Norway’s Data Protection Authority (Datatilsynet) has imposed a NOK 20 million (approximately $2.1 million) administrative fine on electronics retail giant Elkjøp for multiple GDPR violations tied to its customer club, targeted marketing activities, and handling of customer privacy requests.
The regulator found that the company relied on invalid consent mechanisms, lacked a lawful basis for certain advertising tools, and failed to process data subject requests within legally required deadlines.
The decision follows an on-site inspection conducted at Elkjøp’s Oslo offices in June 2022 after Datatilsynet received breach notifications, complaints, and tips concerning the retailer’s customer club. Investigators reviewed the company’s processing of customer information, including marketing practices, profiling activities, and procedures for handling privacy rights requests.
According to Datatilsynet, Elkjøp’s customer club relied on a consent model that failed to meet GDPR requirements. Investigators concluded that the consent obtained from customers was neither specific, informed, nor freely given. Membership bundled together multiple data processing activities, including newsletters, SMS marketing, profiling, personalization, and analytics, without allowing users to separately consent to individual purposes. The authority also found that customers were presented with promises of discounts and benefits while receiving insufficient information about the profiling and analytics performed on their data.
Elkjøp is the largest consumer electronics retailer in the Nordic region, operating more than 400 stores across Norway, Sweden, Denmark, Finland, Iceland, the Faroe Islands, and Greenland under several regional brands, including Elkjøp, Elgiganten, and Gigantti.
A major concern for the regulators was the retailer’s use of Google’s Customer Match advertising platform. Datatilsynet found that customer information collected through the customer club was later used for audience matching and targeted advertising without a valid legal basis. The regulator determined that customers could not reasonably expect their data to be repurposed for advertising campaigns involving third-party platforms, particularly when such uses were not covered by the original consent.
The investigation also examined Elkjøp’s use of “Offline Conversions,” a marketing measurement technique that sends customer purchase data to platforms such as Google and Meta to determine whether online advertisements led to in-store sales. While Datatilsynet stopped short of ruling on the legality of the tool itself, it found that Elkjøp had failed to adequately document and assess its claimed legitimate interest basis. The authority said the company’s assessment omitted factors such as the number of affected individuals, processing of children’s data, customer expectations, and the potential consequences of sharing information with advertising companies.
Another violation involved the company’s handling of customer privacy requests. Datatilsynet discovered that some requests remained unresolved for months, and in some cases more than a year. The retailer routinely categorized email address correction requests as “complex,” automatically extending the GDPR’s one-month response deadline. Regulators concluded that such blanket extensions were unlawful and that Elkjøp failed to respond to certain requests even within the maximum three-month period permitted under the GDPR.
Some of the affected data subjects were children, which the regulator considered an aggravating factor. Investigators found that the customer club accepted members as young as 15 years old at the time of the inspection but lacked effective mechanisms to verify age.
Although the authority described the infringements as being at the lower end of moderate severity, it determined that the violations touched core GDPR principles and affected a large number of individuals. Datatilsynet also acknowledged mitigating factors, including improvements implemented by Elkjøp after the inspection and the lengthy duration of the investigation, which contributed to a reduction in the final penalty amount.
Leave a Reply