Norwegian Air Shuttle ASA

Norway's Data Protection Authority concluded that Norwegian Air Shuttle ASA violated data-protection rules by routinely requiring a copy of valid identification from a customer seeking to exercise GDPR access and erasure rights, despite lacking reasonable doubt about the person's identity. The authority issued a formal reprimand and stated that routinely requiring identification without sufficient reason was unlawful. The authority described the matter as closed on its side. Source: https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2024/irettesettelse-til-norwegian-etter-unodvendig-krav-om-legitimasjon/