Sbanken ASA – Dismissed (Norway, 2020)

A data subject who comes from the Netherlands moved to Norway and established a customer relationship with a bank (Sbanken ASA). For several years, the complainant has been in dialogue with the bank to correct the way they write his name. The bank writes his name in capital letters in "van" (Name Van Navnesen, instead of Name van Navnesen). The bank stated that its processing systems retrieve customer information from the National Population Register. In the National Register, all names are written in capital letters and Sbanken has a program that automatically changes the spelling of names from uppercase to lowercase letters with the exception of the first letter which is written in capital letters: from "NAME VAN NAVNESEN" to "Name Van Navnesen". The reason for this choice is that most customers write all names with a capital letter in line with the Norwegian naming tradition. As the data subject was unsuccessful in having his name spelled differently, he lodged a complaint with the Datatilsynet. The DPA held that Article 16 does not require a qualified degree of inaccuracy, and does not allow for a risk-based approach to when the data subject's rights can be asserted. The Datatilsynet also emphasised the objective nature of the personal data in question, and noted that such data (the same as age, address, personal name, or other information with an objective standard) shall be corrected by replacing it with information that is objectively correct. Furthermore, the DPA found the bank’s proposal, of correcting the complainant’s name in the online banking website but not in the bank's underlying systems, to be insufficient. Did the Datatilsynet arrive at a correct assessment as it ordered the bank to rectify the complainant’s name based on Articles 5(1)(d) and 16? The PVN unanimously overturned the Datatilsynet’s decision. In building its arguments, the PVN recognized that in the Dutch passport the name was written with a lowercase letter (“van”). However, it then noted that it is normal to have differences between countries in spelling names, and gave examples of characters which do not even exist in all languages. Other than the Datatilsynet, the PVN’s reasoning did not focus on the objective nature of the data, nor on it being objectively incorrect. Instead, the PVN relied on the principle of data accuracy and emphasised that the correctness of the data must be assessed in light of the processing purposes. As the purpose of the bank is to administer the customer relationship with the complainant, the PVN held that the current spelling of the name entails no danger of misidentification. Therefore, the PVN held that there is no incorrect personal data that can be required to be corrected in accordance with Article 16.