BRANDSDAL GROUP AS
Postboks 8104 Exempt from public disclosure:
4675 KRISTIANSAND S Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
20/02313-9 14.02.2024
Closure of case – Brandsdal Group AS
I. Introduction
On 5 March 2020, the Finnish Data Protection Authority (“Tietosuojavaltuutetun Toimisto”,
“Finnish SA”) transferred a complaint to the Norwegian Data Protection Authority
(“Datatilsynet”, “we”, “our”). The complaint was lodged by (“the
complainant”) against Brandsdal Group AS (“Brandsdal Group”). Brandsdal Group is a
Norwegian e-commerce company that operates the website www.cocopanda.fi
(“Cocopanda”).
II. Factual background – the complaint
The complainant stated that Cocopanda cancelled her order due to suspicion of fraud. In order
for the complainant to regain access to her account, Cocopanda asked her to verify her
identity by sending a picture of her ID card via unencrypted email. The complainant did not
consider this a secure way to verify her identity. Furthermore, the complainant requested
Cocopanda to erase her personal data pursuant to Article 17 GDPR. The complainant claims
that Cocopanda did not comply with her erasure request.
III. Inquiry by the Norwegian Data Protection Authority
On 18 May 2020, the Norwegian Data Protection Authority sent an order to provide
information to Brandsdal Group, inquiring about the issues brought up in the complaint. In
their response, Brandsdal Group stated that they do not require customers to verify their
identity by sending a picture of their ID cards via unencrypted email – there are alternate
ways to upload this verification if the customer views email as an unsecure channel of
communication. Furthermore, Brandsdal Group stated that they did not reject the
complainant’s request for erasure. This fact was also communicated to the Finnish SA.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
IV. Closure of case
On 18 December 2023, we asked the Finnish SA to forward a letter to the complainant. The
letter informed the complainant about the delay in our processing of the complaint due to a
lack of resources. On 21 December 2023, the Finnish SA informed us that they had forwarded
the letter to the complainant and received a response. The complainant stated that she has
settled the case with Cocopanda.
Taking into account that the complainant has settled the case with the controller, effectively
mooting the issues raised in the complaint, and that the complainant did not express any wish
to pursue the matter further, we consider that the matter has been resolved to the
complainant’s satisfaction and will close the case.
In light of the above, we consider that the subject matter of the complaint has been
investigated to the extent appropriate in accordance with Article 57(1)(f) GDPR, and that the
matter may be deemed to be resolved to the complainant’s satisfaction. We have therefore
decided to close the present case in accordance with Article 60(7) GDPR.
Kind regards
Tobias Judin
Head of Section
Trine Smedbold
Senior Legal Adviser
This letter has electronic approval and is therefore not signed
2