Norges Høyesterett - 2021-2403-A

Norges Høyesterett - HR-2021-2403-A
Court:	Norges Høyesterett (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 4(11) GDPR Article 5(1)(a) GDPR Article 6(1) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 7(4) GDPR Article 9 GDPR Article 9(2)(a) GDPR Article 85 GDPR European Convention on Human Rights Article 10 European Convention on Human Rights Article 8 Grunnloven (The Constitution of the Kingdom of Norway) § 100 Personopplysningsloven (Personal Data Act) § 3
Decided:	07.12.2021
Published:	13.12.2021
Parties:	Legelisten.no AS Legeforeningen (The Norwegian Medical Association)
National Case Number/Name:	HR-2021-2403-A
European Case Law Identifier:
Appeal from:	Datatilsynet (Norway) 15/01355
Appeal to:
Original Language(s):	Norwegian
Original Source:	Norges Høyesterett (The Supreme Court of Norway) (in Norwegian)
Initial Contributor:	Rie Aleksandra Walle

The Supreme Court of Norway ruled that the Privacy Appeal Board's decision on Legelisten.no was valid, agreeing that Legelisten had legal grounds in Article 6(1)(f) GDPR for publishing subjective user reviews of healthcare personnel on their website.

English Summary

Facts

In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals.

In one case in 2015, the DPA held that Legelisten did not have a legal basis for processing personal data related to the website reviews and, further, that Legelisten had to offer an opt-out arrangement for healthcare personnel not wanting their personal data published on the website. The decision was appealed to the Norwegian Privacy Appeals Board, who overturned parts of the DPA's decision, importantly relating to the (lack of) legal basis and the opt-out arrangement.

Following this, the Norwegian Medical Association brought an action to the Norwegian courts, claiming that the website had no legal basis as per Article 6(1)(f) GDPR for registering and publishing subjective user reviews of healthcare personnel.

Holding

After a balancing of the legitimate interests safeguarded by the website operator Legelisten against the interests of the healthcare personnel, the Supreme Court found that Legelisten had a legal basis for the processing as per Article 6(1)(f) GDPR.

Thre Court emphasised that Legelisten.no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied what could reasonably be expected. Thus, the DPA's initial decision was overturned and the appeal appeal against the Privacy Appeals Board's decision was rejected.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.

"Article 6. Legality of treatment1. The processing is only lawful if and to the extent that at least one of the following conditions is met: ... f) the processing is necessary for purposes related to the legitimate interests pursued by the data controller or a third party, unless the data subject's interests or fundamental rights and freedoms take precedence and require the protection of personal data, especially if the data subject is a child. "