¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Exempt from public disclosure:
Offl § 13 jfr Popplyl. § 24
Your reference Our reference Date
20/02425-8 02.05.2023
Avslutning av sak - L'AMOURBOX ApS
Datatilsynet viser til din klage av 14. februar 2019 angående L'AMOURBOX ApS (sak
20/02425). Dette er en sak som måtte håndteres av datatilsynet i Danmark der virksomheten
har hovedkontoret sitt, jf. personvernforordningen artikkel 4 nr. 23 og artikkel 56 nr. 1.
Om saksbehandlingen
Datatilsynet i Danmark har gjort undersøkelser i saken ved å ta kontakt med L'AMOURBOX
ApS. Etterpå samarbeidet de med oss om å vurdere saken basert på klagen din og øvrig
informasjon du har gitt oss, i tillegg til svaret fra virksomheten. Vi har i fellesskap fattet
avgjørelse i saken, i henhold til personvernforordningen artikkel 60.
Avgjørelsen
Den felles avgjørelsen fra det norske og danske datatilsynet følger under. Avgjørelsen er
skrevet på engelsk, men vi kan bistå med å oversettelse dersom det er ønskelig. I så fall ber vi
deg om å ta kontakt.
Overprøving av vedtaket
Ettersom dette er en grenseoverskridende sak og en endelig beslutning er truffet, er det ikke
mulig å klage på vedtaket etter forvaltningsloven. Det følger av personopplysningsloven § 22
annet ledd annet punktum at vedtak som utarbeides gjennom samarbeid mellom ledende
tilsynsmyndighet og andre berørte tilsynsmyndigheter ikke kan påklages til
Personvernnemnda. Du kan imidlertid bringe saken inn for domstolene dersom du mener at
vedtaket er feil eller ugyldig.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
Decision
The Norwegian Data Protection Authority, Datatilsynet (“Norwegian DPA”) refers to
the complaint against L'AMOURBOX ApS you submitted on 14 February 2019
concerning the fact that, in February 2019, by accessing the chat function on
www.lamourbox.no, you could access other customers’ previous chat history with
L’AMOURBOX, in which information about the customer’s name, address and
possible purchases appeared.
After having reviewed your complaint, the Norwegian DPA concluded that your
complaint concerned a cross-border processing of personal data (within the meaning
of Article 4(23) of the General Data Protection Regulation (GDPR)), which meant that
the case had to be processed in cooperation with the supervisory authorities of other
EU/EEA Member States in accordance with Article 60 GDPR.
In cases that concern a cross-border processing of personal data, the supervisory
authority of the main establishment or of the single establishment of the relevant
company – which in this case is located in Denmark – shall be competent to act as lead
supervisory authority. Thus, in the present case, the Danish Data Protection Agency
(“Danish DPA”) acted as lead supervisory authority.
While handling the case, the Danish DPA asked L’AMOURBOX on 9 August 2022 if
other customers had unauthorized access to your personal data via the chat function on
L’AMOURBOX’s website.
The Danish DPA received an answer from L’AMOURBOX on 22 August 2022,
which stated that a technical fault in its chat function allowed its customers to have
unauthorized access to other people’s chats for a short period of time. However,
L’AMOURBOX has not confirmed that other customers had unauthorized access to
your personal data via the chat function. The Danish DPA informed the Norwegian
DPA about the inquiry on the same day.
After examining the case, the Danish DPA found that there were no grounds for the
Danish DPA to take further action regarding the case. This was due to the fact that
Section 39(1) of the Danish Data Protection Act states that a data subject can only
lodge a complaint with a supervisory authority regarding processing of data relating to
him or her. Conversely, a data subject cannot lodge a complaint with a supervisory
authority regarding the processing of data that does not relate to him or her.
In light of the information provided by L’AMOURBOX’s and the Danish DPA’s
inquiry in to the matter at hand, it may not be concluded that other customers had
unauthorized access to your personal data, and thus that the processing described in
your complaint relates to you. On this basis, your complaint shall be rejected.
2
The Norwegian DPA will take no further action regarding the case and considers it to
be closed. However, it takes note of the information you provided in your complaint,
which may be used for future investigative purposes.
As this decision has been adopted pursuant to Article 56 and Chapter VII GDPR, the
present decision may be appealed before Oslo District Court (“Oslo tingrett”) in
accordance with Article 78(1) GDPR, Article 25 of the Norwegian Data Protection
Act, and Article 4-4(4) of the Norwegian Dispute Act.
Vennlig hilsen,
Tobias Judin
seksjonssjef
Luca Tosoni
juridisk fagdirektør
This letter has electronic approval and is therefore not signed
3