The Norwegian Data Protection Authority has sent to Odin Flissenter a notice of order and an infringement fee of NOK 300 000. The case concerns the credit rating of a sole proprietorship without a basis for processing.
A sole proprietorship was credited without having any kind of customer relationship or other connection to Odin Flissenter.
Must have a valid processing basis
Credit information about a sole proprietorship is also personal data, as the owner is directly identified with the undertaking and this is directly linked to the owner’s private finance. This means that one must have a basis for processing to credit assess sole proprietorships.
A credit rating is the result of the compilation of personal data from many different sources, and shows a number indicating the probability that a person or sole proprietor will pay a claim. A credit rating will also show details of the company’s finances, such as any payment remarks, voluntary mortgages and debt ratios.
– Credit information about sole proprietorships can be used to derive information about the owner’s private finances. It is therefore private information that the owner has an expectation that is not collected by businesses unless it is substantively justified – says legal adviser Ole Martin Moe.