Norwegian Labour and Welfare Administration at municipality X (NAV) – Dismissed (Norway, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Norwegian Labour and Welfare Administration (NAV) refused to delete a person's data from social security applications, citing the need to keep records for archival purposes. The Norwegian Privacy Appeals Board eventually ruled that the person should receive compensation for missing the appeal deadline due to confusion over the correct appeal body. This case highlights the complexity of navigating data erasure requests and appeal processes.
What happened
NAV refused to delete personal data from social security applications, citing archival requirements.
Who was affected
Individuals who requested their personal data be erased from NAV's records.
What the authority found
The Norwegian Privacy Appeals Board compensated the individual for missing the appeal deadline due to confusion over the correct appeal body.
Why this matters
This case underscores the importance of clear guidance on appeal processes for data erasure requests. Organizations should ensure they provide accurate information on how individuals can appeal decisions about their data.
GDPR Articles Cited
National Law Articles
The data subject made a request under Article 17 GDPR for erasure of their personal data from submitted applications for social security assistance to the Norwegian Labour and Welfare Administration at municipality X (NAV). NAV refused to delete the personal data and cited the Norwegian Archives Act which requires storing the information for archival purposes. After this refusal the data subject contacted the State Administrator, which was stated on NAV's initial decision, to be the competent appeal body. The State Administrator rejected the complaint and informed that the Norwegian DPA is the correct complaint body in the case. The data subject contacted the DPA, but the DPA disagreed with the State Administrator, and viewed the State Administrator is the competent appeal body in the case. The DPA viewed that a dispute about what is the correct inerpretation of the Norwegian Archives Act must be reported to the State Administrator. The data subject then again contacted the State Administrator, which maintained its original view. The State Administrator also provided guidance on his understanding of the applicable rules. The data subject the again contacted the DPA requesting clarification on who is the competent appeal body but the DPA maintained its own view. The data subject appealed against this decision, but The DPA rejected the complaint on the grounds that it had been submitted after the appeal deadline of three weeks and did not find any special reasons that made it reasonable for the complaint to be nevertheless processed. The data subject also contacted the Civil Ombudsman which rejected the case and referred the data subject to the Norwegian Privacy Appeals Board. The Norwegian Privacy Appeals Board held that the conditions for trying the appeal had clearly been met after the appeal deadline being missed and gave the data subject compensation for missing the appeal deadline. The Norwegian Privacy Appeals Board emphasized, firstly, that the DPA is th
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for Norwegian Labour and Welfare Administration at municipality X (NAV) in NO
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Norwegian Labour and Welfare Administration at municipality X (NAV) - Norway (2023). Retrieved from cookiefines.eu
Last updated: