Datatilsynet Fines Elkjop Nordic AS NOK 20 Million for Invalid Forced Consent

The complaint originated in July 2021 when a Swedish member could not stop marketing without cancelling Elgiganten Kundklubb membership. IMY referred the case under Article 56 to Datatilsynet as lead authority for the Norwegian controller. The decision records the company's written admission that membership was required to receive offers and documents further repurposing of club data for tracking absent compatibility assessment. Datatilsynet's findings align with EDPB Guidelines 05/2020 on consent and mirror enforcement patterns in the 2023 Meta Ireland case (EDPB binding decision 01/2023) where bundled consent was invalidated. The five-year timeline from IMY reference DI-2021-6660 to final fine shows supervisory authorities now closing long-open files on loyalty programs that condition rights exercise on continued membership. Operational impact extends to all EU-facing retailers using similar clubs. Companies must separate marketing consent from membership benefits and perform Article 6(4) assessments before secondary use. Failure to provide unconditional opt-out under Article 21(2) now carries documented financial risk beyond warning letters. Future audits will likely target remaining Nordic and EU loyalty schemes that still link email marketing to active membership status. Regulators have signalled continued enforcement against pay-or-consent structures following this precedent.