns out to be invalid, the processing that has taken
place will be unlawful. The reasoning behind this is that the controller must make the
assessment at the outset of processing, and that the data subject should be able to trust that the
information given about the basis for processing is correct. 2
3.3. The data subject’s right to object
The data subject shall at any time have the right to object to processing of personal data
concerning him or her that is based on Article 6(1)(f) GDPR. The same applies to personal
data processed for the direct marketing purposes, regardless of what the basis for processing
is, cf. Article 21(2) GDPR. When the data subject objects to processing for direct marketing
purposes, the personal data shall no longer be processed for such purposes, cf. Article 21(3)
GDPR.
3.4. The data subject’s right to information
3.4.1. Right to information about the legal basis for processing, purpose of the
processing and the right to object
A person that has their personal data processed, has the right to information about several
circumstances. The information shall be given in a concise, transparent, intelligible and easily
accessible form, using clear and plain language, cf. Article 5(1)(a) and Article 12(1) GDPR.
This can for instance be done through a privacy statement.
When personal data is collected from the data subject, the controller shall inform, inter alia,
of the purposes of the processing for which the personal data are intended as well as the legal
basis for the processing, cf. Article 13(1)(c) GDPR. If the processing is based on point (f) of
Article 6(1), the data subject shall also be informed of the legitimate interests pursued. This
information shall be given at the time when the personal data are obtained.
2
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, Version 2.0, para. 17.
4
The controller should seek to avoid confusion regarding which legal basis they apply for
processing of personal data. The data subject can, e.g., get the impression that they are
consenting to a specific processing, while the processing in reality is based on contract
pursuant to Article 6(1)(b) GDPR. 3
At the latest at the time of the first communication with the data subject, he or she shall be
explicitly informed of the right to object in Article 21(1) and (2) GDPR. The information shall
be presented clearly and separately from any other information, cf. Article 21(4) GDPR.
3.4.2. Time limits for answering data subject requests
If the data subject asks for the fulfilment of a right pursuant to Article 15–22 GDPR, the
controller shall give an answer without undue delay and in any event within one month of
receipt of the request, cf. Article 12(3) GDPR. The answer shall contain information on action
taken on the request. Where necessary, taking into account the complexity and number of the
requests, the time limit can be extended by two further months. If so, the data subject shall be
informed of any such extension within one month of receipt of the request, together with the
reasons for the delay.
4. The Norwegian Data Protection Authority’s assessment
4.1. Lawful processing of personal data
Komplett Bank writes in the letter of 18 June 2020 that direct marketing towards customers is
a processing of personal data that is based on a balancing of interests pursuant to Article
6(1)(f) GDPR.
Komplett Bank has attached the evaluation on balancing of interests that is made regarding
the processing of personal data for the purposes of direct marketing towards customers of the
bank’s products within the same product category. The Norwegian Data Protection Authority
is of the perception that the balancing of interests provides basis for lawful processing of
personal data for this purpose pursuant to Article 6(1)(f) GDPR.
Further, you write that the processing of personal data in connection to the customer benefit
program for Komplett Bank Mastercard is based on contract pursuant to Article 6(1)(b)
GDPR. You write that you see it as a contractual obligation to inform participants in the
benefit program about campaigns and other related benefits. The membership terms for the
customer benefit program, dated 18 September 2015, point 1.1, state that Komplett Bank
undertakes to inform the customers periodically about earning possibilities and possibilities to
withdraw bonus points.
As mentioned, one can only use Article 6(1)(b) as legal basis for processing if the main
subject-matter of the specific contract with the data subject cannot be performed if the
3
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, Version 2.0, para. 20.
5
specific processing of the personal data in question does not occur. To identify the main
subject-matter, one should look at the nature of the service provided, the contract’s purpose
and essential elements. Especially, one should consider how the service is promoted or
advertised to the data subject, since this can shed light on what were the mutual perspectives
and expectations of the parties, as well as which reasonable expectations the customers can
have regarding how their personal data will be processed. 4
This case primarily regards a credit card service. Taken into account how Komplett Bank
advertises the credit card on their own website, it seems like the essential elements that can be
expected by the customer are a charge-free and non-contact credit card with until 50 days of
interest-free credit, bonus point acquirement and insurances. 5 Therefore, we assume this the
main subject-matter of the service.
In other words, it does not seem like sending out offers from Komplett Bank and from the
bank’s collaborating partners is part of the main subject-matter of the service, even if this is
written in the membership terms for Komplett Bank’s customer benefit program, point 1.1.
In Komplett Bank’s answer to the advance notification of 22 January 2021, you write:
‘As the Norwegian Data Protection Authority points out, the main subject-matter of the
customer benefit program is credit, earning of bonus points and insurance. When we send
newsletters and campaigns to customers to motivate use of the credit card and promote the
benefits of the benefit program, it will necessarily also include our collaborator’s services,
that is, insurance partners or stores where bonus points can be earned. This is all the same
marketing of Komplett Bank’s own service, that is, our service in giving out bonus points
and negotiating for good terms with our collaborators.’
We agree with Komplett Bank’s remark in that marketing of collaborators’ services is all the
same marketing of Komplett Bank’s own service in this context. However, we cannot see that
marketing of the service is the main subject-matter of the contract. Use of the credit card, with
its benefits, bonus point acquirement and insurances, can be executed without the processing
personal data for direct marketing purposes. It is therefore the Norwegian Data Protection
Authority’s assessment that the processing of personal data for marketing purposes on
Komplett Bank’s or other parties’ behalf is not objectively necessary for the performance of a
contract to which the data subject is a party.
Further, in Komplett Bank’s answer to the advance notification of 22 January 2021, you
write:
‘As an illustration that it can be relevant to use alternative (b) instead of alternative (f),
we can point to former legal sources. In the travaux preparatoires of the former
Personal Data Act Article 26 (the right to opt out from direct marketing) it was
expressed that it can be ‘hard and unnatural to separate objective information
4
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, Version 2.0, para. 33.
5
https://www.komplettbank.no/kredittkort/.
6
connected to the contractual relationship and marketing of closely related products.’
Further, Article 7-7 of the former Norwegian Regulation on Data Protection made an
exception for the duty to give notice for processing of customer data as part of
administration and execution of the contractual obligations. This shows that it is not
unnatural, considering the legal sources, to deem processing of personal data relating
to marketing in existing customer relationships as ‘necessary for the performance of a
contract’ and therefore with legal basis in Article 6(1)(b) GDPR’.
It is the responsibility of the controller to follow applicable data protection rules. The new
Personal Data Act and the GDPR has been applicable in Norway since 20 July 2018. In the
EU, the GDPR has been applicable since 25 May 2018. Article 26 of the former Personal
Data Act was set aside in 2009. 6 This case regards processing executed in the period after
these dates. Former legal sources may carry limited weight in this regard.
The processing of personal data for marketing purposes on Komplett Bank’s or other parties’
behalf was not necessary for the performance of the contract. Therefore, Article 6(1)(b)
GDPR cannot provide legal basis for the processing.
The processing in question was executed without a legal basis in Article 6(1) GDPR. This
constitutes a breach of Article 6(1) GDPR.
In Komplett Bank’s answer to the advance notification of 22 January 2021, you have also
written that you assume that our compliance order only regards the processing that relates to
the case and not the activities of the bank in general. This is a correct interpretation. We have
constricted the wording in the compliance order for clarification. The requirement of having a
valid legal basis, however, applies generally to all processing of personal data executed by a
controller.
4.2. Retroactive change of legal basis for the processing
It is not possible to retroactively “change” to another legal basis after having commenced with
the processing, e.g., because the original legal basis did not cover the processing after all.7
Any change in the legal basis for processing shall in any event be informed to the data
subjects pursuant to the duty to inform in Articles 12–14 GDPR.
The Norwegian Data Protection Authority is of the understanding that the same legal basis
had been used for the processing activities in question from start to end, and that there is no
kind of retroactive “change” of legal basis, e.g., from consent to contract. The fact that the
complainant may have been of the understanding that this is the case, may on the other hand
suggest that Komplett Bank has provided insufficient information (see Section 4.4 below).
6
By the Marketing Practices Act.
7
See EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of
the provision of online services to data subjects, Version 2.0, para. 34 and EDPB Guidelines 05/2020 on consent
under Regulation 2016/679, Version 1.1, para. 123.
7
Komplett Bank writes, in your answer to the advance notification of 22 January 2021, that
you are willing to change the legal basis for processing of personal data for marketing of the
customer benefit program:
‘The Norwegian Data Protection Authority recognises that Komplett Bank has legal basis
in Article 6(1)(f) GDPR for the processing of personal data concerning the marketing
towards customers of the bank’s own products within the same product category.
Conversely, the Norwegian Data Protection Authority finds that Komplett Bank does not
have legal basis in Article 6(1)(b) for processing of personal data in relation to the
marketing of the customer benefit program. The Norwegian Data Protection Authority’s
conclusion is that this in the future will have to be based on another legal basis, for
instance a legitimate interest, if the requirements are fulfilled.
We take note of this. In the future, we will base our marketing of the customer benefit
program on Article 6(1)(f) GDPR.’
Further, you write:
‘For the sake of good order, we would like to bring attention to the fact that we have
intended no substantial difference between basing one type of marketing on Article 6(1)(f)
GDPR, and the other on Article 6(1)(b) GDPR. For both processing activities, we have
found the requirements in the Article 15(3) of the Marketing Practices Act to be fulfilled –
meaning there is an existing customer relationship, and the marketing relates to our own
services corresponding to the one that the customer relationship is built on. Whether
alternative (b) or (f) is used as legal basis will then not make a difference to the processing
of personal data.
[…]
Distinguishing between alternative (b) or (f) for direct marketing in existing customer
relationships is still mostly of theoretical interest. It does not affect the extent or the way
in which we send newsletters or marketing, and it does not affect the customers’ privacy
rights, including the right to reserve oneself against marketing. When we now will follow
the decision of the Norwegian Data Protection Authority, and clarify that our legal basis is
Article 6(1)(f) GDPR, cf. Article 15(3) of the Marketing Practices Act, this implies no
difference in practice. Our potential reference to a wrong legal basis therefore has not had
any negative effects for the data subjects.’
We recognise that you have considered the marketing activity in question to be in line with
the requirements in Article 15(3). As mentioned, we do not have competence to examine the
statement. These requirements come in addition to your duties pursuant to data protection
rules. In other words, compliance with the Marketing Practices Act does not remedy breaches
to the Personal Data Act.
We also recognise that if Komplett Bank had used a different legal basis for the processing
from the outset, it may not have had any impact on how the processing was executed. This
8
does not, however, necessarily mean that the reference to an inapplicable legal basis has not
had negative effects for the data subjects. Furthermore, it does not make the already executed
processing lawful pursuant to data protection rules.
All processing of personal data must follow the principles of ‘lawfulness, fairness and
transparency’ pursuant to Article 5(1)(a) GDPR. The principle of transparency entails that the
legal basis for the processing should be transparent to the data subject from the outset. A
retroactive change from one legal basis to another after the processing has started, leads to a
lack of predictability for the data subjects. The controller is required to disclose the legal basis
upon collection of the personal data, and must therefore have correctly identified in advance
of collection what the applicable lawful basis is. 8
The processing in question can therefore in the future be based on Article 6(1)(f) GDPR,
provided that the requirements set out in that provision are fulfilled. There is, however, no
room for a retroactive change to this legal basis for processing of personal data that was
initially based on Article 6(1)(b).
The change of legal basis cannot remedy the inapplicability of the specified legal basis for the
processing already executed.
4.3. The data subject’s right to object
The complainant has provided documentation that he, in an e-mail to the Data Protection
Officer of Komplett Bank of 27 September 2018, asked you to stop sending him direct
marketing. The wording he used connected to direct marketing via e-mail was: ‘Further, I ask
for a guarantee that this will not repeat itself.’
The Norwegian Data Protection Authority considers this an objection pursuant to Article 21
GDPR. Upon an objection to processing for direct marketing purposes, the personal data shall
no longer be processed for such purposes, cf. Article 21(3) GDPR. The complainant still
received new direct marketing from Komplett Bank after the request.
The continued processing of personal data for direct marketing purposes after the
complainant’s objection to the Data Protection Officer of Komplett Bank, constitutes a breach
of Article 21(3) GDPR.
4.4. The data subject’s right to information
Documentation provided by the complainant shows that there evidently is no designated opt
out possibility for marketing from Komplett Bank in the online banking service. On the
contrary, under the tab called ‘My Consents’, there is a possibility to ‘approve’ digital
marketing via e-mail and SMS. According to the complainant, this box was pre-ticked with
the answer ‘yes’ to marketing via e-mail. If this is the alternative you have referred to as a
simple possibility to opt out from direct marketing from Komplett Bank, it does not provide
8
EDPB Guidelines 05/2020 on consent under Regulation 2016/679, Version 1.1, para. 123.
9
information in a transparent and easily accessible form. Firstly, the information indicates that
the legal basis for the processing is consent. Secondly, the information can be understood in a
way in which there is only a possibility to limit direct marketing from Komplett Bank that is
sent electronically.
In the membership terms for the customer benefit program, dated 18 September 2015, the
processing of personal data is also connected with the notion of ‘consent’, see point 4. The
Norwegian Data Protection Authority assumes that these membership terms were applicable
at the time of the events of the present case, and that the Personal Data Act of 2018 therefore
is applicable.
A request for consent that is implemented into a longer text with different contractual terms is
not a valid consent pursuant to Article 6(1)(a) GDPR. 9 Komplett Bank does not in reality
seem to have been of this conviction either. Conversely, Komplett Bank has informed us that
the legal basis for this processing has been evaluated under Article 6(1)(b). Nonetheless, the
membership terms gives misleading information, as it indicates that the legal basis for the
processing is consent pursuant to Article 6(1)(a) GDPR. Komplett Bank has not given the
data subjects information about using Article 6(1)(b) GDPR as legal basis for processing of
personal data.
Assessing the information provided in combination, can lead to the person having their
personal data processed believing that the legal basis is consent.
The documentation provided by the complainant on correspondence with the Data Protection
Officer of Komplett Bank, also shows that he is given insufficient information about which
legal basis is used for which processing activity, even if this was corrected at a later stage.
The Norwegian Data Protection Authority further cannot see that Komplett Bank made the
complainant aware of his right to object to the processing of his personal data for direct
marketing purposes, pursuant to Article 21(4) GDPR.
On this background, the Norwegian Data Protection Authority finds that there is a breach of
Articles 13(1), 12(1) and 21(4) GDPR.
In the answer to the advance notification of 22 January 2021, Komplett Bank states that you
have implemented measures to correct the wording in your communication, by clarifying that
the legal basis is Article 6(1)(f). You also state that measures have been implemented to make
sure that the data subjects are made explicitly aware that they have the right to object at the
latest at the time of the first communication.
9
See especially Article 7(2) GDPR and EDPB Guidelines 05/2020 on consent under Regulation 2016/679,
Version 1.1, para. 71.
10
4.4.1. Time limits for answering data subject requests
We cannot see that Komplett Bank has given the complainant information on actions taken
due to his requests without undue delay, and in any event within one month of receipt of the
request. We also cannot see that Komplett Bank has given the complainant information about
the delay, and the reasons for the delay within one month. Several times, the complainant has
experienced that more than one month has passed without receiving neither a final, nor a
temporary answer to his requests. Furthermore, we cannot see that Komplett Bank’s routines
for handling access requests from data subjects state that the time limits in Article 12(3)
GDPR are to be followed.
In the answer to the advance notification of 22 January 2021, Komplett Bank explains that the
time limits was exceeded in this case due to a lack of capacity and a backlog at the customer
service. In the first instance, the delay was only a couple of days after the one-month limit.
Thereafter, you explain that some time was spent investigating the complainant’s additional
questions and comments to your answers.
Article 12(3) states that where necessary, taking into account the complexity and number of
the requests, the time limit can be extended by two further months. In any case, the data
subject shall be informed of the extension within one month of receipt of the request, together
with the reasons for the delay. This requirement needs to be incorporating into your routines
for handling access requests from data subjects, to provide compliance also when exceeding
the one-month time limit is permitted.
We find that there is a breach of Article 12(3) GDPR.
5. Judicial review
As we have informed earlier, this is a cross-border case. We have cooperated with other
concerned supervisory authorities in the case handling. As mentioned, the Norwegian Data
Protection Authority has, as lead supervisory authority in the case, a duty to hear all
concerned supervisory authorities before a final decision is made.
In cross border cases, the Norwegian Privacy Appeals Board does not have competence to
review the Norwegian Data Protection Authority’s decisions, cf. Article 22(2) second
sentence of the Personal Data Act.
The decision can be challenged before the courts. Each natural or legal person shall have the
right to an effective judicial remedy against a legally binding decision of a supervisory
authority concerning them, cf. Article 78(1) GDPR. Proceedings against a supervisory
authority shall be brought before the courts of the Member State where the supervisory
authority is established, cf. Article 78(1) GDPR. Court proceedings against the Norwegian
Data Protection Authority shall be brought before Oslo District Court. 10
10
Article 4-4(4) of the Act of 17 June 2005 no. 90 relating to mediation and procedure in civil disputes, cf.
Article 25 of the Personal Data Act.
11
6. Access to documents
The Norwegian Data Protection Authority has a duty of secrecy regarding the complainant’s
identity, cf. Article 24 of the Personal Data Act and Article 13 of the Public Administration
Act. As a party to the case, you have the right to such information, cf. Article 13(b)(1)(1)
Public Administration Act. You also have the right to access the documents in this case, cf.
Article 18 of the Public Administration Act.
We also want to inform that all documents generally are subject to freedom of information
requests, cf. Article 3 of the Norwegian Freedom of Information Act. If you are of the opinion
that the document or parts of the document is exempt from public access, we ask you to give
reasons for this.
Kind regards
Tobias Judin
Head of International
Guro Fiskvik Åsbø
Legal Adviser
This letter has electronic approval and is therefore not signed
Copy to: Complainant
12