Back in the summer of 2021 I was a member of the Elgiganten Kundklubb, the customer club the Elkjop group runs across the Nordics, and like a lot of members I was buried under marketing emails. So I did the obvious thing and went looking for a way to switch them off. What I found instead was the problem that has taken five years to put right - the only way to stop the marketing was to cancel my membership of the club altogether.
I wrote to their Data Protection Officer on 30th July and set out, in plain terms, why that arrangement breaks the law. Under Article 21(2) of the GDPR every person has an absolute right to object to direct marketing. Under the ePrivacy Directive, marketing by email is only lawful where I have given my consent, or where there is an existing customer relationship and I am offered a simple way to opt out both at the point my details are collected and in every message after that. And consent, to be worth anything at all, has to be freely given - which under Article 4(11) and Article 7 means it cannot be bundled into, or made a condition of, something else. Forcing me to surrender my membership and the benefits that come with it, just to exercise a right I already hold, is the textbook example of consent that is not freely given.
They put the violation in writing
The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission.
So I escalated. I served a formal restriction of processing under Article 18, I sent a full subject access request under Article 15 - the legal basis they were relying on, the legitimate interest balancing test, the recipients, the sub-processors, the international transfers, the profiling, all of it - and I filed a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), which issued the reference DI-2021-6660. The company's answer to all of this was to point me at a vague privacy policy, and then, when that did not wash, to stretch the deadline on my access request out to ninety days while citing "complexity" and "limited internal resources".
How a Swedish complaint became a Norwegian fine
This is where the machinery of the GDPR comes in. The customer club is run by the Norwegian parent, Elkjop Nordic AS, and on the facts it is the parent that holds the real decision making power over the purposes and the means of the processing. So in September 2022 IMY decided it was not the right authority to deal with this at all. Under the one-stop-shop in Article 56(1), the competent regulator is the one for the controller's main establishment, and that establishment sits in Norway. IMY handed the investigation and my complaint to Datatilsynet, the Norwegian DPA, which accepted the case. And then, as these things tend to, it went quiet for a very long time.
On 1 June 2026 it stopped being quiet. Datatilsynet fined the Elkjop group NOK 20 million, a little over €1.8 million, and it found precisely what I had told them in 2021. The consent the company was relying on for its customer club was not valid - it was forced, it was not specific, and members were not properly informed. On top of that, the company had taken the personal data it gathered through the club and put it to further use for advertising and conversion tracking, without ever carrying out the compatibility assessment that Article 6(4) demands before you repurpose people's data like that. The decision runs through Articles 4(11), 5(1)(a), 5(2), 6(1)(a), 6(1)(f) and 6(4) - the lawfulness, the fairness, the transparency and the accountability of the entire arrangement.
I want to be clear about why this matters well beyond one retailer and one fine. Forced consent, pay-or-consent, bundled consent, the whole "agree to everything or you cannot use the service" model - it is everywhere, and it is the default way an enormous part of the digital economy operates. It is also unlawful, for the same simple reason every single time - if you cannot say no without losing something you are entitled to keep, you have not freely consented to anything. Five years and a seven figure fine later, that point is now sitting in a published decision for anyone to read.
I had to read about it on a wiki
And yet there is a part of this story I am not willing to let slide, because it is its own small scandal.
I did not find out about this decision from IMY. I did not find out from Datatilsynet. I found out from GDPRhub, a volunteer-run wiki, on a random Thursday morning, nearly five years after I filed my complaint and well after the decision had already been made.
Under Article 77(2) of the GDPR a supervisory authority is under a binding legal obligation to keep a complainant informed of the progress and the outcome of their complaint. It is not a courtesy and it is not discretionary - it is written into the law. I filed my complaint with IMY, IMY passed it on, the case ended in a multi-million euro enforcement action, and not one of the authorities involved thought to tell the person who started it.
So this morning I wrote to IMY and asked them, in writing, to explain themselves. I have given them five working days. If the answer is what I suspect it will be, I will be filing under the European Union's infringement procedure, because a supervisory authority that cannot meet its most basic obligation to the people it exists to protect is exactly the sort of thing the Commission is supposed to look at. I have walked the Commission down this road before, over Phorm and the United Kingdom's failure to properly implement the EU rules on the confidentiality of communications, and I am entirely willing to do it again.
I have been saying for years that privacy is personal, and I mean it in the most literal way I can. This was my club membership, my inbox, my data and my complaint. The law was on my side in 2021 and it is on my side now. The company that told me to leave or put up with it has paid for that choice.
The only things still outstanding are an explanation from the Regulator that was meant to have my back the whole way through and civil litigation against Elkjop group now that the regulatory process has run its course - a litigation that is going to be so much more extensive now we have further details of further illegal processing of that personal data.
If they had listened to me in 2021, they would have avoided the fine, they would have made their processing lawful, they would have avoided the brand damage and the resulting litigation.
When I write to you as DPO with a complaint, it would be wise for you to take note. I am not a layperson, I am an expert on this law that I helped to create and I do not stop just because these actions are inconvenient, it is my life's work. Pay attention, when I write to you I am giving you free advice and you should treat as such instead of getting defensive and refusing to change.
