Personvernnemnda (Norway) - PVN-2022-19
| Personvernnemnda - PVN-2022-19 | |
|---|---|
 | |
| Authority: | Personvernnemnda (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 17(1)(a) GDPR Article 17(1)(c) GDPR Article 17(3)(b) GDPR Article 17(3)(d) GDPR The Archives Act (arkivlova) |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 28.02.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | PVN-2022-19 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Norwegian |
| Original Source: | Norwegian Privacy Appeals Board (Personvernnemnda) (in NO) |
| Initial Contributor: | Maximilien Hjortland |
Child Welfare Services did not violate the GDPR by denying to comply with a data subject's erasure request pursuant to Article 17 GDPR regarding information on the data subject's ethnic minority status within their son's archived record.
English Summary
Facts
This case is an appeal of a decision by the Norwegian DPA (Datatilsynet). Person A (the data subject) complained about the Norwegian Child Welfare Services of a municipality which denied the data subject's right to erasure laid down in Article 17 GDPR. the complainant requested the Child Welfare Services to delete information about the data subject's ethnicity from the complainant's son's archived Child Welfare Services record.
The data subject argued that the archiving information of his ethnical background and national minority status was irrelevant to his son's case and experienced as racism. The Child Welfare Services rejected the complainant's request to delete this information from his son's record.
In its original decision, the Norwegian DPA informed the data subject about the Child Welfare Services' statutory obligation to document and archive information pursuant to national legislation. The DPA viewed, that in this case, it was necessary to assess whether the information on the data subject's ethnicity was 'necessary for the purpose for which it was collected or processed' pursuant to Article 17(1)(a) GDPR. Furthermore, the DPA found that when the Child Welfare Services has evaluated information as worthy of archiving, it will deny the data subject's right to erasure in accordance with the exceptions under Article 17(3)(b) and (d) GDPR.
After an overall assessment, the DPA concluded that the Child Welfare Services did not violate the GDPR by refusing to delete data on the data subject's ethnical background from his son's record. The data subject complained about the DPA's decision. The DPA found no reason to change their decision. As a result, the case was transferred the to The Norwegian Privacy Appeals Board (Personvernnemnda).
Holding
The Norwegian Privacy Appeals Board stated that Article 17(3)(b) GDPR makes an exception to the right to deletion if the processing of personal data is necessary to fulfill a legal obligation and Article 17(3)(d) GDPR for archival purposes in the public interest. It was concluded that Child Welfare Services procedures, routines and case management documentation are not eligble for deletion and must archived for the future. Hence the record itself must be preserved.
The question therefore was whether the information about the data subject's ethnical background can be deleted, even if the documation is otherwise archived.
Essentially, The Privacy Appeals Board held that erasure of data on ethnicity from the record must be dependent on the value of that information is necessary to understand the context and content of the archived documentation. The Cild Welfare Services argued, that in this case, the data subject's ethnicity is essential for interpreting the family's understanding of and reactions to the case. The board took in consideration that The the Child Welfare Services had indicated that the data subject and the family have otherwise communicated that they feel that the child protection case is about racism and represents a witch hunt against them which was reproduced in the documentation. The board viewed this as a sufficient justification for the necessity of keeping the data subject's ethnicity on record.
The members of the Privacy Appeals Board unanimously decided to reject the complaint.
Comment
The Privacy Appeals Board referenced their previous decision PVN-2018-02, and stated that the threshold for confirming deletion of personal data from a Child Welfare Services record must remain high.
In addition, in this particular case, the Norwegian DPA stated, in its initial decision, that whether the information is considered "necessary" for documentation in the individual case requires 'child protection expertise' as well as 'insight into the individual case', which the Norwegian DPA views that the it does not have. Furthermore, the DPA stated that it is therefore difficult for the DPA to verify assessments of what is considered to be necessary information for the child protection service to fulfill its statutory documentation obligation. The view taken by the Norwegian DPA can be viewed as controversial, as essentially the supervisory authority is the competent authority to assess whether a controller has complied with the GDPR when acting on a data subject's erasure request pursuant to Article 17 GDPR.
In another decision issued by the Norwegian Privacy Appeals Board (PVN-2022-21) the board has addressesd this exact question about the supervisory authority's competence with regard to evaluating the controller's assessment of the applicability of the exceptions to en erasure request provided by Article 17(3)(b) and (d) GDPR. The board emphasised that that it is the Norwegian DPA that is the supervisory authority when it comes to requests for deletion pursuant to Article 17 GDPR. In the board's view, this means that, among other things, the DPA must decide on the scope of the exceptions that follow from Article 17(3)(b) and (d) GDPR. When the DPA processes a deletion request, the board clarified that the DPA has the opportunity to obtain a statement from the concerned party in cases where the DPA deems it necessary to be able to conclude a decision on an erasure request. Eventually, the board highlighted that the fact that the the concerned party's own assessment of whether the information is necessary for archival purposes must be given great weight does not change the fact that the DPA is the authority to receive and process erasure requests.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
PVN-2022-19 Demand for deletion of personal data in child welfare records
The Norwegian Data Protection Authority's reference:
22/03062-5
ANONYMIZED VERSION
The Norwegian Privacy Board's decision on 28 February 2023 (Mari Bø Haugstad, Bjørnar Borvik, Hans Marius Graasvold, Heidi Talsethagen, Morten Goodwin, Malin Tønseth)
The case concerns a complaint from A against the Norwegian Data Protection Authority's decision on 30 September 2022, where the Norwegian Authority concluded that the child welfare service in municipality X has not breached the Personal Data Act by rejecting requests to delete information in the son's child welfare record.
Background of the case
A contacted the Danish Data Protection Authority on 5 April 2022 with a request for assistance to delete information in the son's child welfare record that the father is a tater.
In a letter dated 10 March 2022, the child welfare service in X municipality has refused A's request to delete the information about the father in the son's record.
In a decision on 30 September 2022 to A, the Norwegian Data Protection Authority explained the rules relating to the child welfare service's documentation and archiving obligation and the right to erasure in the Personal Protection Regulation Article 17. The Norwegian Data Protection Authority concluded that the Child Protection Service in X municipality has not breached the Personal Data Act by rejecting the deletion request and closed the case.
A filed a timely complaint against the Norwegian Data Protection Authority's decision on 20 October 2022.
The Norwegian Data Protection Authority assessed the complaint, but found no reason to change its decision. The Norwegian Data Protection Authority forwarded the case to the Personal Protection Board on 16 November 2022. The parties were informed about the case in a letter from the board on 24 November 2022, and were given the opportunity to make comments. A gave his comments in e-mails to the tribunal on 29 November 2022 and 23 January 2023.
The child protection service has explained its view in a letter to the tribunal on 31 January 2023 by sending a letter from the child protection service to A on 10 March 2022. In the letter, the child protection service explains its view and justifies the rejection of A's request for deletion.
A has given his comments on the letter in an e-mail to the tribunal on 6 February 2023.
The case was dealt with in the committee's meeting on 24 January and 28 February 2023. The privacy committee had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Hans Marius Graasvold, Heidi Talsethagen, Morten Goodwin and Malin Tønseth. Secretariat manager Anette Klem Funderud was also present.
The Norwegian Data Protection Authority's assessment in brief
The Danish Data Protection Authority first explains the child protection service's statutory documentation obligation in the Child Protection Act § 1-4 and archiving duty in the Archives Act § 9, as well as the National Archives' regulations on preservation and disposal in child protection cases, cf. § 7-28 no. 9 letter d and points out that there are strict rules for what is required to be archived in a child protection case.
The Norwegian Data Protection Authority then starts from the fact that the right to deletion in this case must be assessed based on whether the personal data is no longer "necessary for the purpose for which it was collected or processed", cf. the Personal Protection Regulation article 17 no. 1 letter a.
The Norwegian Data Protection Authority assumes that the information about the father's ethnicity is correct, and that there is therefore no question of incorrect information. What is considered "necessary" for adequate documentation in the individual child protection case requires child protection expertise as well as insight into the individual case, which the Norwegian Data Protection Authority determines that the authority does not have. It is therefore difficult for the Norwegian Data Protection Authority to verify assessments of what is considered to be necessary information for the child protection service to fulfill its documentation obligation. However, the Norwegian Data Protection Authority clarifies that it is very important that all information that is considered relevant is registered in a child protection record, and refers to the Norwegian Personal Protection Board's statements in case PVN-2018-02 that "there must be a high threshold for making a decision on the deletion of personal data in child protection journal".
The Norwegian Data Protection Authority determines that when the municipality has assessed information as worthy of archiving, section 9 of the Archives Act with regulations will prevent the information from being deleted, cf. the personal protection regulation article 17 no. 3 letters b and d.
After an overall assessment, the Norwegian Data Protection Authority finds no basis for concluding that the child protection service has breached the privacy regulations by refusing requests for deletion of information about the father's ethnicity in accordance with the privacy regulation article 17 no. 1.
As's view of the case in brief
They have several times asked the children's welfare service why it is necessary to write that the father is a Tater when he is ethnically Norwegian. They have also tried to explain the disadvantage of using the word tater several times. They have tried repeatedly to take this up with the mayor of the municipality and the director of the municipality, but never get an answer to this.
They had a meeting with the state administrator on 18 January 2022. After that, the state administrator sent a letter to all municipalities in Y about minorities, as there was clearly little knowledge about this. The mayor has still not responded to their inquiry.
In 2015, the state and church had to apologize to the travelers for what they had to go through. It was a dark story that should not be repeated. Everyone knew what the travelers had to go through, both from lobotomization, sterilization and that children were deprived of their parents without a decision. The children were often called fantungs/damn tater kids etc. This story was told by the father to the child welfare services during a conversation with them about his own upbringing. Nevertheless, they choose to write in the journal that the father is a tater.
Father does not use taters about himself as taters are considered by many to be derogatory and stigmatizing. This group was met with many prejudices for many years in Norway, as his mother was also treated. She was deprived of all her children on the grounds that she was of Travelers, including one of the complainants (father) in this case. Father was often called "your fan tongue" when he was a child because he belonged to the travelers. Why is there such a need for child protection to write something he says violates his identity?
Father has become disabled because of the upbringing the state gave him, stole him from mother because she was a traveller. Father is afraid that using the word "tater" would affect his children. That is why he never uses the fact that he himself is a Tater of a minority. He may say that he belongs to the travelers. However, he also does not want this information to appear in the child welfare service's medical record, as he believes it is unnecessary.
For the father, the use of the word "tater" implies hateful speech which is covered by section 185 of the Criminal Code. That the father should feel discriminated against/persecuted because the child protection service is suspended from keeping this in the record is incomprehensible.
The son was 4 years old at the time (2018) and had to take a hearing and vision test which turned out to be difficult because he thought it was scary. They tried several times without success, and experienced being reported to child protection because of this. It was completely unnecessary as the health center was actually supposed to forward such cases to the specialist health service, which they never did. Instead, the case was dismissed with a finger pointed at the parents. They were told that they had to have confidence in the health service at X in the future, otherwise child protection would be concerned. The case was dropped, but they still got this finger. The parents believe this is due to prejudice against the father's minority background and nothing else.
The municipality's view on the matter in brief
It was the health center that reported concerns to the child welfare service in June 2019. The case was dealt with in accordance with the current legislation both with regard to review of the report and further investigation, see current Act on Child Welfare Services Section 4-3.
After a conversation with A and an investigation report, the child protection case was closed. A's comments on the report were stored in the son's folder with other documents in the case. Incidentally, complaints from A that are addressed to the child welfare service are stored in the case's documents.
A has complained to child welfare and to the state administrator that an investigation case was established and how this was carried out. The state administrator has found no basis for establishing a supervisory case against the child protection service.
As regards the information that the father belongs to a national minority, in the case it is only reproduced from what the father himself says.
The Child Protection Service received an e-mail from the father on 4 February 2021 in which he asks whether information regarding health and ethnic background had been deleted. The request was answered the same day. It is shown here that the case has been closed on the part of the child protection services, and the documents in the case have been locked in accordance with the current rules in the Child Protection Act and the Archives Act. The Child Protection Service will not take any further action in the matter. This relationship was appealed and the case was forwarded to the state administrator the following day.
In its briefing to the state administrator, the child welfare service wrote the following:
"When it comes to information about the father being the father, this appears in a journal entry dated 18.06.19. It is the father himself who comes up with this information. Both in this conversation and in other contact with the family, they convey that their understanding of the case is that this is about racism and a witch hunt on the part of the municipality. The father's association with a minority or upbringing is not taken into account in the further case documents. In the investigation report, the family's understanding of the case is only briefly shown. The information appears to be essential as it helps form a basis for understanding why the family has the understanding they have of the case as well as the reactions the family has had during and after the case."
In its letter, the state administrator has referred A to the Norwegian Data Protection Authority as the proper authority for appeals regarding the demand for deletion of information in the son's child welfare record.
The child welfare service neither can nor sees reason to correct/delete information in the son's child welfare record.
The Norwegian Privacy Board's assessment
Request for deletion
Article 17 no. 1 of the Personal Protection Regulation gives the data subject the right to have information about him deleted under certain conditions. The relevant options for requesting deletion in this case are Article 17 No. 1 letter a (no longer necessary for the purpose for which they were collected) and Article 17 No. 1 letter c (the data subject objects to the processing pursuant to Article 21 No. 1 and there are no more weighty reasons for the processing).
Article 17 no. 3 letter b and d makes an exception to the right to deletion if the processing of personal data is necessary to fulfill a legal obligation (letter b) or for archival purposes in the public interest (letter d).
About the exceptions in article 17 no. 3 letters b and d, the ministry says in Prop. 56 LS (2017-2018) page 81:
"Article 17 no. 3 letter d makes exceptions to the right to erasure under the same conditions as in article 14 no. 5 letter b. The data subject is therefore not entitled to deletion if this would make it impossible or seriously hinder the fulfillment of the purposes of processing for archives, research and statistics in accordance with Article 89 no. 1. It can also be mentioned that the data subject does not have the right to deletion either if the processing is necessary to fulfill a legal obligation under Union law or national law or to carry out a task in the public interest, cf. Article 17 no. 3 letter b. This means that the Archives Act's rules on cassation and limited right of disposal in the same way as in day will go before the court of
deletion, cf. section 28 first paragraph of the current law. In contrast to the current Personal Data Act, the regulation does not give the Norwegian Data Protection Authority any competence to make a decision on deletion that precedes the archives legislation, sml. applicable Personal Data Act § 27 third paragraph and § 28 fourth paragraph."
The information that the father is a tater appears in the child protection service's journal note on 18 June 2019 in connection with the child protection service's follow-up of a report of concern from the health center about A's son. According to the child welfare service, the journal note is a reproduction of what the father himself says. A agrees that he told the child protection service about his background, including his experiences with bullying and what he experienced as a witch hunt from the authorities because of his family's belonging to a national minority. He still believes this is irrelevant to the child protection service's handling of the case about his son.
It has been stated that the child welfare case, after a conversation with A and an investigation report, was closed. The purpose of continued storage of the information is now based on archival purposes in the public interest, cf. the provisions on archival material in the Archives Act. It follows from the Personal Protection Regulation article 5 no. 1 letter b that further processing of information for archival purposes in the public interest is not considered incompatible with the original purpose.
The Archives Act with regulations has rules on the archiving and preservation of documents. According to section 1, the purpose of the act is:
"to secure archives that have monal cultural or research value or that contain legal or important administrative documentation, so that these can be preserved and made available for posterity".
It follows from the National Archivist's regulation of 19 December 2017 no. 2286 section 7-1 letter c that the purpose is, among other things, to:
"ensure that archives are not disposed of before legal and administrative documentation needs have ceased."
In the regulations, part III, it is established which types of cases cannot be deleted ("made subject to cassation"), see § 7-23 and § 7-28, ninth paragraph. In § 7-28 ninth paragraph letter a, it is determined that "Procedures, routines and case management processes for the child protection service, including handling of reports of concern" shall be preserved for posterity and shall not be made the subject of appeal.
It follows from this that the journal note itself cannot be required to be deleted. The question is whether the information about the father's belonging to an ethnic minority can be required to be deleted, even if the journal note is otherwise archived. According to the tribunal's assessment, it must depend on whether the information about ethnic affiliation is necessary to understand the context and content of the journal note and the child welfare service's processing of the report of concern.
The child protection service has indicated that A and the family have otherwise communicated that they feel that the child protection case is about racism and represents a witch hunt against them from the municipality's side. This is reproduced in the journal note. The father's ethnicity and association with a minority group are not mentioned in the later case documents, and the investigation report only briefly shows the family's understanding of the case. In line with previous practice, the tribunal assumes that there must be a high threshold for making a decision on the deletion of personal data in the child welfare record, cf. PVN-2018-02. Child protection considers the information to be essential because it forms the basis for understanding why the family has the understanding they have of the case as well as the reactions the family has had during and after the case. The tribunal considers this to be sufficient justification from the child protection service that the information in the journal note is necessary to understand the child protection service's processing of the report of concern.
A is not successful in his appeal.
Conclusion
The Norwegian Data Protection Authority's decision not to order the deletion of information in the child protection record is upheld.
The decision is unanimous.
Oslo, 28 February 2023
Mari Bø Haugstad
Manager
