- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
The Norwegian DPA Datatilsynet – Violation Found (Norway, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Norwegian DPA Datatilsynet was reviewed for how it handled complaints about its own data processing practices. The outcome showed that the authority's processing of personal data was under scrutiny but did not result in any violations found.
What happened
A complaint was lodged against the Norwegian DPA regarding its data processing activities.
Who was affected
A person who filed a complaint about the Norwegian DPA's handling of personal data.
What the authority found
The authority found no violations of GDPR in its processing activities.
Why this matters
This case highlights the importance of transparency and accountability for public authorities in their data processing, reassuring users that complaints are taken seriously.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject lodged a complaint against the Norwegian DPA for several GDPR violations related to their website (https://www.datatilsynet.no). Since the DPA is disqualified from managing complaints lodged against them, the Ministry of Local Government and Regional Development, administratively superior to the DPA, appointed an external party to assess the complaint and make a decision. First, the data subject claimed that the DPA violates Article 6 GDPR because they base all processing activities relating to website visits on Article 6(1)(f), when the second paragraph of Article 6(1) states that this lawful basis does not apply to processing carried out by public authorities in the performance of their tasks. The data subject opined that since the DPA is a public authority and operating their website happens as part of their tasks, they could not rely on this lawful basis. In addition, the data subject claims that even if the DPA could base certain processing activities on this lawful basis, the interests claimed are not necessary for the processing in question, for example claiming that storing keyword searches are not necessary to operate the website. The DPA responds that they have assessed several possible lawful bases for processing of personal data in relation to their website, for example Article 6(1)(e) and Article 6(1)(a). However, they felt that (e) was not appropriate and that (a) was only partly appropriate. Thus, they concluded that Article 6(1)(f) was the correct lawful basis. As for the complaint from the data subject, they refer to the legal preparatory works related to the GDPR, where the Ministry of Justice and Public Security assumes that the exception referred to in the second paragraph of Article 6(1) only refers to the processing of personal data related to the exercise of the public authorities' tasks. The DPA also refers to the French DPA's use of this lawful basis for several of their processing activities and purposes. Second, the data sub
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for The Norwegian DPA Datatilsynet in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
24 March 2020
Authority
Datatilsynet (Norway)
About this data
Cite as: Cookie Fines. The Norwegian DPA Datatilsynet - Norway (2020). Retrieved from cookiefines.eu
Last updated: