Exempt from public disclosure:
OSLO Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
20/01759-12 04.10.2022
Final Decision - Raise Gruppen AS og Raise Norway AS
IMI article 56 entry number: 57051
IMI case register: 62626
National case reference: NO SA: 20/01759 & 18/02429
Controller: Raise Gruppen AS and Raise Norway AS
Date of complaint: 29 August 2018
We refer to the abovementioned cross-border case where Datatilsynet (the Norwegian Data
Protection Authority, hereinafter "NO SA") has been identified as the lead supervisory
authority pursuant to Article 56(1) GDPR1. Integritetsskyddsmyndigheten (the Swedish Data
Protection Authority) has been identified as the sole supervisory authority concerned pursuant
to Article 4(22) GDPR.
The NO SA adopts the following decision:
The NO SA rejects the complaint submitted against Nikita Hair on 29 August 2018 (Case
18/02429 & 20/01759).
Factual Background
On 29 August 2018, the NO SA received a complaint (the "Complaint") against the chain of
hairdressers trading under the names Nikita Hair and Hairshop. The background of the
Complaint was that in connection with drop-in hairdresser appointments (i.e. where the
complainant tried to get a haircut by simply turning up at the salon) at both Hairshop and Nikita
Hair branches in Oslo on 27 August and 28 August 2018 respectively, the complainant had to
provide both their full name and telephone number (the "Requested Personal Data") before
they could get a haircut.
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119/1.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
When the complainant asked an employee at Hairshop what the purpose of requiring the
Requested Personal Data was, the employee answered that it was needed in case the
complainant complained about the service. When the complainant asked the same question to
an employee of Nikita Hair, the employee answered that the information was needed in case of
a financial audit. In both cases, the complainant would have paid by way of a bank card.
In the Complaint, the complainant specified that their complaint related to whether:
• Nikita Hair had a real need for, and reasonable grounds to require the provision of, the
Requested Personal Data; and
• whether the Requested Personal Data was only used in connection with financial audits,
particularly as the complainant had received a text message from Nikita Hair requesting
feedback.
On 17 November 2021, the NO SA sent an order to provide information to Raise Gruppen AS,
who was specified as Nikita Hair's contact point for information regarding processing of
personal data. The NO SA requested Raise Gruppen AS who the controller for the processing
is, and if they were the controller to explain how personal data relating to drop-in hairdresser
appointments are processed in accordance with the Norwegian Data Protection Act and the
GDPR.
On 17 December 2021, Raise Gruppen AS responded to the NO SA's order to provide
information dated 17 November 2021. Raise Gruppen AS explained their group company
structure, and that its previous wholly owned subsidiaries Nikita Hair Norway AS (trading as
Nikita Hair) and Sayso Hair & Style AS (trading as Sayso, previously Hairshop) had now been
merged into one wholly owned subsidiary called Raise Norway AS. In addition, the same is
true for the wholly owned Swedish subsidiaries Nikita Hair Sweden AB (trading as Nikita Hair)
and Sayso Hair & Style AB (trading as Sayso, previously Hairshop) which merged into one
wholly owned subsidiary called Raise Sweden AB.
Raise Gruppen AS also confirmed that the booking system for all customers is handled centrally
by the administration in Raise Gruppen AS, and that Raise Gruppen AS is therefore largely the
controller of processing activities connected to this system. In connection with the restructuring
of the group, Raise Gruppen AS stated they were currently reviewing their privacy policy
including to make it clear what the processing relationship between the group companies and
customer rights is.
Raise Gruppen AS stated that in the case of the complained of processing operation, and in
relation to the Requested Personal Data, the legal basis for processing is to fulfil the legal
obligations that follow from the requirements of the Norwegian Bookkeeping Act (Nw.
Bokføringsloven) and the Norwegian Bookkeeping Regulations (Nw. Bokføringsforskriften).
Section 5-15 of the Norwegian Bookkeeping Regulations stipulates what documentation
businesses that provide services by appointment must keep, and specified that the time of when
the service was carried out, the customer name and as far as possible the name of the person
carrying out the service shall be documented. The same provision also specified that it applies
to appointments that are not made beforehand (i.e. drop-in appointments). Raise Gruppen AS
stated that when implementing a new booking system, they wanted to be able to offer
2
anonymous drop-in appointments, but they obtained an external legal assessment on the
obligations under the Norwegian Bookkeeping Regulations which confirmed that they were not
able to offer anonymous drop-in appointments. In addition, the external legal assessment stated
that they needed to register "contact details" for drop-in customers in order to fulfil a legal
obligation pursuant to Article 6(2) GDPR, Section 5-15 of the Norwegian Bookkeeping
Regulations and the Norwegian Bookkeeping Act. Raise Gruppen AS also stated that they were
of the understanding that the same rules applied in Sweden.
On 26 January 2022, the NO SA sent a further order to provide information to Raise Gruppen
AS ordering them to explain for what purpose, and under which legal basis, they processed the
telephone numbers of drop-in customers in Norway, and for what purpose and under which
legal basis they processed the name and telephone numbers of drop-in customers in Sweden.
On 21 February 2022, Raise Gruppen AS responded to the NO SA's order to provide
information dated 26 January 2022. Raise Gruppen AS explained that, due to their
understanding of the intention behind the Norwegian Bookkeeping Act and consequently the
Norwegian Bookkeeping Regulations, to prevent a black market and money-laundering through
securing auditability of transactions covered by the law, it is necessary to be able to distinguish
individual customers in the booking system. Raise Gruppen AS therefore used telephone
numbers as an identifier to secure compliance with the Norwegian Bookkeeping Act. The legal
basis for processing the name of drop-in customers is therefore Article 6(1)(c) GDPR, and the
legal basis for processing the telephone number of drop-in customers is Article 6(1)(f) GDPR
as a practical way to implement the requirement to be able to distinguish between customers.
The same applies for drop-in customers in Sweden, albeit instead in relation to the Swedish
Bookkeeping Act (1999:1078).
Legal Background
Pursuant to Article 6(1) GDPR, as adapted pursuant to Annex XI of the EEA Agreement as
amended by the Decision of the EEA Joint Committee No 154/2018 of 6 July 2018:
1. Processing shall be lawful only if and to the extent that at least one of the following
applies:
a. the data subject has given consent to the processing of his or her personal data
for one or more specific purposes;
b. processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior
to entering into a contract;
c. processing is necessary for compliance with a legal obligation to which the
controller is subject;
d. processing is necessary in order to protect the vital interests of the data subject
or of another natural person;
e. processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;
3
f. processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, except where such interests are overridden by
the interests or fundamental rights and freedoms of the data subject which
require protection of personal data, in particular where the data subject is a
child.
Point (f) of the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.
2. Member States [and EFTA States] may maintain or introduce more specific provisions
to adapt the application of the rules of this Regulation with regard to processing for
compliance with points (c) and (e) of paragraph 1 by determining more precisely
specific requirements for the processing and other measures to ensure lawful and fair
processing including for other specific processing situations as provided for in Chapter
IX.
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid
down by:
a. [the EEA Agreement]; or
b. Member State [and EFTA State] law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the
processing referred to in point (e) of paragraph 1, shall be necessary for the
performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller. That legal basis may contain specific provisions to
adapt the application of rules of this Regulation, inter alia: the general conditions
governing the lawfulness of processing by the controller; the types of data which are
subject to the processing; the data subjects concerned; the entities to, and the purposes
for which, the personal data may be disclosed; the purpose limitation; storage periods;
and processing operations and processing procedures, including measures to ensure
lawful and fair processing such as those for other specific processing situations as
provided for in Chapter IX. The [EEA Agreement, Member State or EFTA State] law
shall meet an objective of public interest and be proportionate to the legitimate aim
pursued.
Findings
The Complaint focuses on why Nikita Hair requires both a drop-in customer's name and
telephone number prior to offering a haircut. Therefore the focus of the NO SA's assessment
will be on the matter of the legal basis for processing the name and telephone number of drop-
in customers at Nikita Hair, as the NO SA deems that this would constitute investigating the
complaint to the extent appropriate.
The legal basis allegedly relied upon when processing the name of drop-in customers is Article
6(1)(c) GDPR in order to comply with the Norwegian Bookkeeping Act and Norwegian
4
Bookkeeping Regulations. The Norwegian Bookkeeping Regulations imposes a duty on those
carrying out services by appointment, including by drop-in appointments, to collect and process
the name of the customer. The NO SA notes that only the entity under the obligation of the
legal obligation may rely on Article 6(1)(c), as such legal obligation would mandate the purpose
and means of the processing on the entity under such obligation. As such, the controller for
such processing operation must be Raise Norway AS (following the merger of Nikita Hair
Norway AS and Sayso Hair & Style Norway AS into one company and renaming such company
Raise Norway AS), as that is the entity that carried out the service for the complainant and
therefore the entity to which the obligations of the Norwegian Bookkeeping Regulations apply.
The NO SA therefore finds that the processing of drop-in customer names can validly be based
on Article 6(1)(c) GDPR, but notes that Raise Gruppen AS appears to have misunderstood to
which legal entity such legal basis relates and therefore which legal entity is the controller.
The legal basis relied upon when processing the telephone numbers of drop-in customers is
Article 6(1)(f) GDPR as a practical way to implement the intention behind the Norwegian
Bookkeeping Act and Norwegian Bookkeeping Regulations by distinguishing between
customers. The NO SA considers that this interest is a legitimate one, and it is unlikely that
such interest is overridden by the interests or fundamental rights and freedoms of the data
subject when having regard to the purpose of the processing.
In relation to the processing of the complainant's telephone number for the purpose of sending
a text message to the complainant requesting feedback after their haircut, the NO SA notes that
Raise Gruppen AS has stated they are normally the controller in relation to processing activities
connected to the booking system (i.e. they have determinative influence in deciding the
purposes and means of processing). The NO SA further notes that Raise Gruppen AS did not
specifically elaborate on the legal basis relied upon for this processing activity. However, the
NO SA considers it is unlikely Raise Gruppen AS did not have a legal basis for this specific
processing activity, particularly as a customer relationship had been established at the time the
processing activity was carried out (i.e. after the complainant had received a haircut). The NO
SA deems that it would be disproportionate to investigate this part of the complaint any further.
Based on the above, the NO SA deems this case to be investigated to the extent appropriate and
did not identify any infringement of Article 6 GDPR. The NO SA therefore rejects the
Complaint, and considers the case closed.
The NO SA nonetheless considers that both Raise Norway AS and Raise Gruppen AS would
benefit from being reminded of their obligations under the GDPR. Therefore the NO SA will
send a separate letter to them pointing out the same, particularly in relation to identifying who
the controller is for a given processing activity, ensuring that transparent information is given
to data subjects as to how and why their personal data is processed and a controller's
responsibilities generally.
Right of appeal
As this decision has been adopted by the NO SA pursuant to Article 56 and Chapter VII GDPR,
it is not possible to appeal it before the Norwegian Privacy Appeals Board pursuant to Section
5
22 of the Norwegian Data Protection Act. This decision may nevertheless be appealed before
the Norwegian courts in accordance with Article 78(1) GDPR.
Kind regards
Tobias Judin
Head of Section
Sebastian Forbes
juridisk rådgiver
This letter has electronic approval and is therefore not signed
Copy to: Raise Gruppen AS and Raise Norway AS
6