- Enforcing jurisdiction
- Norway · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Church of Norway - Den norske kirke – Violation Found (Norway, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Church of Norway was found to have improperly registered newborns after their legal permission expired. The church continued to process sensitive data without informing parents. This case serves as a warning that organizations must stay updated on their legal permissions to handle personal data.
What happened
The Church of Norway continued to receive notifications about newborns after their legal permission to do so expired.
Who was affected
Parents of newborns who were registered by the Church of Norway were affected.
What the authority found
The authority found that the Church of Norway unlawfully processed personal data by failing to delete records after the legal basis expired.
Why this matters
This case highlights the need for organizations to regularly review their data processing permissions and to inform individuals about their data rights. It underscores the importance of compliance with changing legal frameworks.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Church of Norway (the controller) used information about new births from the National Population Register disclosed on the basis of national law, including sensitive data. If at least one parent was an existing member of the Church, the controller was allowed to register newborns (as 'affiliated persons') in their member register and, on the same condition, they also had permission as per the national population regulations to receive automatic notifications on newborns. This permission expired on 1 October 2018, and on 1 January 2021 the other relevant regulations were replaced. The controller, however, still continued to receive the automatic notifications until 14 November 2018. At this point, they still considered that the minors registered during the period 1 October to 14 November were correctly registered as per the (now expired) [https://lovdata.no/dokument/NLO/lov/1996-06-07-31 Norwegian Church law], and did not delete the data. On 28 February 2020 the Norwegian Humanist Association and lawfirm Bull & Co lodged a complaint with the Norwegian DPA on behalf of eight data subjects, claiming that the controller had unlawfully collected information on the data subjects' newborns and failed to inform them about this processing. Consequently, the DPA launched an investigation. Only when the controller realised that the correct end date was 1 October, it initiated an erasure process, but due to a claimed technical error, this was not carried out until 18 August 2020. The controller informed the DPA that the personal data on affiliated persons would be deleted when the legal basis for this processing expired on 1 January 2021. On 22 January 2021, it informed that the personal data of 108.880 data subjects were deleted. With regard to the alleged lack of information issue, the controller claimed that it could rely on the exemption set forth in Article 14(5)(c) GDPR and noted that it still provided some information through the main privacy notice for the Church
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Church of Norway - Den norske kirke in NO
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
9 January 2023
Authority
Datatilsynet (Norway)
About this data
Cite as: Cookie Fines. Church of Norway - Den norske kirke - Norway (2023). Retrieved from cookiefines.eu
Last updated: