Norwegian System of Patient Injury Compensation – Court Ruling (Norway, 2024)

A data subject requested access to her data processed by the board within the [https://www.npe.no/no/ Norwegian System of Patient Injury Compensation] (Norsk pasienterstatning), a controller. The data subject was a party to proceedings before the controller and her request covered the documents of the case, including the logs data. The data subject stood on the position that the controller’s employees didn’t check the documents in depth, while examining her case. For this reason, the data subject wanted to verify who and when accessed her documents. The controller partially answered the access request. The data subject didn’t receive the information she asked for, in particular whether printouts of the documents were done, or the documents were sent by e-mail or copied and stored elsewhere. The data subject complained with the Norwegian DPA (Datatilsynet) and notified the Ministry of Public health. The data subject claimed that the controller violated Article 32 GDPR, because they didn’t secure the data properly as there was no logs control in place. Moreover, lack of access to log data deprived the data subject from scrutinising the controller’s conduct with their case. Additionally, the data subject filed an access request with the [https://www.helseklage.no National Appeals Body for the Health Service] (Nasjonalt klageorgan for helsetjenesten), which was the body competent to deal with appeals and/or complaints against the controller's decisions. The appeal body answered the request and provided the data subject with the dates and purposes of access to the data subject’s documents. Nevertheless, in reference to the Ministry of Public health letter, the appeal body didn’t disclosed the identity of employees who accessed the documents. The DPA issued a decision, stating that access request was answered. Moreover, alleged violation of Article 32 GDPR were not found. Thus, the DPA closed the case. The data subject lodged an appeal with the Privacy Appeals Board (Personvernnemnda), sustaining her previous arguments. Also, the data subject pointed out that the DPA violated Article 57(1)(f) GDPR by refusing to examine the case. The Privacy Appeals Board dismissed the appeal. Firstly, the controller didn’t violate Article 32 GDPR. A log control was implemented. Furthermore, the Privacy Appeals Board had no doubts that the members of the controller’s board, who examined the case, had lawful access to the documents. Secondly, the data subject’s complaint didn’t provide the DPA with sufficient grounds to examine compliance with Article 32 GDPR. The data subject asked the DPA only for additional investigation whether or not the security of data was good enough under the GDPR. According to the Privacy Appeals Board, such a claim didn’t oblige the DPA to further investigate the case. Hence, the DPA didn’t violate Article 57(1)(f) GDPR. Thirdly, the data subject received the answer to the access request. All the information disclosed by the controller and the the National Appeals Body for the Health Service satisfied the purposes indicated by the data subject in the request. Then, there was no reason to provide the data subject with the identity of the controller employees who accessed the data. The Privacy Appeals Board explained that in principle employees’ identity under the CJEU Pankki case was not covered by the Article 15 GDPR.