Personvernnemnda (Norway) - PVN-2023-04
| Personvernnemnda - PVN-2023-04 | |
|---|---|
 | |
| Court: | PVN (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 16 GDPR |
| Decided: | 15.09.2023 |
| Published: | 15.09.2023 |
| Parties: | Datatilsynet |
| National Case Number/Name: | PVN-2023-04 |
| European Case Law Identifier: | |
| Appeal from: | Datatilsynet 21/02380-4 og 5 |
| Appeal to: | Unknown |
| Original Language(s): | Norwegian |
| Original Source: | Personvernnemnda (in Norwegian) |
| Initial Contributor: | co |
The Norwegian Privacy Appeals Board (Personvernnemnda) upheld the Norwegian DPA’s decision that a data subject does not have a right to rectification of his personal data under Article 16 GDPR, when the data in question is not factually incorrect.
English Summary
Facts
The data subject had been receiving unemployment benefits from NAV, the Norwegian Labour and Welfare Administration (the controller) since autumn 2015. With a decision of 2 October 2015, the controller suspended benefits to the data subject as he stated that he was in education, thus no longer entitled to receive them. Later, the data subject submitted more information stating that he was not an active student and the controller reassessed the case and started granting him benefits again from 30 November 2015. On 17 March 2016, the controller issued a new decision reversing its October 2015 decision to suspend benefits, so that the data subject was granted unemployment benefits also for the period of suspension. In relation to this, the data subject requested the controller to obtain access to his personal data and to rectify inaccurate data about him, namely the fact that he was in education or training while also receiving benefits, as stated in the decision of suspension of benefits of October 2015. On 26 May 2021, the controller refused to comply with the request for rectification of the data included in its decision of October 2015 as it added a note in that document referring to its corrected decision of March 2016.
The data subject filed a complaint with the Norwegian DPA on 6 June 2021 asking the DPA to order the controller to provide him with all documents including his personal data and rectify inaccurate data about him and to assess any other GDPR violations by the controller.
On 14 December 2021, the Norwegian DPA held that the controller could not comply with the data subject’s request to rectification/completion of his data according with Article 16 GDPR as the information was not per se incorrect and thus the first condition under Article 16 GDPR was not met. Given that the controller added a note to its decision of 2 October 2015 referring to its corrected decision of March 2016, it thus fulfilled the complainant’s request of rectification of his personal data.
Holding
The data subject was dissatisfied with the DPA’s decision as it claimed that adding a note to a decision that references the corrected one cannot be considered rectification and decided to appeal. Thus, on 6 February 2023, the Norwegian DPA transferred the case to the Norwegian Privacy Appeals Board (Personvernnemnda) for review.
On 15 September 2023, the Board considered the case and held that the two decisions concerning the suspension and granting of unemployment benefits issued by the controller must be seen in conjunction with one another. As regards the decision of October 2015, the Board held that the information included therein cannot be considered an objective factual error since that decision was based on evidence describing the data subject’s situation in that moment, namely that he was in education, as he submitted in his application for benefits. It follows that the information required to be corrected is not “incorrect” data and it thus falls outside the scope of Article 16 GDPR. In addition to this, the Board clarified that, with its decision of March 2016, the controller fulfilled the data subject’s request by supplementing its initial decision, and provided the correct information about the complainant. In the Board’s view, both decisions must be read together which translates as follows: the controller does not consider the data subject to be in education and it recognises its suspension of benefits of October 2015 to be unlawful, meaning that no incorrect information about the data subject was registered.
The Board thus upheld the DPA's decision and concluded that the data subject does not have a right to claim rectification of his personal data by virtue of Article 16 GDPR as the condition for rectification set out in its first sentence is not met.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
The Privacy Board's decision 15 September 2023 (Mari Bø Haugstad, Bjørnar Borvik, Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem, Morten Goodwin, Malin Tønseth) The case concerns a complaint from A about the Norwegian Data Protection Authority's decision on 20 December 2021, where the Norwegian Data Protection Authority concluded that there was no basis for correcting a decision from NAV, cf. Article 16 of the Personal Data Protection Regulation. Background of the case In autumn 2015, A received unemployment benefits from NAV. He applied for support to establish his own business on 15 September 2015 and stated that he was doing a master's degree. On 2 October 2015, NAV made a decision to suspend unemployment benefits from 28 September 2015. In the decision, NAV assumed that A was "undergoing education or training" and therefore did not meet the conditions for entitlement to unemployment benefits. After further correspondence with A, NAV reassessed the case and granted, in a decision on 1 December 2015, A daily allowance from 30 November 2015. In a decision on 17 March 2016, NAV made a new decision which entailed a reversal of the decision of 2 October 2015 on suspension of unemployment benefits. NAV concluded that unemployment benefits should not have been suspended and granted A unemployment benefits also for the period 28 September 2015 to 30 November 2015. A was dissatisfied with the handling of the case at NAV and made various demands relating to the correction and supplementation of information in the case documents, as well as demands for access. On 26 May 2021, NAV refused As's request for correction of the decision of 2 October 2015 on the suspension of unemployment benefits. NAV supplemented the decision with an electronic note in the document that referred to the conversion decision on 17 March 2016. A brought the matter before the Norwegian Data Protection Authority on 6 June 2021 and maintained its claim for rectification. He also made a demand to be sent all of NAV's documents in the case, as well as asking that the Norwegian Data Protection Authority assess possible other breaches under the Personal Data Protection Regulation. In a letter on 27 October 2021, the Norwegian Data Protection Authority gave guidance on A's rights under the Personal Data Act and the Personal Data Protection Regulation, including the right to correction and supplementation under Article 16 of the Data Protection Regulation. A maintained its claim related to lack of access, as well as a claim for the correction of incorrect information in an e-mail to the Norwegian Data Protection Authority on 16 November 2021. The Norwegian Data Protection Authority concluded on 14 December 2021 that NAV has fulfilled As's requirement for correction/completion, cf. the Personal Protection Regulation Article 16. The Authority asked NAV for an explanation of the way in which As's request for access was handled. After receiving NAV's explanation, the Norwegian Data Protection Authority did not find it appropriate to follow up the access case further and assumed that NAV and A would together find a solution to the access requirement. This part of the case was then closed in a letter to A on 23 June 2022. In the same letter, the Norwegian Data Protection Authority asked for feedback on whether A maintained its complaint from 11 January 2022 about the Norwegian Data Protection Authority's decision that NAV had fulfilled its obligation to correct/complete, cf. Article 16. In an e-mail on 12 July 2022, A stated that he maintained his complaint against the Norwegian Data Protection Authority's decision regarding correction/completion. The Norwegian Data Protection Authority assessed the complaint, but found no reason to change its decision. The Norwegian Data Protection Authority forwarded the case to the Personal Protection Board on 6 February 2023. The parties were informed about the case in a letter from the board on 9 February 2023, and were given the opportunity to make comments. NAV has submitted comments in letters on 28 February and 13 March 2023. A has given his comments in e-mail and letter on 1 March 2023, in e-mail on 22 June 2023 and in e-mail and letter on 6 September 2023 . The case was dealt with at the board's meeting on 15 September 2023. The privacy board had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Hans Marius Graasvold, Ellen Økland Blinkenberg, Hans Marius Tessem, Morten Goodwin and Malin Tønseth. Secretariat manager Anette Klem Funderud was also present. Briefly about the Norwegian Data Protection Authority's decision The Norwegian Data Protection Authority supports NAV's assessment that corrections cannot be made in the actual decision of 2 October 2015. The information that has been requested to be corrected is not an "incorrect" rendering of NAV's assessments at the time of the decision. This applies even if NAV later assessed the matter differently. The condition for rectification according to the Personal Protection Ordinance, Article 16, first sentence, is therefore not met. NAV has instead added a note to the decision of 2 October 2015 which refers to the decision of 17 March 2016. On this basis, as well as the fact that the complainant's view on the matter can be found in writing at NAV, it appears to the Norwegian Data Protection Authority that NAV has fulfilled the complainant's right to completion according to Article 16 of the Personal Data Protection Ordinance. As's view on the matter in general NAV has not corrected/corrected/completed incorrect information as NAV is obliged to do under the Personal Data Protection Ordinance. NAV's correction consists of the following notice added to a letter from 2 October 2015: "See amendment decision 17 March 2016". This is not an acceptable fix. The amendment decision does not refer to anything in the letter of 2 October 2015. He wants a textual description that clearly shows that he is not guilty or suspected of gross social security fraud for more than NOK 400,000, as the letter of 2 October 2015 actually indicates. He has done nothing wrong. At no time has there been a real basis for suspecting him of having done anything wrong in relation to unemployment benefits. Errors that have been made are due to mistakes and violations of the law on NAV's part. All subsequent proceedings related to the incorrect payment case, which NAV only closed in March 2018, are solely due to procedural errors. NAV has made serious mistakes in this letter and incorrect information must be corrected. He believes the following must be in place: to have it established in plain text that the decision is invalid, because it is based on the wrong facts and has several serious procedural errors · that NAV admits that he has not committed the offense the letter accuses him of, and that at no time has there been a basis for claiming this. Contrary to what the letter actually says that there have never been grounds for suspicion of the offense described, according to the standard for "reasonable grounds for suspicion" as described in Ot.prp.nr. 76 (2007-2008) point 4.5.2 and Ot.prp. No. 60 (2004-2005) point 4.5.3. that NAV on incorrect grounds refused to process an application to be allowed to keep unemployment benefits during the establishment of one's own business NAV's view on the matter in general A applied for unemployment benefits while setting up his own business on 15 September 2015. In this application it was stated that A was doing a master's degree. On the basis of this, a decision was made to suspend unemployment benefits from 28 September 2015, and A was asked to provide further documentation of his education, so that NAV could assess his right to unemployment benefits. After providing information that he was not an active student, A was granted unemployment benefit again from 30 November 2015 in a decision of 1 December 2015. This meant that he was left without unemployment benefit in the period from 28 September to 30 November 2015. However, on 17 March 2016 a new decision was made in which the previous decision on suspension dated 2 October 2015 was overturned in that he was still granted and paid unemployment benefit from 28 September 2015. This means that NAV already at this time considered that the earlier suspension of unemployment benefits in the decision of 2 October 2015 was still not correct. A's information that he was not in education in violation of the rules for unemployment benefits was therefore used as the basis for the decision of 17 March 2016. It is this decision that is the last applicable decision, not the revised decision of 2 October 2015 that A refers to to. A change to the content of a decision is thus made by NAV making a new decision in the case based on the information that is considered probable at any given time, not by correcting or deleting the content of the original decision. The decision of 2 October 2015 does not stand alone, but must be seen in the context of the later revision decision of 17 March 2016. The content of the decision of 2 October 2015 can hardly be considered an objective factual error, as it is the result of a concrete evidence assessment that NAV made at that time, and which has subsequently been changed. This will thereby fall outside of what NAV is obliged to correct under Article 16. The note on the decision of 2 October 2015 which refers to the amendment decision of 17 March 2016 gives a correct picture of the reality of the case. NAV has thus made a correction by supplementing it in line with Article 16 of the Personal Data Protection Ordinance. The Norwegian Privacy Board's assessment Article 5 of the Personal Data Protection Regulation lays down principles for the processing of personal data. Article 5 no. 1 letter d states that the information must be correct and if necessary updated and that every "reasonable measure" must be taken to ensure that personal information that is incorrect with regard to the purposes for which it is processed is deleted or corrected without delay . Article 16 of the Personal Data Protection Regulation gives the data subject the right to rectification: "The data subject shall have the right to have incorrect personal information about himself corrected by the data controller without undue delay. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by submitting a supplementary declaration. When NAV makes a decision on the granting or suspension of unemployment benefits, NAV must firstly interpret the legal rules on when an applicant is entitled to unemployment benefits or not, and then carry out an evidentiary assessment of the facts, in order to decide whether the actual situation is such that it meets the statutory conditions for being granted unemployment benefit. If NAV interprets the legal rule incorrectly or makes an incorrect assessment of the facts, this could result in an incorrect decision. If NAV has used an incorrect understanding of the facts as the basis for its decision, this will normally be apparent from the reasoning in the decision and may also include incorrect personal information. Such errors cannot be required to be rectified under Article 16, but can be changed by the decision being appealed, overturned or changed through a new decision, as is the case in this case. The decision from 2 October 2015 correctly expresses the fact that NAV used as a basis when this decision was made. In the subsequent decisions on 1 December 2015 and 17 March 2016, NAV reversed its assessment of the actual circumstances and granted A unemployment benefits in line with his application. According to the tribunal's assessment, it appears from the three decisions read in context that A was not an active student at the time of applying for unemployment benefits and that NAV's suspension of unemployment benefits in October 2015 was unlawful. Overall, this means that no incorrect information has been registered about A. The condition for correction according to Article 16 first sentence is therefore not met and NAV cannot be ordered to correct or supplement the information. Based on A's submissions, the tribunal will emphasize that it is not up to either the Norwegian Data Protection Authority or the Personal Data Protection Board to assess whether or not the evidence assessment of the facts NAV carried out in October 2015 on the basis of A's application was justifiable or not. The same applies to the proceedings at NAV. The tribunal has then come to the conclusion that A cannot claim rectification under Article 16. A is not successful in his appeal. Conclusion The Norwegian Data Protection Authority's decision is upheld. The decision is unanimous. Oslo, 15 September 2023 Mari Bø Haugstad Manager
