Norwegian Labour and Welfare Administration at municipality X (NAV) – Dismissed (Norway, 2023)

The data subject made a request under Article 17 GDPR for erasure of their personal data from submitted applications for social security assistance to the Norwegian Labour and Welfare Administration at municipality X (NAV). NAV refused to delete the personal data and cited the Norwegian Archives Act which requires storing the information for archival purposes. After this refusal the data subject contacted the State Administrator, which was stated on NAV's initial decision, to be the competent appeal body. The State Administrator rejected the complaint and informed that the Norwegian DPA is the correct complaint body in the case. The data subject contacted the DPA, but the DPA disagreed with the State Administrator, and viewed the State Administrator is the competent appeal body in the case. The DPA viewed that a dispute about what is the correct inerpretation of the Norwegian Archives Act must be reported to the State Administrator. The data subject then again contacted the State Administrator, which maintained its original view. The State Administrator also provided guidance on his understanding of the applicable rules. The data subject the again contacted the DPA requesting clarification on who is the competent appeal body but the DPA maintained its own view. The data subject appealed against this decision, but The DPA rejected the complaint on the grounds that it had been submitted after the appeal deadline of three weeks and did not find any special reasons that made it reasonable for the complaint to be nevertheless processed. The data subject also contacted the Civil Ombudsman which rejected the case and referred the data subject to the Norwegian Privacy Appeals Board. The Norwegian Privacy Appeals Board held that the conditions for trying the appeal had clearly been met after the appeal deadline being missed and gave the data subject compensation for missing the appeal deadline. The Norwegian Privacy Appeals Board emphasized, firstly, that the DPA is th