Elkjøp fined 1.78 million euros for GDPR violations in Norway

The Norwegian Data Protection Authority, Datatilsynet, has imposed a fine of approximately 1.78 million euros on the electronics retailer Elkjøp for violations of the General Data Protection Regulation (GDPR).

The investigation focused on the company’s customer club, finding that members were not sufficiently informed about the extent of their data processing during registration. Specifically, the authority noted that consent for data processing was not properly separated from the acceptance of general terms and conditions, and the purpose of the data usage remained too vague.

Furthermore, the regulator criticized Elkjøp’s customer personalization processes. The company merged internal customer data with data from third-party platforms for advertising purposes, using data originally collected for club membership to facilitate profiling and targeted marketing. This was deemed a violation of transparency, purpose limitation, and effective consent requirements.