Church of Norway - Den norske kirke – Violation Found (Norway, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Church of Norway kept registering newborns using outdated permissions from the National Population Register. They failed to delete the data on time and didn't properly inform parents. The Norwegian authority found this violated GDPR rules, but no fine was imposed.
What happened
The Church of Norway continued to register newborns with expired permissions and didn't inform parents correctly.
Who was affected
Newborns and their parents whose data was registered by the Church of Norway without proper permissions.
What the authority found
The Norwegian authority found the Church of Norway violated GDPR by using outdated permissions and not informing parents properly.
Why this matters
This case underscores the importance of keeping data permissions up to date and ensuring transparency with individuals about data use. Organizations should regularly review their data practices to comply with GDPR.
GDPR Articles Cited
The Church of Norway (the controller) used information about new births from the National Population Register disclosed on the basis of national law, including sensitive data. If at least one parent was an existing member of the Church, the controller was allowed to register newborns (as 'affiliated persons') in their member register and, on the same condition, they also had permission as per the national population regulations to receive automatic notifications on newborns. This permission expired on 1 October 2018, and on 1 January 2021 the other relevant regulations were replaced. The controller, however, still continued to receive the automatic notifications until 14 November 2018. At this point, they still considered that the minors registered during the period 1 October to 14 November were correctly registered as per the (now expired) [https://lovdata.no/dokument/NLO/lov/1996-06-07-31 Norwegian Church law], and did not delete the data. On 28 February 2020 the Norwegian Humanist Association and lawfirm Bull & Co lodged a complaint with the Norwegian DPA on behalf of eight data subjects, claiming that the controller had unlawfully collected information on the data subjects' newborns and failed to inform them about this processing. Consequently, the DPA launched an investigation. Only when the controller realised that the correct end date was 1 October, it initiated an erasure process, but due to a claimed technical error, this was not carried out until 18 August 2020. The controller informed the DPA that the personal data on affiliated persons would be deleted when the legal basis for this processing expired on 1 January 2021. On 22 January 2021, it informed that the personal data of 108.880 data subjects were deleted. With regard to the alleged lack of information issue, the controller claimed that it could rely on the exemption set forth in Article 14(5)(c) GDPR and noted that it still provided some information through the main privacy notice for the Church
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Church of Norway - Den norske kirke in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Church of Norway - Den norske kirke - Norway (2023). Retrieved from cookiefines.eu
Last updated: