DPA case PVN-2022-11 – Dismissed (Norway, 2022)

The data subject contacted the Norwegian DPA on 18 December 2020 due to a belief that unlawful entries had been made on her son's welfare record at the Child Welfare Service (the controller). The Norwegian DPA found no basis for conducting investigations in this area and recommended that the data subject re-direct any questions about municipality controls and routines for handling personal data to the municipality Data Protection Officer (DPO) and closed the case on 29 April 2021. The data subject was granted access to the child welfare records and proceeded to complain one more time to the DPA, asking to reassess the controller's handling of confidential personal data in an e-mail on 7 December 2021. The DPA held in its assessment that they did not possess the competence to assess who in the controller' office had legitimate access to the child welfare record and who did not. In particlar, the DPA did not have the competence to assess whether employees of the controller had acted in breach of the [https://www.regjeringen.no/en/dokumenter/the-child-welfare-act/id448398/ Child Protection Act]. Moreover, the DPA did not have the necessary professional expertise in child protection to assess which employees of the controller had an official responsiility to make entries in the journal. In practice, the DPA had no opportunity to review the controller's own assessment of the legality of the posting. Therefore, the DPA decided not to carry out investigations in this case because it fell outside the scope of the their area of responsibility outlined by Article 57(1)(a) GDPR. The data subject complained about the closing of the case to the Norwegian Privacy Appeals Board. The Norwegian Privacy Appeals Board (the Board) assessed the DPA's closure of the case due to lack of competence as a decision on rejection. A decision on rejection gives the right to appeal, according to [https://www.sdir.no/contentassets/83952ba07df145b18d035886ddd28bf0/public-administration-act.pdf?