Lab Pharma AS

Summary

The Norwegian DPA has imposed a fine of EUR 18,745 on Lab Pharma AS. The controller runs an online store selling dietary supplements. In 2016, the controller signed a one-year marketing contract with an influencer, allowing them to use the influencer's content on their website. After the contract expired, however, the controller continued to use the data subject's name, images, and product reviews on their Norwegian, Danish, Swedish, and Finnish websites. After the contract expired, the data subject requested the removal of all their personal data. As the controller did not comply with this request, the data subject filed a complaint with the authority. The authority found that, after the contract had expired, the controller did not have a legal basis for processing the data. The controller was fined for not cooperating with the authority. During the investigation, the controller obstructed the authority by threatening lawsuits against its employees, demanding that the case be closed, and missing deadlines.