First infringement penalty for failing to comply with the Transparency Act – and it bites!

Upon written request, any person has the right to information from companies covered by the Transparency Act about how the company addresses actual and potential adverse impacts on human rights and decent working conditions. Companies shall as a main rule provide answers to information requests within a reasonable time and no later than three weeks after the request has been received. 

As a result of a retail company's two failures to respond to information requests on time, a penalty of 450,000 NOK, equivalent to 0.2 % of the company's turnover (based on 2023 total sales income), was imposed. 

Considering that the Consumer Authority is authorised to issue fines of a maximum of 4 % of the annual turnover or up to 25 million NOK – whichever is higher, and only in case of "repeated infringements", imposing a fine of this size for two instances of not responding on time, certainly bites. If this is representative for how the Consumer Authority intends to react to failures to comply going forward, the bar is set high, also for how in-scope companies should work with the Transparency Act in order to ensure compliance. 

The Consumer Authority's decision is reported to have been appealed to the Market Council.

The right to information

Anyone who submits a written information request to a company subject to the Transparency Act shall, as a main rule, receive a written response within a reasonable timeframe and no later than three weeks from the date the request was received by the company. The sender of the information request is not required to justify the request. 

The request must relate to how the company addresses actual and potential adverse impacts on human rights and decent working conditions, in light of the company's human rights due diligence. The obligation to provide information generally does not cover specific factual information (such as production sites, number of work hours and hired-in workers), but providing specific information may in certain circumstances, based on a concrete assessment, be necessary in order to give adequate information about actual adverse impacts. 

Questions that do not relate to the company (either to the operations directly or via the suppliers and business partners), or are not related to fundamental human rights or decent working conditions, fall outside of the scope of the Transparency Act. Whether such questions should be responded to, would largely depend on the general communication policies of the company. 

Notably, an information request is considered to be received by the company regardless of which specific employee it was addressed to and through which communication mean the written request has been sent. For example, it could be sent to any employee's e-mail address, through online portals, letters, or similar.

Information requests can be handled in three ways:

• Providing a substantive response to the request no later than three weeks after it has been received. The response must be adequate and comprehensible.
• Extending the deadline for providing a response if answering within three weeks is disproportionally burdensome. The person requesting information must be informed of the extension within three weeks, and a substantive response must then be provided within two months.
• Rejecting the request. 

Information requests may be rejected if: 

• The request provides an insufficient basis for identifying what the request concerns.
• The request is clearly unreasonable.
• The requested information concerns data relating to the personal affairs of one or more individuals.
• The requested information concerns data regarding technical devices and procedures or other operational and business matters which for competitive reasons it is important for the company to keep secret.
• The requested information is classified pursuant to the Norwegian Security Act or protected pursuant to the Norwegian Intellectual Property Rights Act.

A rejection of the request must be done in writing within three weeks. However, information requests concerning any actual adverse impacts on fundamental human rights known to the company, shall be given a substantial response, and are not exempted.

In case of repeated infringements of the duty to respond to information requests, an infringement penalty may be imposed. The penalty may be up to a maximum of 4 % of the company's annual turnover, or up to NOK 25 million, whichever is higher.

About the decision

The company subject to the Consumer Authority's decision to impose an infringement penalty, is a retail clothing business which on two occasions had failed to respond to information requests on time. 

After the company's first failure to respond to an information request, the Consumer Authority engaged in dialogue with the company in November 2023. In February 2024, the Consumer Authority decided to close the first case in light of the company's recognition of not having responded on time, and after having submitted documentation that the company had taken measures to comply with their duties going forward. However, in April 2024, merely two months after the first case was closed, the Authority holds that the company again failed to answer to an information request on time. On 25 September 2024, the Consumer Authority issued the infringement penalty for the two instances of not responding to information requests on time.

As a basis for their decision, the Consumer Authority emphasised: 

• The company had breached the duty to provide information on two separate occasions, meaning that there were repeated offences. There is no requirement that the breaches also have to be consistent, i.e. it is not required that a company consistently fails to comply with the deadlines for responding to information requests.
• It is a requirement that the company, i.e. person(s) acting on the company's behalf, must at least have acted negligently with regards to the factual circumstances that form the basis for the infringement penalty. This follows from Section 46, first paragraph, of the Public Administration Act (Norw. "Forvaltningsloven"), which, in the Consumer Authority's opinion, takes precedence over the near objective requirement of guilt for businesses under Section 14, second paragraph, of the Transparency Act.  
• In this case, the Authority held that one or more persons who acted on behalf of the company acted wilfully in connection with the offences in this case. More concretely, the Authority concluded (our translation): 

"When the company received and was aware that the enquiry had been received at the time of the action, in our view there is a clear preponderance of probability that someone acting on behalf of the company intentionally failed to provide information within the expiry of the deadline."

• The fact that the company after the deadlines for responding to the information requests did in fact provide answers, was irrelevant for concluding that violations did indeed occur at the time the deadlines expired. 
• The Consumer Authority did not agree with the company's objections that their failures to respond to the information requests were due to "actual ignorance" on the part of those who acted on behalf of the company, as the enquiries were perceived as something other than information requests. The Authority held that ignorance of legal rules (Norw. "rettsvillfarelse") does not exempt from liability when the ignorance is negligent. 

The company had argued that infringement penalties under the Transparency Act are intended for more serious, systematic and extensive violations of the Transparency Act than the violations in this case. The company also held that it is a prerequisite for imposing an infringement penalty that the Consumer Authority first has used less intrusive measures and that it then must be clear that a company will still not comply with the deadlines set out in the Transparency Act. 

The Consumer Authority held that the use of less restrictive measures is not an absolute condition for the imposition of an infringement fee, but rather a factor that is relevant when assessing the need for a decision in each case. In any event, less intrusive measures had been taken in this case through the handling of the initial case which was closed in February 2024.

With respect to the size of the fine the company had argued that the violations were very limited and a result of actual ignorance. The Consumer Authority did not accept these arguments. Rather, they emphasised that since the company failed to provide the information seekers with the information they are entitled to under Section 6 of the Transparency Act at the time of the offences in question, the offences could not be considered to have been "very limited" either individually or collectively. The handling of the information requirements in this specific case meant that the requirements set for companies' handling of information requirements under Section 7 were not complied with, and that the information seekers did not receive the information they are entitled to within the statutory deadlines.

Key takeaways

Through their decision, the Consumer Authority sends a clear message to companies subject to the Transparency Act that a failure to comply will have consequences. The Authority stated that (our translation): 

".. it is necessary to impose an administrative fine in this case in order to make it clear to those subject to the Transparency Act that businesses cannot wait to operate in accordance with the Act before the Consumer Authority contacts them in connection with our exercise of authority."

The Authority also referred to that companies are expected to organise their business in such a way that it complies with applicable laws within the relevant business area. With respect to information requests more concretely, the Authority held that employees who may receive or assess information requirements must be expected to be trained in and familiar with what constitutes an information requirement under the Act.

In light of the Consumer Authority's decision, and in order to avoid breaching the Transparency Act's duty to provide information, in-scope companies should make sure:

• They have robust procedures for how to handle information requests
• Their employees know how to identify an information request and how to handle it in a timely manner
• Relevant employees receive training
• The company is prepared for how to respond to information requests

There is no requirement that the sender has to label their question "Information Request under the Transparency Act" or similar. It is pertinent to ask the question whether you feel comfortable that employees in your organisation know how to identify information requests and know how to react if they receive such requests. If not, it is certainly prudent to strengthen your procedures and raise awareness in your organisation on this issue. This is particularly relevant for large companies with hundreds or thousands of employees, where it may be more challenging to ensure that all relevant persons are aware of how to handle information requests.

It is worth noting that the retail company subject to the Consumer Authority's decision, explained to the Authority that it is hit by numerous and ever-increasing sustainability requirements from both national authorities and the EU, and that it is a demanding administrative task to handle such regulations as well as the information requirements under the Transparency Act. Even if the organisation has the best intentions, human error can occur. 

These are typical challenges and practical issues faced by companies. However, as illustrated by the Consumer Authority's decision, the Consumer Authority did not allow them to take precedence over legal requirements. 

Our ESG, compliance and risk management team has extensive experience with the Transparency Act, and regularly assists companies on how to ensure compliance with the Transparency Act. Please reach out if you have any questions.