Logo and page links

Main menu

Fine and order to establish procedures after unlawful credit rating

The Norwegian Data Protection Authority has decided to fine T. Stene Transport AS NOK 40,000 (EUR 4,000) after unlawfully performing a credit rating of a sole proprietorship. The company is also ordered to establish procedures for when it is appropriate to perform a credit rating.

A credit rating is a compilation of personal data from many different sources and shows the likelihood of a person or enterprise being able or willing to pay an outstanding claim.

A credit rating will also reveal details about the enterprise’s financial status, such as any payment remarks, its debt-to-income ratio and whether the enterprise has any mortgages.

Must have legal basis

Credit information about a sole proprietorship also constitutes personal data, as the owner is immediately identified with the enterprise, and the enterprise is directly linked to the owner’s personal finances.

This means that a valid legal basis is required to subject sole proprietorships to a credit rating.

Must establish procedures for credit ratings

In general, we believe procedures would create awareness and promote compliance with regulations. In this case, the company had not previously used the credit rating tool. Consequently, they were ordered to establish procedures, even though they did not routinely perform credit ratings.