DPA case PVN-2022-19 – Dismissed (Norway, 2023)

Information of the ethnicity of a child's parent (the data subject) appeares in a journal note of the child welfare services of a Norwegian municipality (the controller). The journal note is a reproduction of what information the data subject themself had provided to the controller. Additionally, the data subject had expressed to the controller that they feel that the child welfare case is about racism and represents a witch hunt against them from the municipality's side because of their family's belonging to a minority group. The data subject requested the controller to delete information on their ethnicity pursuant to Article 17 GDPR from their child's records, because they viewed that such information was irrelevant with regard to the controller handling their child's case. The controller refused to delete the information, because it argued to have a statutory obligation to document and archive the information under national law. The data subject complained about the controller's refusal to delete the data to the Norwegian DPA. The DPA found that the exceptions under Article 17(3)(b) and (d) GDPR applied in this case, since the controller had vuewed the information as worthy of archiving in accordance with archiving obligations laid down by national law. Therefore, the Norwegian DPA held that the controller had not violated the data subject's right to erasure under Article 17 GDPR by refusing to delete the data. The data subject complained about the DPA's decision. The case was transmitted the to the Norwegian Privacy Appeals Board for an assessment. In its decision, the Norwegian Privacy Appeals Board clarified that Article 17(3)(b) GDPR makes an exception to the right to erasure when the processing of personal data is necessary to fulfill a legal obligation and Article 17(3)(d) GDPR when the processing is necessary for archival purposes in the public interest. Furthermore, the board found that, since the case had been closed, the purpose of cont