Datatilsynet – Court Ruling (Norway, 2023)

The data subject had been receiving unemployment benefits from NAV, the Norwegian Labour and Welfare Administration (the controller) since autumn 2015. With a decision of 2 October 2015, the controller suspended benefits to the data subject as he stated that he was in education, thus no longer entitled to receive them. Later, the data subject submitted more information stating that he was not an active student and the controller reassessed the case and started granting him benefits again from 30 November 2015. On 17 March 2016, the controller issued a new decision reversing its October 2015 decision to suspend benefits, so that the data subject was granted unemployment benefits also for the period of suspension. In relation to this, the data subject requested the controller to obtain access to his personal data and to rectify inaccurate data about him, namely the fact that he was in education or training while also receiving benefits, as stated in the decision of suspension of benefits of October 2015. On 26 May 2021, the controller refused to comply with the request for rectification of the data included in its decision of October 2015 as it added a note in that document referring to its corrected decision of March 2016. The data subject filed a complaint with the Norwegian DPA on 6 June 2021 asking the DPA to order the controller to provide him with all documents including his personal data and rectify inaccurate data about him and to assess any other GDPR violations by the controller. On 14 December 2021, the Norwegian DPA held that the controller could not comply with the data subject’s request to rectification/completion of his data according with Article 16 GDPR as the information was not per se incorrect and thus the first condition under Article 16 GDPR was not met. Given that the controller added a note to its decision of 2 October 2015 referring to its corrected decision of March 2016, it thus fulfilled the complainant’s request of rectification of