Legelisten.no AS – Violation Found (Norway, 2017)

Legelisten.no AS is a Norwegian limited liability company running a website where people anonymously can post reviews about dentists, doctors, psychologists and other healthcare personnel. A review must adhere to Legelisten's policy, it should include a heading and a description of at least 100 characters, as well as a rating from one to five stars. The user is asked to include positive and negative aspects and avoid offensive language, allegations of malpractice or rumors. The user must confirm their submission via email and all reviews are monitored and moderated by Legelisten as a part of their quality assurance process. The Norwegian DPA received (and processed) several complaints related to the site since its inception in 2012. Their final decision relates to a case from 2015, when a dentist lodged a complaint after she had received a negative review. She claimed that the processing of her personal data did not have a legal basis og demanded to have her personal data removed from the site. The DPA disagreed and the case was submitted to the Norwegian Privacy Appeals Board (Personvernnemda), who returned the case to the DPA for new processing due to lack of consideration of the dentist's demand to have her personal data removed from Legelisten. This time, the DPA also considered several other aspects of the case, particularly if Legelisten was the controller (Legelisten claimed they acted as a processor) and if Legelisten had legal grounds for processing reviews of healthcare personnel. The DPA also considered exemptions or derogations for processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, or if the processing would be covered by the right to freedom of expression and information, seen against the Norwegian Personal Data Act, the Norwegian Constitution, and the European Convention on Human Rights. The DPA investigated several aspects of the processing of personal data in the case, summarized below. =