[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdsVrzvEioWOQjNn8Hu1_JAAZPO8S9VGGkIWkKr8RRh4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41},"00dc0b1d-bada-493d-b84c-501385461d2c","pharma-company-fined-for-ignoring-gdpr-erasure-rights-and-obstructing-dpa-investigation","129d3558-8a0a-4598-9147-16bbbe2272ea","Pharma Company Fined for Ignoring GDPR Erasure Rights and Obstructing DPA Investigation","Lab Pharma AS continued to process an influencer's personal data beyond the contractual period and refused to honour a valid Article 17 GDPR erasure request, representing a fundamental failure in data lifecycle management. Compounding the violation, the company refused to cooperate with Norway's Datatilsynet and reportedly threatened DPA employees, escalating a compliance failure into active obstruction of a regulatory investigation. This case illustrates that data subjects' rights are legally enforceable obligations, not optional courtesies, and that non-cooperation with supervisory authorities carries its own significant penalties. Organizations must have clear, documented processes for managing personal data tied to third-party contracts and for responding lawfully to data subject requests within statutory timeframes.","**Immediate actions:**\n- Audit all active and recently expired contracts with influencers, freelancers, and third parties to identify personal data still being processed beyond the contractual basis.\n- Establish a formal Data Subject Rights (DSR) intake process to log, track, and respond to erasure requests within the GDPR-mandated 30-day window.\n- Brief legal and compliance teams on the duty to cooperate with supervisory authorities and the consequences of obstruction.\n\n**Long-term improvements:**\n- Implement a data retention and deletion schedule tied directly to contract expiry dates, with automated reminders to trigger data purging workflows.\n- Embed contractual data processing clauses that explicitly define permissible retention periods and deletion obligations upon termination.\n- Develop a regulatory engagement policy that mandates timely, respectful, and complete responses to all DPA information requests.\n\n**Training & governance measures:**\n- Train marketing and commercial teams on GDPR data subject rights, particularly the right to erasure and the conditions under which it applies.\n- Appoint or empower a Data Protection Officer (DPO) with sufficient authority to enforce compliance decisions, including data deletion, against internal resistance.\n- Conduct annual mock DSR and DPA-inquiry drills to ensure staff know the correct escalation and response procedures.",[12,13,14,15,16,17,18,19,20],"GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 31 – Cooperation with the supervisory authority","GDPR Article 5(1)(e) – Storage limitation principle","GDPR Article 58 – Powers of the supervisory authority","NIST Privacy Framework PR.DS-P4 – Data retention and disposal","NIST SP 800-53 IP-3 – Redress (individual rights management)","CIS Control 3 – Data Protection (data retention and disposal)","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL Service Management – Supplier and contract lifecycle management","published","2026-08-21T14:20:24.445384+00:00","2026-08-21T14:20:24.341+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_23\u002F00435-62&diff=52754&oldid=52749","datatilsynet-norway-23-00435-62-34df75","Datatilsynet (Norway) - 23\u002F00435-62",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]