Statistics Norway – Court Ruling (Norway, 2024)

On 19 February and 4 March 2023, a data subject contacted the Norwegian DPA to notify them about the Statistics Norway's (“the controller”) processing of personal data which they believed to be in violation with the GDPR. The data subject gave several examples on how the controller breached the GDPR, including that the controller collected all mobile data in Norway and that it sold confidential personal data identified by social security number. On 6 July 2023, the DPA replied in a letter that his inquiry had been dealt with. The DPA further stated that it would not carry out further investigations as they found it unlikely that a possible breach of the law would lead to corrective measures. Therefore, the DPA closed the case. On 25 July 2023, the data subject lodged a complaint with the DPA, requesting erasure from the controller and other controllers who received personal data from the controller. The DPA processed the complaint and upheld its decision to close the case without conducting further investigations. On 22 September 2023, the case was forwarded to the Norwegian Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board examined whether the DPA fulfilled their duty as supervisory body under the GDPR by closing this case without further investigations. According to Article 57(1)(f) GDPR, the DPA must handle a complaint lodged by a registered person and investigate, to the extent appropriate, the subject matter of the complaint and inform the registered person of the progress and outcome of the investigation within a reasonable period. The Board stated that the DPA has a certain freedom to decide how extensive the individual case requires investigation. In a previous case ([https://pvn.no/PVN-2017-09 PVN-2017-09]), the Board stated that the DPA is allowed to prioritise cases “to a certain extent that not all inquiries are treated equally thoroughly.” The DPA is required to fulfil its duty to investigate and provide information so that the parties of the case are sufficiently informed and that their assessment of the legality of the relevant processing of personal data appears sound. According to the Board, the DPA must take a position on the material question of whether the processing of personal data had been in breach of the GDPR after an investigation which can be quite superficial or in-depth depending on the nature of the case. If the DPA closes a case without taking a position on the material issues, this is a decision dismissing the case which gives the data subject the right to appeal to the Board. The question in this case was what leeway the DPA had, when it received an inquiry about possible breaches of the GDPR, to choose not to take a decision on whether the processing was in violation or not. It follows directly from the wording in Article 77(1) GDPR that the data subject must claim that an individual's personal data has been processed in a way that is in breach of the GDPR. The Board stated that this provision requires that the infringement must affect the person lodging the complaint. In the absence of this requirement, the notification should not be regarded as a complaint that obliges the DPA to carry out certain investigations. As both Article 57(1)(f) GDPR and [https://gdpr-info.eu/recitals/no-141/ Recital 141] state that the “investigation of a complaint should [...] be carried out to the extent that is appropriate in the specific case", the Board held that the case can then be dismissed without further investigation. The Board took into account a similar approach that was taken by the European Court of Human Rights (ECHR) on [https://www.coe.int/en/web/compass/the-european-convention-on-human-rights-and-its-protocols Article 34 ECHR]. This Article holds that the right of appeal exists only for the person who claims to be a victim of a violation of one or more of the rights in the convention. In the ECHR case [https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-98428%22]} Tănase v. Moldova], the Court required that the person "must be directly affected by the impugned measure" in order to be considered a victim within the meaning of the Convention (see §104). Thus, the Court only decides on whether the application of the rules or the practice in question affected the person directly and in such a way that the convention has been violated. The Board stated that even if the ECtHR's practice under [https://www.coe.int/en/web/compass/the-european-convention-on-human-rights-and-its-protocols Article 34 ECHR] is not directly relevant to the interpretation of what constitutes a "complaint" in the sense of the GDPR, it can be applied similarly to the GDPR. The enforcement bodies (the ECtHR under the ECHR and the DPAs under the GDPR) must only deal with real and real cases from persons who can provide concrete and sufficient evidence that there has been a violation of protected rights. Statements of more or less unfounded suspicions or allegations without concrete evidence cannot trigger an obligation for the DPA to initiate investigations with the aim of clarifying whether there has been a GDPR violation of the processing of personal data. In several cases, the Board held that it is the task of the person lodging the complaint to explain the case and present documentation for the relationship complained of (see [https://pvn.no/PVN-2023-15 PVN-2023-15] and [https://pvn.no/PVN-2023-22 PVN-2023-22]). In this case, where the information provided in the inquiry did not in itself provide sufficient reason to suspect unlawful processing of personal data as the data subject is not personally affected, the inquiry could not be considered a complaint that obligated DPA to carry out further investigations according to Article 57(1)(f) GDPR. In such a case, the DPA can dismiss the case. Thus, the Privacy Appeals Board upheld the DPA’s decision to not further investigate the complaint.