Court case PVN-2024-06 – Court Ruling (Norway, 2024)

A data subject contacted the Norwegian DPA (Datatilsynet) asking for investigation against the Child Welfare Service in relation to its GDPR compliance. The request covered processing activities relating to data subject’s children. In response, the DPA explained that the [https://www.statsforvalteren.no/ State Administration] (Statsforvalteren) was competent to hear complaints, in particular, regarding data processing of municipality bodies. Thus, the DPA closed the case. Few months later, the data subject filed a complaint with the DPA in relation to data processing performed by the Police. Allegedly, the police breached the duty of confidentiality, disclosing a criminal report case to the Child Welfare Service. Additionally, the data subject asked the DPA to audit the municipality's data processing. The DPA informed the data subject that it is not competent to examine the processing activity's of the police. Also, again the DPA found no reasons to conduct further investigation against the Child Welfare Service, nor to audit the municipality. Hence, the DPA close the case. The data subject lodged an appeal with the Privacy Appeals Board (Personvernnemnda). The Privacy Appeals Board dismissed the appeal. According to the Privacy Appeals Board, the DPA closed the case since there was no complaint within the meaning of Article 77(1) GDPR in conjunction with Article 57 GDPR. The Privacy Appeals Board found that the mere suspicion of unlawful data processing, not yet linked to specific processing activities, did not oblige the DPA to initiate investigation. In the case at hand, the data subject asked the DPA to verify whether the Child Welfare Service violated GDPR in one of the mentioned cases. Nevertheless, the data subject’s claims were vague and general, expressing the data subject dissatisfaction with the Child Welfare Service conduct. Consequently, for the Privacy Appeals Board the data subject's request didn't constitute a complaint under Article 77(1) GDP