Unofficial English translation of the
original Norwegian version
Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven §
24 første ledd 2. punktum
Your reference Our reference Date
21/00418-16 20.01.2025
Rejection of complaint and closure of case – IF Skadeförsäkring AB
The Norwegian Data Protection Authority refers to your complaint received by us on 15
January 2021 regarding the sharing of your personal data in connection with the sale of a debt
to Lindorff, as well as our last e-mail to you regarding this matter on 1 November 2023.
Decision
The Norwegian Data Protection Authority rejects your complaint pursuant to Article 60(8) of
the GDPR.
Background
This is a so-called cross-border case which, pursuant to the GDPR, is subject to different case
handling rules compared to normal cases (see Articles 4(23) and 56(1) of the GDPR).
The case is cross-border because IF Skadeforskiring NUF is an establishment of IF
Skadeförsäkring AB. IF Skadeförsäkring AB is a company with establishments in more than
one EEA country and the processing in question takes place in the context of the activities of
such establishments. To ensure uniform application of the GDPR in the EEA, data protection
authorities across the EEA must cooperate in the handling of cross-border cases.
The Data Protection Authority in Sweden, Integritetsskyddsmyndigheten, has acted as lead
supervisory authority in the handling of your complaint. We and the Data Protection
Authority in Denmark have participated in the handling of your complaint as concerned
supervisory authorities.
Begrunnelse for vedtaket vårt
The lead supervisory authority has investigated the subject matter of your complaint to the
extent appropriate in accordance with Article 57(1)(f) of the GDPR and, based on such
investigation, they have not found any reason to suspect infringement of the GDPR. The lead
Postadresse: Kontoradresse: Telefon: Org.nr: Hjemmeside: 1
Postboks 458 Sentrum Trelastgata 3 22 39 69 00 974 761 467 www.datatilsynet.no
0105 OSLO 0191 OSLO
supervisory authority has therefore concluded that your complaint should be rejected and that
the case should be closed. All concerned supervisory authorities, including us, agree with
such conclusion.
The lead supervisory authority’s reasoning for why your complaint should be rejected follows
below. As this case is cross-border the reasoning is written in English. We can assist with
translation if you wish. If so, please contact us.
You have lodged a complaint with the Norwegian Datatilsynet against IF
Skadeförsäkring AB (IF). The complaint has been submitted to the Swedish Data
Protection Authority (IMY), which is the lead supervisory authority pursuant to Article
56(1) of the General Data Protection Regulation (GDPR).1
IMY shall process complaints about incorrect processing of personal data and, where
appropriate, investigate the subject matter of the complaint Article 57.1 f GDPR.
The main points of your complaint are as follows. You claim that IF has handled your
personal data in violation of the GDPR when handing over information about you to a
debt collection company because of unpaid insurance invoices without your consent.
In order for personal data processing to be lawful, the controller must have a legal
basis for the personal data processing according to article 6 and comply with the
basic principles under article 5 in the GDPR. Consent is only one of a total of six
legal grounds that can make processing of personal data lawful. Consent is not always
required for the processing of personal data to comply with the GDPR. IMY considers
that what is stated in the complaint does not give reason to question that the
processing in question has been supported by any of the other legal bases in the
GDPR or that it has otherwise not been compliant with the GDPR. Therefore, what
you have stated does not give IMY reason to suspect any deficiency in relation to the
provisions of the GDPR. The case should therefor be closed.
As your complaint is to be rejected, the supervisory authority that received your complaint –
in this case us – is the one which will adopt the final decision pursuant to Article 60(8) of the
GDPR.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the
GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant
to Section 22(2) of the Norwegian Personal Data Act (in Norwegian:
personopplysningsloven). This decision can nevertheless be challenged before Norwegian
courts in accordance with Article 78(1) of the GDPR.
1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the free movement of
such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2
Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian
Public Administration Act regarding the information they receive about the complainant’s
identity, personal matters and other identifying information, and such information can only be
used to the extent necessary to safeguard their interests in this case. Any breach of this duty of
confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
Kind regards
Tobias Judin
Head of Section
Sebastian Forbes
Senior Legal Adviser
This document is electronically approved and therefore does not require a handwritten
signature.
Copy to: IF SKADEFORSIKRING NUF
3