Excempt from public disclosure – Complaint Upheld (Norway, 2021)

This case is an appeal of the decision DT-20/02178 by the Norwegian DPA (Datatilsynet), in which it imposed a fine of NOK 400,000 (approx. €38,300). The controller argued that the size of the administrative fine imposed, was too high and therefore appealed the decision with the DPA. The DPA reviewed their decision, but upheld it. The case was therefore was submitted to the Privacy Appeals Board (Personvernnemnda) for consideration. Personvernnemnda decided that the amount of the fine was correctly assessed by the DPA. However, they reduced it from NOK 400,000 (approx. €38,300) to NOK 250,000 (approx. €23,950) because of the long time it took the DPA to process the case. It took almost 16 months for the DPA to send the notices of orders and fines after all facts of the case were essentially clarified. According to the Personvernnemnda this processing time could generally be justified by the fact that the authortiy has limited resources. However, this did not apply here as the case was neither factually nor legally particularly complex. Personvernnemnda also noted that the fact that the DPA apologised for the long processing time was not sufficient compensation.