1 July 2022
Sent by the Norwegian Data Protection Authority J.No. 2019-7320-1235
Doc.no. 490655
Caseworker
Charlotte Nørtoft
Poulsen
Complaint about Trustpilot A/S
The Danish Data
Protection Agency
On 27th of November 2018 you have filed a complaint to the Norwegian Data Protection Au- Carl Jacobsens Vej 35
thority (hereinafter the Norwegian DPA) regarding Trustpilot A/S. 2500 Valby
Denmark
T 3319 3200
In accordance with Article 56 of the General Data Protection Regulation 1, the Danish Data 0
dt@data ilsynet.dk
Protection Agency (hereinafter the Danish DPA) has been designated as the leading supervi- datatilsynet.dk
sory authority of the case. VAT No. 11883729
1. The Danish DPA understands that you have been running the website www.elbords.no, and
in that context comments about you and reviews from customers have appeared on www.trust-
pilot.com.
Your complaint to the Norwegian DPA concerns the right to be forgotten and the right to have
untrue and fake offenses of you and the website www.elboards.no removed.
The Danish DPA has sent your complaint to Trustpilot A/S on the 24th of March 2021, and 19th
of April 2021 Trustpilot A/S has stated the following:
The requesting data subject has contacted Trustpilot several times between December 2018 and Janu-
ary 2019 with regards to this issue and on each occasion was provided with timely and accurate inform-
ation on how he could flag any reviews that contained his personal information or which otherwise viol-
ated our guidelines.
The data subject has at all times been free and able to flag any reviews he had a concern about to us for
review in line with the process referred to above, but for reasons unknown to us decided not to do this
until after submitting his complaint to Norwegian Data Protection Authority.
In January 2019, the requesting data subject flagged multiple reviews about his business to us. In line
with our guidelines, the reviews that were assessed to be in breach of our guidelines were removed from
Trustpilot platform.
1 Regula ion (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural per-
sons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation).
Finally, please note that since the requesting data subject’s company’s website has now been closed, it Page 2 of 2
is no longer possible for any new reviews to be left about this company on www.trustpilot.com
On the 7th of April 2022 the Norwegian DPA has – on behalf of the Danish DPA – sent you the
statement from Trustpilot A/S and requested for your comments. It appears that you have not
returned with comments to the statement.
2. On the basis of the information available, the Danish DPA does not consider it necessary to
take any further action regarding your complaint.
In the present case the Danish DPA is of the opinion that it would be disproportionate to initi-
ate further investigations in the light of what can be achieved by such an investigation.
The Danish DPA has attached importance to the fact that Trustpilot A/S has stated that Trustpi-
lot A/S in January 2019 – after you flagged multiple reviews – have removed said reviews from
their website.
Furthermore, you do not seem to have contacted the Norwegian DPA since you filed the com-
plaint on 27th of November 2018 – which was before your inquiry (you flagged the reviews) to
Trustpilot A/S – or have responded to the statement from Trustpilot A/S being sent to you on
the 7th of April 2022, which leads the Danish DPA to believe that the matter has been resolved.
The Danish DPA refers to GDPR Article 57(1)(f), which states that each supervisory authority
shall handle complaints lodged by a data subject and investigate, to the extent appropriate,
the subject matter of the complaint.
It follows from that provision that the supervisory authority decides to what extent it is appro-
priate to examine the subject matter of the complaint.
3. The Danish DPA notes that this decision cannot be appealed to another administrative au-
thority, cf. Section 30 of the Danish Data Protection Act. The decision can however be brought
before the courts.
Kind regards
Charlotte Poulsen