Court case PVN-2022-12 – Court Ruling (Norway, 2022)

The parent of a school pupil (the data subject) was concerned that the municipality (the controller) violated children's privacy rights on a number of occasions. The parent sent a request to the controller under Article 15 GDPR, to access the data subject's student file but the request was denied. The parent informed the Norwegian DPA about this rejection as well as the alleged violations on behalf of the controller. She believed to be exercising her right under Article 77 GDPR to lodge a complaint with a supervisory authority. The DPA did not open an investigation into the individual complaint but advised the parent to contact the controller's data protection officer. Later on, the parent was informed that the DPA had started an ex officio investigation into the controller's routines for internal control and information security. The DPA stated that that the questions put to the controller were related to the municipality's duties as data controller, and not to the data subject's rights. The DPA completed the investigation and proceedings without an order or fine against the controller. The parent complained to the DPA about this decision using an internal administrative appeal, which is possible under the Norwegian [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act]. However, the DPA rejected this complaint by stating that the parent was not a party to the ex officio investigation against the controller and could not appeal the decision. Under a national administrative law procedure, the parent's case was referred to the Norwegian Privacy Appeals Board (Privacy Board). The Privacy Board had to assess whether it was correct of the Norwegian DPA to reject the parent's complaint. It recalled that the DPA chose to open an ex officio investigation. In these proceedings, no individual decision was made, as the DPA, after obtaining the controller's explanation, gave guidance and then c