Statistics Norway – Court Ruling (Norway, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Norway's data protection authority closed a case about Statistics Norway without investigating further. This is significant because it raises questions about how well authorities are handling complaints about personal data misuse. Companies should be aware that complaints need proper attention.
What happened
A person complained that Statistics Norway was processing personal data improperly, but the authority decided not to investigate.
Who was affected
The individual who reported the alleged misuse of personal data by Statistics Norway.
What the authority found
The authority concluded that there was no need for further investigation into the complaint about Statistics Norway's data practices.
Why this matters
This case shows that data protection authorities have discretion in handling complaints, but it also highlights the need for thorough investigations to maintain public trust.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
On 19 February and 4 March 2023, a data subject contacted the Norwegian DPA to notify them about the Statistics Norway's (“the controller”) processing of personal data which they believed to be in violation with the GDPR. The data subject gave several examples on how the controller breached the GDPR, including that the controller collected all mobile data in Norway and that it sold confidential personal data identified by social security number. On 6 July 2023, the DPA replied in a letter that his inquiry had been dealt with. The DPA further stated that it would not carry out further investigations as they found it unlikely that a possible breach of the law would lead to corrective measures. Therefore, the DPA closed the case. On 25 July 2023, the data subject lodged a complaint with the DPA, requesting erasure from the controller and other controllers who received personal data from the controller. The DPA processed the complaint and upheld its decision to close the case without conducting further investigations. On 22 September 2023, the case was forwarded to the Norwegian Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board examined whether the DPA fulfilled their duty as supervisory body under the GDPR by closing this case without further investigations. According to Article 57(1)(f) GDPR, the DPA must handle a complaint lodged by a registered person and investigate, to the extent appropriate, the subject matter of the complaint and inform the registered person of the progress and outcome of the investigation within a reasonable period. The Board stated that the DPA has a certain freedom to decide how extensive the individual case requires investigation. In a previous case ([https://pvn.no/PVN-2017-09 PVN-2017-09]), the Board stated that the DPA is allowed to prioritise cases “to a certain extent that not all inquiries are treated equally thoroughly.” The DPA is required to fulfil its duty to investigate and provide information so that the par
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Statistics Norway in NO
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Statistics Norway - Norway (2024). Retrieved from cookiefines.eu
Last updated: