Datatilsynet – Court Ruling (Norway, 2023)

The data subject had been receiving unemployment benefits from NAV, the Norwegian Labour and Welfare Administration (the controller) since autumn 2015. With a decision of 2 October 2015, the controller suspended benefits to the data subject as he stated that he was in education, thus no longer entitled to receive them. Later, the data subject submitted more information stating that he was not an active student and the controller reassessed the case and started granting him benefits again from 30 November 2015. On 17 March 2016, the controller issued a new decision reversing its October 2015 decision to suspend benefits, so that the data subject was granted unemployment benefits also for the period of suspension. In relation to this, the data subject requested the controller to obtain access to his personal data and to rectify inaccurate data about him, namely the fact that he was in education or training while also receiving benefits, as stated in the decision of suspension of benefits of October 2015. On 26 May 2021, the controller refused to comply with the request for rectification of the data included in its decision of October 2015 as it added a note in that document referring to its corrected decision of March 2016. The data subject filed a complaint with the Norwegian DPA on 6 June 2021 asking the DPA to order the controller to provide him with all documents including his personal data and rectify inaccurate data about him and to assess any other GDPR violations by the controller. On 14 December 2021, the Norwegian DPA held that the controller could not comply with the data subject’s request to rectification/completion of his data according with Article 16 GDPR as the information was not per se incorrect and thus the first condition under Article 16 GDPR was not met. Given that the controller added a note to its decision of 2 October 2015 referring to its corrected decision of March 2016, it thus fulfilled the complainant’s request of rectification of his personal data. The data subject was dissatisfied with the DPA’s decision as it claimed that adding a note to a decision that references the corrected one cannot be considered rectification and decided to appeal. Thus, on 6 February 2023, the Norwegian DPA transferred the case to the Norwegian Privacy Appeals Board (Personvernnemnda) for review. On 15 September 2023, the Board considered the case and held that the two decisions concerning the suspension and granting of unemployment benefits issued by the controller must be seen in conjunction with one another. As regards the decision of October 2015, the Board held that the information included therein cannot be considered an objective factual error since that decision was based on evidence describing the data subject’s situation in that moment, namely that he was in education, as he submitted in his application for benefits. It follows that the information required to be corrected is not “incorrect” data and it thus falls outside the scope of Article 16 GDPR. In addition to this, the Board clarified that, with its decision of March 2016, the controller fulfilled the data subject’s request by supplementing its initial decision, and provided the correct information about the complainant. In the Board’s view, both decisions must be read together which translates as follows: the controller does not consider the data subject to be in education and it recognises its suspension of benefits of October 2015 to be unlawful, meaning that no incorrect information about the data subject was registered. The Board thus upheld the DPA's decision and concluded that the data subject does not have a right to claim rectification of his personal data by virtue of Article 16 GDPR as the condition for rectification set out in its first sentence is not met.