Norwegian Retailer Fined €1.83M for GDPR Consent and Data Processing Violations

Elkjøp Nordic was fined for fundamental GDPR compliance failures including obtaining invalid consent for their customer club membership, improperly using customer matching tools for advertising, and failing to adequately assess offline conversion tracking practices. The company also delayed responses to data subject access requests, violating individuals' rights under GDPR. These violations demonstrate how poor data governance and inadequate privacy controls can result in significant financial penalties and reputational damage.

Tactical Insight

Immediate actions

Audit all current consent mechanisms to ensure they meet GDPR validity requirements
Review and suspend any customer matching or tracking tools that lack proper legal basis
Establish dedicated processes to handle data subject rights requests within regulatory timeframes

Long-term improvements

Implement comprehensive Data Protection Impact Assessments (DPIAs) for all data processing activities
Deploy privacy management software to automate consent collection and data subject request handling
Train marketing and IT teams on lawful bases for data processing and privacy-by-design principles

Monitoring measures

Set up automated alerts for data subject request response deadlines
Conduct regular privacy compliance audits with external assessors
Monitor consent withdrawal rates and processing activity logs for compliance gaps