The Labour and Welfare Administration (NAV) – €1,740,000 Fine (Norway, 2023)

"NAV", the Norwegian Labour and Welfare Administration, is a government agency that collaborates with local municipalities to provide a unified access to public labor and welfare services. Its primary functions include promoting employment and ensuring financial and social security. NAV administers a significant portion of the state budget and is one of the country's largest employers with about 22,000 employees. Almost all citizens of Norway are in contact with NAV at some point of their life. On 1 March 2023, the Norwegian DPA Datatilsynet notified NAV (the controller) of a physical inspection as per Article 57(1)(a) GDPR, Article 57(1)(h) GDPR, cf. Article 58(1)(a) GDPR, Article 58(1)(b) GDPR, Article 58(1)(e) GDPR and Article 58(1)(f) GDPR. The DPA conducted their inspection on 6 September. They focused on the controller's IT systems for processing personal data related to their government-related services, including technical and organisational measures related to access controls, logging and log control, as per Article 32 GDPR and Article 5(1)(f) GDPR, including if the controller had established an appropriate management system in line with Article 24 GDPR and Article 5(2) GDPR. The DPA sent the controller the preliminary audit report on 1 November, to which the controller responded on 22 November. The DPA then submitted their final report on 27 November, along with a notification of their intent to impose a fine and issue several orders. The controller has three weeks to respond to the DPA's preliminary conclusions, after which the DPA will make their final decision. Overall, the DPA found that many of the controller's employees work on cases from across the country, in several service areas, with broad access rights. Despite this, there isn't systematic control over how they use systems; this relies instead on trust. The employees also lack the necessary tools to manage this trust and the responsibility they're given, due to a lack of routines and supervision. Following the audit, the DPA draws two main conclusions. First, the controller's management system is not suited to ensuring adequate security for protecting personal data. Second, confidentiality in their systems, in practice, is not adequate. This resulted in 12 violations: * Violation 1: The controller has not established an adequate management system to provide adequate technical and organisational measures to ensure and demonstrate that processing personal data is done in line with Article 5(2) GDPR and Article 24(1) GDPR and Article 24(2) GDPR. * Violation 2: The controller's governing documentation for access controls fails to incorporate adequate technical and organisational measures, necessary for ensuring and demonstrating compliance with Article 32(1) GDPR and Article 32(2) GDPR, see also Article 5(2) GDPR and Article 24(1) GDPR and Article 24(2) GDPR. * Violation 3: The controller does not regularly review its governing documentation for access controls, as required by Article 32(1)(d) GDPR. * Violation 4: The controller has not implemented sufficient organisational measures to ensure that risk assessments are done as per Article 32(2) GDPR, when establishing and developing IT systems. * Violation 5: Access to meta data of documents in one system is too general and broad, violating the confidentiality principle of Article 5(1)(f) GDPR and the security requirements set out in Article 32(1) GDPR. * Violation 6: The controller has not implemented sufficient organisational measures for training identity control administrators, violating Article 32(1) GDPR and Article 32(4) GDPR. * Violation 7: The routines for granting accesses are out of date and fail to provide guidance for discretionary assessments, violating Article 32(1) GDPR and Article 32(4) GDPR. * Violation 8: Access to personal data only processed for archive purposes in historical cases is too general and broad, violating the confidentiality principle of Article 5(1)(f) GDPR and the security requirements set out in Article 32(1) GDPR. * Violation 9: The controller has chosed to organise their access controls in a way that allows a significant number of users access to systems with no real work-related need for it. Combined with an inadequate system for access controls, this violates the confidentiality principle of Article 5(1)(f) GDPR and the security requirements set out in Article 32(1) GDPR. * Violation 10: The controller has inadequate technical and organisational measures for safeguarding personal data of certain categories of data subjects (own employees, people with secret addresses etc.), violating Article 32(1) GDPR and Article 32(2) GDPR. * Violation 11: The controller has inadequate routines for controlling unit leaders' yearly revision of accesses, violating Article 32(1)(d) GDPR. * Violation 12: The controller has not established a systematic access log control. Combined with the fact that a significant number of employees have broad accesses (see violation 9), this violates the requirement to implement sufficient technical and organisational measures to ensure and demonstrate that the processing of personal data is done in line with the GDPR, thus violating Article 32(1) GDPR and Article 32(2) GDPR, see also Article 5(2) GDPR, Article 24(1) GDPR and Article 24(2) GDPR, as well as the requirements for periodic control as per Article 32(1)(d) GDPR. First, the DPA intends to order the controller to rectify the 12 violations. This includes establishing a comprehensive and suitable systematic approach for organisational measures to ensure and demonstrate compliance with the GDPR, including necessary routines. Further, the controller must establish technical and organisational measures for access controls and access control logs to ensure confidentiality in their processing of personal data, including limiting access to what's necessary. Second, the DPA intends to fine the controller €1,754,678 (NOK 20 million) for violating Article 5(1)(f) GDPR, Article 32(1) GDPR, Article 32(2) GDPR, Article 32(4) GDPR, as well as Article 5(2) GDPR, Article 24(1) GDPR and Article 24(2) GDPR. The controller has three weeks to respond to the DPA's preliminary conclusions, after which the DPA will make their final decision.