Elkjop Fined €1.8M for Forced Consent Violation

The Elkjop group was recently fined €1.8 million by the Norwegian Data Protection Authority, Datatilsynet, for violating the General Data Protection Regulation (GDPR) by forcing customers to consent to marketing emails in order to be part of their customer club. This decision comes after a complaint was filed in 2021, highlighting the unlawful practice of bundling consent for marketing with membership benefits. The fine serves as a reminder of the importance of obtaining freely given and specific consent from individuals for data processing. The case emphasizes the need for organizations to respect the rights of individuals and adhere to the principles of data protection.

## What happened The complaint was initially filed with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), but was later transferred to Datatilsynet due to the Norwegian parent company's role in the data processing. The investigation revealed that Elkjop's customer club membership was conditioned on consent to receive marketing emails, which is a violation of the GDPR's requirement for freely given consent. The company also failed to conduct a compatibility assessment before repurposing personal data for advertising and conversion tracking. ## Why it matters The Elkjop case highlights the significance of ensuring that consent is freely given, specific, and informed. The GDPR emphasizes the importance of respecting individuals' rights and freedoms, particularly in the context of data processing. The fine imposed on Elkjop serves as a warning to organizations to prioritize data protection and adhere to the principles of transparency, accountability, and fairness. ## How to think about it Organizations should prioritize transparency and accountability in their data processing practices, ensuring that individuals are fully informed and able to provide freely given consent. This can be achieved by implementing clear and concise consent mechanisms, providing easy-to-understand information about data processing, and establishing robust data protection policies. ## FAQ