Court case PVN-2024-05 – Court Ruling (Norway, 2024)

The data subject underwent medical treatment in a hospital managed by the controller following an work related injury. The controller issued a report that was used by the data subject to apply for workers’ compensation. This application was rejected by the competent authority. After that, the data subject filed a rectification and deletion request to the controller, asking the latter to modify the medical report. The controller rejected this request. On 8 December 2023, the DPA closed the case without deciding whether the controller had violated the GDPR and without considering any corrective measures. The DPA pointed out that it does not have medical or healthcare expertise and, therefore, concluded that it was not appropriate to consider the complaint pursuant to Article 57(1)(f) GDPR. Moreover, the DPA pointed out that, according to national law (see holding below) and as already stated by the Data Protection Board, the DPA does not have the power to carry out a real review of what information is correct or relevant to include in a patient record. On 27 December 2023, the data subject complained about this decision. The DPA considered the complaint and upheld its decision not to conduct further investigations. Therefore, on 2 April 2024, the case was submitted to the Data Protection Board (Personvernnemnda). The data subject believed that the DPA has not considered her case and that the DPA has a duty to check that GDPR is complied with. On the handling of the complaint by the DPA First, the Board held that the DPA has closed the case without making a decision and without considering the data subject's complaint. Pursuant to Article 57(1)(f) GDPR, the DPA shall investigate a complaint lodged by a data subject and investigate, to the extent appropriate, the subject matter of the complaint, as well as inform the complainant of the course and outcome of the investigation within a reasonable time. According to the Board, this provision does not allow for a discretionary assessment of which complaints should be processed and which can be closed without processing. Secondly, the DPA pointed out that keeping a patient record involves the processing of personal data. [https://lovdata.no/dokument/NL/lov/1999-07-02-64 Sections 39 and 40 of the Health Personnel Act] (Lov om helsepersonell m.v.) impose a duty on health personnel to keep patient records. These personnel must assess what is relevant and necessary information about the patient and the health care. According to [https://lovdata.no/dokument/NL/lov/1999-07-02-64 Section 42 and 43 of the Health Personnel Act], a person can demand to correct this record to the health personnel. Refusals of demands for correction may be appealed to the county medical officer. Moreover, pursuant to [https://lovdata.no/lov/2014-06-20-42/§26 Section 26 of the Patient Records Act] (Pasientjournalloven), the Norwegian DPA supervises compliance with the GDPR, with the exception to supervisory tasks that are the responsibility of the Norwegian Board of Health Supervision. The Board recalled a previous decision of its, where it had held that data protection legislation does not give either the DPA or the Board the authority to review information in patient records for the purpose of ordering changes to the content of a record at the request of a data subject. On the contrary, it had held that the correctness of such journal entries must be assessed by the health enterprise and possibly by the county medical officer in connection with an appeal against a refusal to rectify. On the rectification and erasure request Thirdly, the Board noted that the data subject’s rectification request has been stored in the hospital’s systems in a way that meets the requirements for supplementing personal data under Article 16 GDPR. Therefore, it considered that the controller fulfilled the rectification request. Finally, the Board noted that the right to erasure does not apply to patient records, since they fall into the exception of Article 17(3)(b) GDPR. Therefore, the Board upheld the data subject’s complaint that the DPA has not considered the case has been upheld. However, it did not uphold her claim that she can demand deletion or further rectification.