NOVUM ØKONOMI AS
Havnegata 10 Exempted from public access:
Offl. § 13 jf. Popplyl. § 24 (1) 2.
3040 DRAMMEN
pkt.
Your reference Our reference Date
20/03920-15 14.01.2022
Decision to issue a reprimand
The Norwegian Data Protection Authority ("Datatilsynet", "we", "our") refer to our advance
notification of a decision to issue a reprimand dated 4 November 2021 and earlier
correspondence. We have not received comments to our advance notification of a decision to
issue a reprimand by the deadline of 26 November 2021.
As mentioned in our request for information dated 7 May 2021, this is a cross-border case where
we cooperate with other concerned national supervisory authorities in the case handling.
Datatilsynet in Norway has been the lead supervisory authority in handling this case and this
decision to issue a reprimand is taken after having heard all concerned supervisory authorities.
1. Decision to issue a reprimand
Datatilsynet has decided the following:
For:
not informing the data subject about which steps you took after the data subject
requested access to and erasure of personal data within a reasonable time frame in
breach of Article 12 (3) of the General Data Protection Regulation ("GDPR"); and
not providing the reasons for complying with the requests nor informing the data
subject that they could submit a complaint to Datatilsynet in breach of Article 12 (4)
of the GDPR,
Novum Økonomi AS («Novum Økonomi») is issued a reprimand.
Our legal basis for deciding to impose corrective measures is Article 58 (2) of the GDPR.
2. Subject of the complaint
Postadresse: Kontoradresse: Telefon: Org.nr: Hjemmeside: 1
Postboks 458 Sentrum Trelastgata 3 22 39 69 00 974 761 467 www.datatilsynet.no
0105 OSLO 0191 OSLO
We opened a case regarding Novum Økonomi based on a complaint from a data subject1
in Poland. The complaint relates to how Novum Økonomi processes personal data.
(the "Complainant") received a marketing email on 12 September 2018 for
"3 D Perspective AS – Introduction of new contracts for the provision of accounting
services in connection with new regulations regarding the protection of personal data
(GDPR)". The email was sent from [email protected] to the Complainant's email
address .
The Complainant reacted because he had not had anything to do with Penno AS ("Penno")
previously. The Complainant therefore sent a complaint to the Polish Data Protection
Authority stating that:
He had never given consent to Penno to process his personal data;
He did not receive any response from Penno after he asked them where they had
obtained his personal data; and
He did not receive any response from Penno when he requested to have his personal
data erased.
3. Factual background
In 2019 the Danish Data Protection Agency was designated the leading supervisory
authority because Penno is a Danish company and it was assumed that Penno was the data
controller for the relevant processing, pursuant to Articles 60, 4 (7), 4 (16) and 4 (23) of
the GDPR.
Through its correspondence with Penno, the Danish Data Protection Agency uncovered
that Penno is a company that helps other businesses with digitalising processes regarding
electronic signatures. Penno stated that they are only a data processor (pursuant to Article
4 (8)), and that they carry out work when their customers place an order with them.
According to Penno, the data controller for the relevant processing activity was their
customer Novum Økonomi. Furthermore, Penno stated that they only process personal data
that the customer has actively inserted when using the software.
Penno has examined their systems and they could not find any information about the
Complainant (i.e. email address or name) there. According to Penno, they had
communicated with Novum Økonomi via telephone, and Novum Økonomi stated that the
aforementioned email was sent to the Complainant by mistake because of human error.
Penno has since deleted the Complainant's personal data.
As Novum Økonomi was data controller for the relevant processing activity, and it has its
main business activities in Norway, Datatilsynet was designated as the new leading
supervisory authority.
1
The individual to whom the processed personal data can be linked
2
On 7 May 2021, Datatilsynet sent a request for information to you, Novum Økonomi, and
received a response on 2 June 2021. You confirmed, among other things, that the
aforementioned email was sent to the Complainant by mistake. You stated that it probably
happened due to a typing error, so that the Complainant received the email instead of the
intended customer. You have stated that this probably happened because the sender did not
double-check the email address before sending.
Furthermore, you have stated that you had not obtained any personal data about the
Complainant. You have also stated that you have not had access to his personal data and
neither had any information about him that you could delete. Again, you highlighted that
the Complainant has not been registered in your systems.
According to you, one of your employees, , contacted the Complainant by
telephone in May 2019. She explained to the Complainant that he possesses the same name
as one of Novum Økonomi's customers, and that this could be the explanation for how the
email came to him instead of the customer. Ms also apologised on behalf of
Novum Økonomi and stressed that you never would have done anything actively to get the
Complainant's email address.
Regarding Novum Økonomi's routines and measures for preventing such breaches, you
have stated that according to your routines, active consent from the recipient is required
when there is no previous relationship. This also applies if the email address is publicly
available. Furthermore, you follow the industry standard "KS Komplett" which, among
other things, concerns internal routines for outgoing emails. Regarding routines for
ensuring the rights of the data subject or the customer according to Articles 15 to 21 of the
GDPR, you have stated that you act in accordance with your trade association "Regnskap
Norge, KS Komplett".
4. The applicable legal framework
4.1. About personal data, data controller and data processor
Personal data
Personopplysningsloven (The Norwegian Privacy Act) implements the GDPR in
Norwegian law, and came into force on 20 July 2018. It follows from Article 4 (1) of the
GDPR that 'personal data' means any information relating to an identifiable natural person,
either directly or indirectly. 'Processing' of personal data means any operation or set of
operations which is performed on personal data (for example collection or registration),
pursuant to Article 4 (2) of the GDPR.
Data controller and data processor
The one who determines the purpose of and the means of the processing is the so-called
data controller. The data controller can choose to have a so-called data processor, who
processes the personal data on behalf of the data controller.
3
The full definitions of 'data controller' and 'data processor' follow from Article 4 (7) and
(8) of the GDPR, pursuant to personopplysningsloven § 1.
4.2. Legal basis – lawful processing of personal data
The general principles for processing personal data follow from Article 5 (1) of the GDPR.
Personal data shall be processed lawfully, fairly and in a transparent manner, pursuant to
Article 5 (1) (a).
According to Article 5(2) of the GDPR, the data controller is responsible for ensuring and
documenting that its processing complies with the general principles of article 5 (1).
Any processing of personal data must have a legal basis under Article 6 (1) of the GDPR
to be lawful. A form of legal basis for the processing can be that the data subject has
consented to the processing of personal data for one or more specific purposes (Article 6
(1) (a)).
Datatilsynet is not the competent authority for areas specifically regulated by
markedsføringsloven (the Norwegian Marketing Act). According to the Norwegian
Marketing Act § 15 (3), it is not necessary to get consent for marketing by electronic mail
when there is already an existing customer relationship, under certain conditions.
Forbrukertilsynet (the Norwegian Consumer Agency) supervises whether organisations
comply with the terms of the Norwegian Marketing Act. Nevertheless, organisations must
also make sure that the processing of personal data is lawful according to the GDPR.
One of the legal bases provided for under Article 6(1)(a)-(f) is required in order to be able
to lawfully process personal data.
4.3. Obligation to facilitate the rights of the data subject – the right of access and the right of
erasure
Organisations must facilitate data subjects exercising their rights under the GDPR (Article
12 (2) of the GDPR). This means that organisations must allocate resources and have
systems in place to consider requests from private individuals. For example, organisations
must have resources and routines to handle requests for access to personal data according
to Article 15 of the GDPR.
Data subjects have a right to access all personal data concerning them that the organisation
processes (Article 15). It is possible to make some exceptions from the right to access under
Article 15 (4) of the GDPR and The Norwegian Data Protection Act § 16.
Article 17 of the GDPR in some cases gives data subjects a right to erasure if certain
conditions are met, and there is a corresponding duty for the organisation to erase their
personal data. This includes, among other things, cases where a data subject withdraws
their consent, if it is no longer necessary to process personal data for the purpose they were
collected for, or if the personal data have been processed unlawfully.
4
4.4. Deadlines and such for responding to the data subject's request
When a data subject exercises their rights under Articles 15 to 22 of the GDPR, the
organisation shall respond to the data subject without undue delay and in any event within
one month of receipt of the request (Article 12 (3)). This deadline can be extended by two
further months where necessary, but the organisation must then send the reasons for the
delay within the deadline. The response shall include information about what measures
have been taken.
Furthermore, it follows from Article 12 (4) of the GDPR that if the data controller does not
take action at the request of a data subject, the data controller shall inform the data subject
without delay and the latest within one month of receipt of the request of the reasons for
not taking action. The data controller shall also inform the data subject they have a right to
file a complaint with the supervisory authority and the right to seek a judicial remedy.
5. Datatilsynet's assessment
5.1. Regarding personal data, data controllers and data processors
Datatilsynet considers that the email address and name are personal data and that the
incorrectly sent email is a processing of personal data. In addition, Datatilsynet finds on
the balance of probabilities that Novum Økonomi is the data controller and Penno is the
data processor for this processing activity, pursuant to Article 4 (7) and (8) of the GDPR.
5.2. Legal basis – lawful processing of personal data
Novum Økonomi writes in their statement dated 2 June 2021 that the email sent to the
Complainant was sent due to a (human) error. Datatilsynet therefore finds on the balance
of probabilities that the processing of the personal data, i.e. sending marketing material by
email to the Complainant, happened without a legal basis according to Article 6 (1) of the
GDPR and without being in accordance with the general principles given in Article 5 (1)
of the GDPR.
Datatilsynet therefore concludes that Novum Økonomi processed the Complainant's
personal data in an illegal manner, pursuant to Articles 6 (1) and 5 (1) of the GDPR.
However, Datatilsynet believes that the threshold for giving a reprimand for these
conditions has not been met. This is because it was a one-time incident and the email
sending happened as a result of human error (and not system failure). The breach has
further not had any major privacy consequences for the Complainant.
5.3. Obligation to facilitate the data subject's rights – access and erasure
As to the question of breach regarding the Complainant's request for access and erasure,
Datatilsynet cannot find any breach of Article 15 (1), (3) or Article 17 (1) of the GDPR.
5
This is because the email address was erased from both Penno's and Novum Økonomi's
systems and databases, so that neither the data controller nor the data processor processes
the Complainant's personal data anymore. There is thus no personal data about the
complainant to erase.
Datatilsynet also notes that the complainant has received information regarding how their
e-mail address came into being with the businesses, i.e. that it was a typographical error in
the system.
5.4. Deadlines and such for responding to the data subject's requests
Datatilsynet cannot see that Novum Økonomi has given the Complainant information about
measures taken based on his request for access/erasure of 12 September 2018 without
undue delay2, and at the latest within one month after the request was received (Article 12
(3)). We can further not see that Novum Økonomi has given the Complainant any
information about the delay or its reasons within one month.
The Complainant was not contacted by Novum Økonomi, represented by ,
until May 2019. then informed him that the email had been sent to him by
mistake and that the company had not collected any information about him. In the phone
call, it was also informed that the company no longer processed any personal data about
the Complainant.
Furthermore, Datatilsynet cannot see that Novum Økonomi informed the Complainant
about their right to file a complaint with the supervisory authority and the right to seek a
judicial remedy (Article 12 (4)).
Novum Økonomi did not inform the Complainant about which steps were taken, nor about
which steps could not be taken, why, and about the right to make a complaint or seek
judicial remedy, by the company after the Complainant had requested access and erasure
within the deadline mentioned. Based on this, Datatilsynet finds a breach of Article 12 (3)
and (4) of the GDPR.
Datatilsynet issues a reprimand due to the severity of the breach, and Datatilsynet finds on
the balance of probabilities that Novum Økonomi does not have routines in place/followed
its routines for facilitating that the data subject can exercise his rights (Article 12 (2)).
Datatilsynet places particular emphasis on the fact that it took about eight months from
when the Complainant first got in touch with Novum Økonomi with his request for access
and erasure, until he received this information from Novum Økonomi.
6. Final remarks
2
According to the Complainant's letter with clarifications to the Danish Data Protection Agency dated 17 March
2020, the Complainant sent an email to the email address [email protected] on 12 September 2018. This should
be the correct email address to send a request to. In addition, the Complainant followed up with an email to both
[email protected] and [email protected] on 11 May 2019, since the Complainant had never received any
response from Novum Økonomi in the first mentioned email.
6
6.1. Ability to appeal this decision
In cross-border cases, the Norwegian Privacy Appeals Board does not have standing to
overturn Datatilsynet's decisions pursuant to personopplysningsloven Section 22 second
paragraph.
This decision can be appealed to the Norwegian courts. All physical and legal persons shall
have the right to an efficient judicial remedy against a legally binding decision of a
supervisory authority concerning them pursuant to Article 78 (1) of the GDPR. Proceedings
against a supervisory authority shall be brought before the courts of the Member State
where the supervisory authority is established pursuant to Article 78 (3) of the GDPR.
Proceedings against Datatilsynet shall be brought before Oslo City Court.3
6.2. Public access, other access and confidentiality
We want to inform you that all documents generally are subject to freedom of information
requests, pursuant to offentlighetsloven § 3 (the Norwegian Freedom of Information Act).
If you are of the opinion that the document is, or parts of the document are, exempt from
public access we ask you to justify this.
Datatilsynet has a duty of confidentiality about who complained to us, and about the
complainant's personal situation. The duty of confidentiality follows from, among others
things, The Norwegian Data Protection Act § 24 and the Norwegian Public Administration
Act § 13. As a party in the case you can still be made aware of such information by
Datatilsynet, cf. the Norwegian Public Administration Act § 13 (b) (1) (1). You also have
the right to access the case documents, cf. the Norwegian Public Administration Act § 18.
We draw attention to the duty of confidentiality you have when Datatilsynet gives you
information about the Complainant's identity, personal situation or other identifying data,
and that you may only use this information to the extent it is necessary to look after your
own self-interests in this case, cf. the Norwegian Public Administration Act § 13 b (2). We
also point out that violation of the duty of confidentiality can be punished according to
straffeloven (the Norwegian Criminal Code) Section 209.
Should you have questions, you may contact Sebastian Forbes by telephone on 22 39 69 49.
Kind regards
Tobias Judin
Head of Section
Sebastian Forbes
3
Law of 17 June 2005 no. 90 on mediation and court proceedings in civil disputes (the Dispute Act) § 4-4 (4),
pursuant to Section 25 of the Norwegian Data Protection Act.
7
Legal Advisor
Copy to: The Complainant
8