The Norwegian Data Protection Authority has issued the Norwegian Public Roads Administration a fine of 37,400 EUR (400 000 NOK) for processing personal data for purposes that were incompatible with the originally stated purposes, and for not erasing video recordings after 7 days.
The background of the fine is the extensive processing of personal data by using fixed road cameras to monitor contract parties, employees, subvendors and the subvendors’ employees.
The usage of such photos for documenting breaches of contract several months after the incidents took place, is incompatible with the original purpose, which was to make possible immediate security measures. It is therefore not allowed to use these video recordings to follow up contracts.
When evaluating whether this usage of the video recordings was compatible with the originally stated purpose, the Norwegian Data Protection Authority has emphasized that the new usage is at considerable disadvantage to the contract parties and its employees, and that it is in conflict with how the contract parties can expect the personal data to be used.