Court case PVN-2022-12 – Court Ruling (Norway, 2022)

The parent of a school pupil (the data subject) was concerned that the municipality (the controller) violated children's privacy rights on a number of occasions. The parent sent a request to the controller under Article 15 GDPR, to access the data subject's student file but the request was denied. The parent informed the Norwegian DPA about this rejection as well as the alleged violations on behalf of the controller. She believed to be exercising her right under Article 77 GDPR to lodge a complaint with a supervisory authority. The DPA did not open an investigation into the individual complaint but advised the parent to contact the controller's data protection officer. Later on, the parent was informed that the DPA had started an ex officio investigation into the controller's routines for internal control and information security. The DPA stated that that the questions put to the controller were related to the municipality's duties as data controller, and not to the data subject's rights. The DPA completed the investigation and proceedings without an order or fine against the controller. The parent complained to the DPA about this decision using an internal administrative appeal, which is possible under the Norwegian [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act]. However, the DPA rejected this complaint by stating that the parent was not a party to the ex officio investigation against the controller and could not appeal the decision. Under a national administrative law procedure, the parent's case was referred to the Norwegian Privacy Appeals Board (Privacy Board). The Privacy Board had to assess whether it was correct of the Norwegian DPA to reject the parent's complaint. It recalled that the DPA chose to open an ex officio investigation. In these proceedings, no individual decision was made, as the DPA, after obtaining the controller's explanation, gave guidance and then closed the case without giving any order. Neither the municipality nor others had the right of appeal under the [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act] against this decision. However, the Privacy Board considered whether the DPA had acted lawfully when it received a notice or a complaint about possible data protection rights breaches, but decided to process the case further without treating the data subject as a party. The question of the individual's right to be recognised as a party to proceedings under the GDPR was considered in a case before the Förvaltningsrätten in Stockholm ([https://gdprhub.eu/index.php?title=FiS_-_13308-22 Case 3308-22]). Förvaltningsrätten pointed out that it is incompatible with EU law if the individual, by not being recognised as a party to the case, would be in a disadvantageous position with regard to their rights under the GDPR. According to the Privacy Board's assessment, the situation was different in this case. The Privacy Board considered that the Norwegian DPA acted reasonably in assuming that the parent's inquiry was a general notice about the controller's handling of personal data, not a complaint under Article 77 GDPR. The Privacy Board held that the fact that the data subject's parent was not satisfied with the DPA closing the case without issuing an order, did not change her status in the ex officio investigation (to which she was not a party), nor did it give her any right to appeal. Consequently, the Privacy Board dismissed the appeal.