Ultra-Technology AS fined

The background to the fine is a complaint from a private individual who has undergone a credit assessment without any form of customer relationship or other connection to the company Ultra-Technology AS.

The General Data Protection Regulation requires all processing of personal data to have a legal basis. Credit information is a type of personal data that is especially worthy of protection.

Lacks legal basis

A credit rating is the result of a compilation of personal data from many different sources and shows the likelihood of a person being able to pay an outstanding claim. A credit rating will also reveal details about the person’s financial status, such as any overdue payments/defaults on loans, mortgages and debt-to-income ratio.

Upon investigating this matter, we have concluded that the credit rating was performed without a legal basis, in violation of the requirements of the General Data Protection Regulation. The undertaking did not have a legitimate interest in performing a credit rating.

Offensive

The Norwegian Data Protection Authority’s 2020 survey showed that people consider information about their personal finances to be especially worthy of protection.

- Because a credit rating contains details about personal finances, it is considered to be unacceptably intrusive when a business uses this information without any legal basis, says Bjørn Erik Thon, General-Director of the Norwegian Data Protection Authority.

- We receive many complaints concerning credit ratings, and we see that many organisations are not sufficiently aware of the rules. It follows from a long-standing practice at the Norwegian Data Protection Authority and the Privacy Appeals Board that CEOs may not use their company’s credit rating tools for private purposes. We take these matters very seriously and normally issue fines for this type of violation, says Bjørn Erik Thon.