Court case PVN-2024-05 – Court Ruling (Norway, 2024)

The data subject underwent medical treatment in a hospital managed by the controller following an work related injury. The controller issued a report that was used by the data subject to apply for workers’ compensation. This application was rejected by the competent authority. After that, the data subject filed a rectification and deletion request to the controller, asking the latter to modify the medical report. The controller rejected this request. On 8 December 2023, the DPA closed the case without deciding whether the controller had violated the GDPR and without considering any corrective measures. The DPA pointed out that it does not have medical or healthcare expertise and, therefore, concluded that it was not appropriate to consider the complaint pursuant to Article 57(1)(f) GDPR. Moreover, the DPA pointed out that, according to national law (see holding below) and as already stated by the Data Protection Board, the DPA does not have the power to carry out a real review of what information is correct or relevant to include in a patient record. On 27 December 2023, the data subject complained about this decision. The DPA considered the complaint and upheld its decision not to conduct further investigations. Therefore, on 2 April 2024, the case was submitted to the Data Protection Board (Personvernnemnda). The data subject believed that the DPA has not considered her case and that the DPA has a duty to check that GDPR is complied with. On the handling of the complaint by the DPA First, the Board held that the DPA has closed the case without making a decision and without considering the data subject's complaint. Pursuant to Article 57(1)(f) GDPR, the DPA shall investigate a complaint lodged by a data subject and investigate, to the extent appropriate, the subject matter of the complaint, as well as inform the complainant of the course and outcome of the investigation within a reasonable time. According to the Board, this provision does not allow for a disc