Court case 25/12378 – Court Ruling (Norway, 2025)

The data subject filed a complaint with the Norwegian Data Protection Authority (Datatilsynet) about their employer. The DPA handled the complaint and chose to use corrective measures toward the employer. The data subject attempted to appeal this decision to the Privacy Appeals Board (PVN), but the PVN rejected the appeal because the data subject did not have the right to appeal under the national law. Later, The Civil Ombudsman stated that the data subject actually does have a right to appeal under Article 78(1) GDPR, which gives to the data subject the right to an effective judicial remedy against the DPA’s decisions. The Norwegian Civil Ombudsman argued that the CJEU rulings in SCHUFA and Land Hessen expand complainants’ right to bring legal action, suggesting they may challenge all aspects of complaint handling, including corrective measures. PVN was then instructed to reconsider its decision. Upon reconsideration, PVN concluded that the data subject still does not have the right to appeal DPA's decision. Under [https://lovdata.no/dokument/NLE/lov/1967-02-10 national law], the data subject is not considered a party to the case against the employer. A party is defined as a person “to whom a decision is addressed or who is directly affected by the case,” and PVN found it clear that the data subject did not meet this threshold. Moreover the PVN examined the possible application of Article 78 GDPR. According to Article 78 GDPR, every natural or legal person shall have the right to an effective judicial remedy against a legally binding decision concerning them taken by a supervisory authority. So, the question was whether the right to an effective judicial remedy under Article 78(1) GDPR can be invoked by a data subject who has lodged a complaint with a supervisory body but who are not themselves the addressees of the decision subsequently taken. According to Recital 143, any natural or legal person should have the right to an effective judicial remedy by the com