HURTIGRUTEN GROUP AS
Langkaia 1 Exempt from public disclosure:
0150 OSLO Offl. § 20 første ledd B
Your reference Our reference Date
21/02687-7 16.05.2024
'Sui Generis' Decision - Hurtigruten
On 27 July 2021, the Hamburg Commissioner for Data Protection and Freedom of Information
(“Hamburg SA”) shared with the Norwegian Data Protection Authority (“Datatilsynet”, “us”,
“our”) a complaint that (the “complainant”) lodged against Hurtigruten Group
AS (“controller”) with the Hamburg SA.
In March 2021, the controller wrote to the complainant to inform her about a data security
incident that affected the complainant’s passport information that the controller collected in
2018.
Following this communication, on 15 March 2021, the complainant wrote to the Hamburg SA
to complain about the excessive retention of her personal data from the part of the controller.
The complaint was shared through the Internal Market Information System (IMI) on 27 July
2021, and Datatilsynet was identified as the lead supervisory authority within the meaning of
Article 56(1) GDPR.
Further to our inquiry, it appears that some of the personal data of the complainant had indeed
been retained longer than was actually necessary for the purposes for which the personal data
had been processed. However, the controller informed us that this excessive retention of
personal data was due to an occasional oversight from their part, which the controller has
acknowledged and remedied since the complaint was lodged in 2021.
We have therefore sought to facilitate an amicable settlement with the controller in accordance
with Recital 131 GDPR, and encouraged the controller to reach out to the complainant for this
purpose.
On 29 February 2024, the controller wrote to the complainant to explain that the excessive
retention of her passport data was due to an occasional breach of the controller’s internal
routines, and to apologize for any inconvenience caused. The controller also offered the
complainant to cover any expenses related to the change of passport, and to provide further
assistance in relation to the incident.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
In light of the above, and given that the complainant has not responded to the above-mentioned
letter, we consider that the subject matter of the complaint has been investigated to the extent
appropriate in accordance with Article 57(1)(f) GDPR, and that the matter may be deemed to
be resolved to the complainant’s satisfaction. We have therefore decided to close the present
case in accordance with Article 60(7) GDPR and the requirements of Internal EDPB Document
06/2021 on the practical implementation of amicable settlements (adopted on 18 November
2021).
A draft of the present decision was shared with the complainant and with the other supervisory
authorities concerned in accordance with Article 60(3) GDPR. None of them has raised any
objections.
Kind regards,
Tobias Judin
Head of International
Luca Tosoni
Specialist Director
This letter has electronic approval and is therefore not signed
Copy to: Complainant
HmbBfDI
2