I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
8 hours ago
- #Data Protection Enforcement
- #GDPR Violation
- #Forced Consent
- In 2021, the author discovered that to stop marketing emails from Elgiganten Kundklubb, they had to cancel their membership entirely, which violates GDPR and ePrivacy rules by making consent to marketing a condition of membership.
- The author reported the issue to the company's Data Protection Officer and filed a complaint with the Swedish supervisory authority (IMY), which was later transferred to the Norwegian DPA (Datatilsynet) due to the one-stop-shop mechanism.
- In June 2026, Datatilsynet fined the Elkjop group NOK 20 million for invalid consent and unauthorized repurposing of personal data without proper assessment, confirming the author's initial allegations.
- The author criticizes the widespread practice of forced or bundled consent in the digital economy, emphasizing that such practices are unlawful under GDPR if users lose benefits by refusing consent.
- The author learned about the decision from a volunteer-run wiki, not from the authorities, and is demanding an explanation from IMY for failing to inform them, as required by GDPR Article 77(2).