I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M (thatprivacyguy.com)

Article summary

The author of the article, an expert in privacy law, had complained to the Swedish Data Protection Authority about Elkjop's customer club, which required members to receive marketing emails to remain members. The company was fined €1.8 million by the Norwegian Data Protection Authority for violating the GDPR. The fine was for forced consent and unlawful processing of personal data. The author is now considering further legal action, including a Representative Actions Directive claim.

Main themes

• GDPR enforcement
• Forced consent
• Data protection
• Privacy law
• Regulatory compliance
• Fines and penalties

What commenters say

• The fine imposed on Elkjop is a significant step towards enforcing GDPR compliance, but the lengthy process and lack of transparency from the regulatory authorities are concerning.
• The effectiveness of fines as a deterrent depends on their size and the company's profits, and in some cases, fines may be seen as a cost of doing business.
• Graduated fines, such as those in the GDPR, can be an effective way to prevent companies from profiting from non-compliance, but the 4% cap on fines may not be sufficient to deter large companies.
• Personal consequences, such as jail time for executives, may be necessary to ensure compliance with data protection regulations, especially in cases of repeat offenses.
• The cost of fighting the fine and potential future legal actions, including class action lawsuits, may ultimately be more significant than the fine itself.
• Some commenters argue that the focus on profits and fines misses the point, and that the goal should be to prevent harmful behavior, regardless of the company's financial gain.
• The incident highlights the importance of transparency and accountability in regulatory processes, including keeping complainants informed of the progress and outcome of their complaints.
• The fact that the company changed its practices after the complaint and fine suggests that regulatory action can be effective in driving change, but ongoing monitoring and enforcement are necessary to ensure continued compliance.