Court case 2023-14 (21/01067) – Court Ruling (Norway, 2023)

A data subject lodged a complaint with the Norwegian DPA, who decided to merely inform the controller of their GDPR obligations and closed the case without further investigation. Dissatisfied, the data subject contested the closure. After some back and forth, the DPA revisited but ultimately upheld their initial decision. Consequently, as per national procedures, the case was escalated to the Privacy Appeals Board. They were tasked with determining whether the DPA could close a case by simply issuing an informational letter to the controller, without assessing any GDPR breaches, or if the data subject could require the DPA to examine their case and decide on the legality of their personal data processing. The Privacy Appeals Board overruled the DPA's decision and instructed them to reassess the case. Their reasoning was based on the data subject's right to lodge a complaint as per Article 77 GDPR, in conjunction with Recital 141, and Article 57(1)(f) GDPR. The Board referenced an earlier decision (PVN-2017-09), acknowledging the DPA's discretion in determining the scope of their investigations. However, they emphasised that this discretion does not extend to selectively processing complaints. In instances like this, where facts are clear but legal interpretation is in question, the DPA is obliged to decide on the lawfulness of the processing. The Board believed that failing to do so would conflict with Article 77 GDPR. Consequently, the DPA is required to assess the case and determine whether the controller unlawfully processed the data subject's personal data. If a violation is found, they must then consider the need for corrective actions in line with Article 58(2) GDPR.