Datatilsynet (Norway) - 20/01772
Datatilsynet - 20/01772 | |
---|---|
Authority: | Datatilsynet (Norway) |
Jurisdiction: | Norway |
Relevant Law: | Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 6(1) GDPR Article 6(3) GDPR Article 9(2)(d) GDPR Article 9(2)(g) GDPR Article 12(1) GDPR Article 14(1)(d) GDPR Article 14(2)(f) GDPR Article 14(5)(c) GDPR Article 17(1)(d) GDPR Article 58(2)(b) GDPR |
Type: | Investigation |
Outcome: | Violation Found |
Started: | 28.02.2020 |
Decided: | 09.01.2023 |
Published: | 16.01.2023 |
Fine: | n/a |
Parties: | Church of Norway - Den norske kirke |
National Case Number/Name: | 20/01772 |
European Case Law Identifier: | n/a |
Appeal: | n/a |
Original Language(s): | Norwegian Norwegian |
Original Source: | Norwegian DPA Datatilsynet (in NO) Norwegian DPA Datatilsynet (press release) (in NO) |
Initial Contributor: | Rie Aleksandra Walle |
The Norwegian DPA reprimanded the Church of Norway for unlawfully collecting information on members' newborns after their legal basis for such processing had expired, and for failing to provide sufficient information as per Articles 14(1)(d), 14(2)(f) and 12(1) GDPR.
English Summary
Facts
On 28 Febaruary 2020 the Norwegian Humanist Association and lawfirm Bull & Co lodged a complaint with the Norwegian DPA on behalf of eight data subjects, claiming that the Church of Norway (the controller) had unlawfully collected information on the data subjects' newborns, also failing to inform them about this processing. Consequently, the DPA launched an investigation.
If at least one parent was an existing member of the Church, the controller was allowed to register newborns (as 'affiliated persons') in their member register and, on the same condition, they also had permission as per the national population regulations to receive automatic notifications on newborns. This permission expired on 1 October 2018, and on 1 January 2021 the other relevant regulations were replaced.
The controller, however, still continued to receive the automatic notifications until 14 November 2018. At this point, they still considered that the minors registered during the period 1 October to 14 November were correctly registered as per the (now expired) Norwegian Church law, and did not delete them. When they realised that the correct end date was 1 October, they initiated an erasure process, but due to a claimed technical error, this was not effectuated until 18 August 2020.
They also informed the DPA that the personal data on affiliated persons would be deleted when their legal basis for this processing expired on 1 January 2021. On 22 January 2021, they informed that the personal data of 108 880 data subjects were deleted.
On the topic of information to the data subjects, the controller claimed that they could rely on the exemption in Article 14(5)(c) GDPR and noted that they still provided some information through the main privacy notice for the Church, as well as on local websites.
Holding
The DPA held that the controller had violated Article 6(1) GDPR by processing personal data on members' newborns between 1 October and 14 November 2018, and to continue to store the personal data, without a legal basis. The DPA also held that the controller had violated Articles 14(1)(d), 14(2)(f) and 12(1) GDPR by not providing the data subjects easily available information about the collection of automatic birth notifications from the National Population Register.
In addition, the DPA noted that the controller could not rely on the exemption in Article 14(5)(c) GDPR, because the collection of automatic birth notifications was not expressly provided by the relevant law (the former Norwegian Church law).
Comment
By initial contributor: Interestingly, the DPA does not impose a fine in this case, despite the processing of special category personal data as per Article 9 GDPR. They comment in the press release that the reason for not opting for a stricter reaction is that the case has "some mitigating factors", without specifying these further. The DPA also does not address or make any comments regarding the complainants claims that the Church violated Articles 24, 33 and 35 GDPR, nor finds a violation of Article 5(1)(a) GDPR, which is a bit surprising considering the violations they did find.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
THE NORWEGIAN CHURCH Postbox 799 Centrum Excluded from the public: 0106 OSLO Official § 13, cf. Personal Data Act § 24 first paragraph 2nd period Your reference Our reference Date 20/01772-19 09.01.2023 Decision on reprimand - Processing of minors' information in Den Norwegian Church 1 Introduction We refer to our notice of a decision to reprimand the Church of Norway by the Council of Churches (hereinafter "DNK") dated 23 June 2021, and DNK's comments to the notice of 1 July 2021. In the comments, DNK apologized for the breaches of the data protection regulation and the Data Protection Authority's notified decision on reprimand for information. In the notes, DNK further writes that the organization will ensure compliance with the privacy requirements that were explained in The Norwegian Data Protection Authority's letter pointing out the duty of 1 July 2021. The Norwegian Data Protection Authority received comments from the Human-Ethical Association (hereinafter "HEF") on behalf of the complainants on 7 September 2021. 2. Notice of decision on reprimand The Norwegian Data Protection Authority hereby adopts a decision to reprimand the Church of Norway by the Council of Churches, 818 066 872, for: • Violation of the personal protection regulation article 6 no. 1, by obtaining birth notifications for members' children from the Population Register from 1 October to 14 November 2018, and by continue to store the personal data that was collected through the birth certificates, without a valid legal basis. • Breach of the Personal Data Protection Regulation article 14 no. 1 letter d and no. 2 letter f, cf. article 12 no. 1, by not providing easily accessible information to the registered about the collection of birth notices for members' children from the National Register of Citizens. Our authority for issuing a reprimand is the Personal Protection Regulation article 58 no. 2 letter b. 3. Background of the case Postal address: Office address: Telephone: Org. no: Homepage: 1 PO Box 458 Sentrum Trelastgata 3 22 39 69 00 974 761 467 www.datatilsynet.no 0105 OSLO 0191 OSLO The complaint from the Human-Ethical Association dated 28 February 2020 On 28 February 2020, the Norwegian Data Protection Authority received a complaint about the treatment of minors personal data in The Norwegian Church at the Church Council (hereafter DNK) from Human-Ethical Forbund (hereafter HEF) and Bull & Co Advokatfirma on behalf of eight registered persons. It appeared from the complaint that the complainants reacted to the fact that they or their children were still listed as belonging to the Church of Norway, despite the fact that the state church system was abolished and new the National Register Act had entered into force. This also applied to a child born after 1 October 2018, when the authority for access to confidential information from the National Register had ceased. The complainants wrote that the registration had taken place without their knowledge, and despite the fact that they or their guardians never did anything active in terms of registration, baptism or church confirmation. In the complaint, it was also pointed out that certain registered users had tried to opt out several times, without success. Common for the complainants is that they experienced not being informed about what that happened to their and their children's personal data. In the complaint, it was stated that the Church of Norway violates the principle of openness i the personal protection regulation article 5 no. 1 letter a and the information requirements in article 14. Furthermore, it was stated that DNK violates the data minimization principle in Article 5 no. 1 letter c by storing personal data about the dependents until they are 18 years old. Based on the complaint, the Norwegian Data Protection Authority sent a demand for an explanation to DNK on 12 August 2020, and new requirements for further explanations on 16 December 2020 and 21 April 2021. Explanations from DNK in letters dated 2 September 2020, 22 January 2021 and 11 May 2021 DNK responded to the Data Protection Authority's request for explanations on 2 September 2020, 22 January 2021 and 11 May 2021. In the reply of 2 September 2020, it was stated that DNK processed personal data about minors belonging to the purpose of fulfilling their duties in the now repealed Church Act § 3. In addition, relatives counted together with DNK's members in the calculation basis for the state's grants to faith and belief communities in accordance with the Church Act and the Act on Faith Communities and ymist another. Both the Church Act and the Act on Faithful Communities and a lot of other things became 1 January 2021 replaced with the new Religious Communities Act. DNK pointed out that their membership registration had a legal basis in the Personal Data Protection Regulation article 6 no. 1 letters c and e, and that the supplementary legal basis according to article 6 no. 3 was Church Act § 3 no. 10 and provisions in the related regulations on the Church of Norway member register. DNK stated that the obligation to register only ceased at the age of 18, and that personal data could therefore not be deleted earlier. For processing special categories of personal data, it was stated that the Personal Protection Regulation article 9. no. 2 letter d and g was fulfilled. 1FOR-2016-04-12-1205 2DNK further stated that DNK was exempt from the obligation to provide information in the Personal Protection Ordinance i subject to the exception in Article 14 no. 5 letter c. It is nevertheless granted to varying degrees information at national and regional level through privacy statements at kirken.no or local websites, as well as through baptism invitations that are sent out. In the report dated 11 May In 2021, DNK presented documentation of the information that was available to them registered in the period from 20 July to 1 October 2018. According to DNK, the reason why not all statements from the complainants have been implemented may be wrong from the local congregation. DNK further informed that the delivery of birth notifications from the National Register of Citizens did not stop up 1 October 2018, when the authority for access to confidential information from The population register ceased. DNK had an ongoing appeal pending at the Tax Agency regarding rights to national register information, and was informed by EVRY Information services that it was recommended not to make changes before this appeal was settled. The Church Council was eventually brought to the fore that this was an incorrect assessment, and delivery of birth notifications stopped on 14 November 2018. DNK then assessed that the children who were registered through birth notifications in the period 1. October to 14 November 2018 was correctly registered in accordance with § 3 of the Norwegian Church Act, and therefore let these entries remain. The date 1 October 2018 gradually became a known date for the changes in access to population register information. Therefore DNK wanted the automatic registration of those belonging to the membership register should correspond to this date. DNK therefore ordered a deletion of the personal details of the children who were registered through birth notifications in the period 1. October–14. November 2018 in September 2019. Procedure for the deletion job was carried out and approved in the member register's test environment, but due to an error it was not carried out accurately same procedure in the member register's production environment. Something smaller was therefore deleted data in the production environment. Thus, the relatives were born in the period 1 October–14. November 2018 still in the membership register. This information was later deleted on 18 August 2020. In the statement of 2 September, DNK informed that personal information about relatives would be deleted upon the termination of the Church Act's automatic affiliation scheme for children in Den norske church on 1 January 2021, unless the parents registered the child in DNK and DNK thus got a other legal basis for the processing of your personal data. In the statement of 22. January 2021, it was informed that of the 109,663 members who were registered in member register before the turn of the year, the personal information of 108,880 was deleted by DNK. New complaints in HEF's letter to the Norwegian Data Protection Authority dated 30 September 2020 and 22 February 2021. HEF has made comments to the reports the Norwegian Data Protection Authority has received from DNK, and has in in this connection extended the complaint on behalf of the registered. 3HEF states that the transfer of confidential population register information after 1 October 2018, as well as the continued processing of this personal data, was illegal. Furthermore, it is stated that DNK has not implemented sufficient technical or organizational measures according to the personal data protection regulation article 24, and that the transfer of confidentiality population register information after 1 October 2018 was not documented and reported to The Danish Data Protection Authority's personal protection regulation article 33. It was further stated that DNK did not have carried out a DPIA in accordance with Article 35 of the Personal Data Protection Regulation. The Norwegian Data Protection Authority's notice, comments from NDK and comments from HEF The Norwegian Data Protection Authority announced a decision to reprimand DNK on 23 June 2021 for breach of the personal protection regulation article 6 no. 1 letter a and article 14 no. 1 letter d and no. 2 letter f, cf. article 12 no. 1. In its comments to the notice of 1 July 2021, DNK took note of the Danish Data Protection Authority's assessments and apologized for the violations. In its comments on the notice of 7 September 2021, HEF asked the Norwegian Data Protection Authority to reconsider its notify concussion regarding the issue of data minimization, process all complaints together and in all cases reconsider their notified sanction of reprimand. 4. Legal background The Personal Data Protection Regulation and processing responsibility The Personal Data Act implements the Personal Data Protection Regulation in Norwegian law, and entered into force 20 July 2018. It follows from the personal protection regulation article 4 no. 7 that the data controller is the which determines the purpose of the processing of personal data and the means to be used used. Principles for processing personal data and legal basis The basic principles for processing personal data follow the personal protection regulation article 5 no. 1. Here it follows, among other things, that: • Personal data must be processed in a legal, fair and transparent manner, cf. letter a. • The personal data processed must be adequate, relevant and limited to that which is necessary for the purposes for which they are processed, cf. letter c. • The personal information must not be stored for longer periods than is necessary the purposes for which they are processed, cf. letter e. The data controller must be able to demonstrate that the privacy price norms are complied with, cf. Article 5 No. 2. 4 All processing of personal data must have a legal basis according to the Personal Protection Ordinance Article 6 No. 1 to be legal. Legal grounds for the processing can be: • The registered person has consented to the processing of personal data for one or more specific purposes, cf. letter a. • The processing is necessary to fulfill a legal obligation incumbent upon it data controller, cf. letter c. • The processing is necessary to carry out a task in the public interest or exercise public authority to which the data controller is required, cf. letter e. • The processing is necessary for purposes related to the legitimate interests which is pursued by the controller or a third party, unless it is registered interests or fundamental rights and freedoms take precedence and require protection of personal data, especially if the registered person is a child, cf. letter f. The grounds for processing under Article 6 no. 1 letter c and e shall follow Norwegian law, cf. article 6 no. 3. For special categories of personal data, such as personal data about religion, health or sexual orientation, the starting point is that such treatment is prohibited, unless some of the exceptions in the regulation's article 9 no. 2 apply. Information about family relationships can for example infer information about sexual orientation. This requirement is in addition to the requirement for processing grounds according to Article 6. Children have the right to special protection of their personal data and privacy, cf. point no. 38 of the Personal Protection Ordinance. Information requirements Anyone who has their personal data processed has the right to information about several matters. When the personal information has been obtained from someone other than the registered person, it follows Article 14 of the Personal Data Protection Regulation states that, among other things, one must be informed about the identity and the contact details of the data controller and their possible privacy representative, the purposes for which the information is processed, the processing basis, the affected categories of personal data, the period for storing the data, the source of the data from and the right to request deletion of personal data, cf. article 14 nos. 1 and 2. If the processing is based on Article 6 no. 1 letter f, the entitled persons must also be informed the interests pursued by the controller or a third party, cf. article 14 no. 2. The controller must take appropriate measures to provide the information that is required according to Article 14 in a concise, open, understandable and easily accessible way, and in a clear and single language, cf. Article 12 no. 1. The information must be provided within a reasonable time after the personal information has been collected, but at the latest within one month, cf. article 14 no. 3, letter a. 5 According to article 14 no. 5, this article does not apply if: • The registered person already has the information, cf. letter a. • It turns out to be impossible to provide said information or it will involve a disproportionate effort, cf. letter b. • The collection is expressly stipulated in Union law or the national law of the member states to which the data controller is subject, and which contains suitable measures to protect the data subject's legitimate interests. Deletion of personal data Article 17 gives the data subject in many cases a right to have their personal data deleted, and the data controller also has a duty to delete the personal data on its own initiative if certain conditions are met. According to Article 17 no. 1 letter d, this applies among otherwise if the personal data has been processed illegally. Article 17 nos. 1 and 2 do not apply if the processing is necessary to fulfill a legal obligation or to perform a task in the public interest or practice public authority to which the controller is responsible, cf. Article 17 no. 3 letter b. The affiliation scheme for children in the Church of Norway The Church Act's automatic affiliation scheme for children in the Church of Norway was repealed by the entry into force of the new Religious Communities Act on 1 January 2021. The new Religious Communities Act replaced both the Church Act and the Act on Faithful Communities and many other things. In the draft law, Prop 130 L (2018-2019) p. 141, it follows: "Since the law no longer provides rules that children automatically belong to the Church of Norway, then unless one or both parents are members, there will not be a statutory requirement that relatives must be included in the register, cf. also the notes to the individual provisions in § 17 of the bill." Before the new Religious Communities Act came into force on 1 January 2021, it followed from the Church Act section 3 no. 2 that children are considered to belong to the Church of Norway if one of the parents is a member. Children who were considered to belong to the Church of Norway became members of this when they were baptized. If the child turned 18 without being baptised, the person was no longer considered to belong under the Church of Norway, cf. § 3 no. 5. Persons who were considered to belong to or were members of the Church of Norway were registered in The Norwegian Church's central membership register, cf. § 3 no. 10. Rules on the keeping of the register were given by the Church Meeting, and the Church Council is responsible for processing the central membership register, cf. regulation on the Church of Norway's membership register § 4. Collection of information about members' children from the national register 6Previously, DNK has received digital birth notifications directly from the National Register of Citizens. Connected to the member information registered on parents, DNK could thus lead relatives into the church's membership register based on this information. In the National Register Act, which entered into force on 1 October 2017, information about kinship is subject obligation of confidentiality, cf. the National Register Act § 9-1, and can only be disclosed to public and private parties businesses that are authorized by law to obtain this information, cf. § 10-2. DNK was authorized to receive the birth notifications in the transition scheme in the National Register Act § 13-1 until 1 October 2018, but after this has no such legal authority. 5. The Norwegian Data Protection Authority's assessment 5.1. Limitation in the Norwegian Data Protection Authority's assessments The Personal Data Act implements the Personal Data Protection Regulation in Norwegian law, and entered into force 20 July 2018. The Norwegian Data Protection Authority has limited our investigations in this case to processing of personal data that has taken place after the Personal Data Protection Regulation entered into force. 5.2. Processing of birth notifications collected from the Population Register from 1 October to 14 November 2018 – Article 6 The collection of birth notifications from the National Register of Citizens from 1 October to 14 November 2018 DNK has informed in its reports that the deliveries of birth notices from the National Register of Citizens did not stop on 1 October 2018, but continued until 14 November 2018. Any processing of personal data requires a legal basis according to Article 6 No. 1 in order to be legal, including the collection of personal data. The Norwegian Data Protection Authority is thus assessing whether DNK had a legal basis for the collection of birth notices from the Population Register from 1 October to 14 November 2018. In our demand for an explanation of 16 December 2020, the Norwegian Data Protection Authority asked DNK to explain which legal basis in the personal protection regulation article 6 no. 1 DNK had to collect the personal information about members' children through birth notifications from the National Register of Citizens i the period 1 October to 14 November 2018. DNK replied in the statement of 22 January 2021 that it was not DNK's intention to collect the relevant confidential personal information in violation of the law. It was nevertheless considered that DNK had a legal basis to continue to store the personal data on the persons concerned through birth notifications from the National Register of Citizens from 1 October to 14 November 2018 in their membership register pursuant to Article 6 no. 1 letters c and e. For the processing of personal data with a legal basis in Article 6 no. 1 letters c and e, it is required that the basis for the processing is laid down in national law, cf. Article 6 no. 3 DNK 7 has shown that the supplementary legal basis for storing the personal information about them relatives received through birth notifications from the National Register of Citizens from 1 October to 14 November 2018 in DNK's membership register, was § 3 no. 10 of the Church Act cf. § 3 no. 5. The Norwegian Data Protection Authority first assesses whether the basis for collection of the data belongs to them birth notifications from 1 October to 14 November 2018 were stipulated in national law, cf. Article 6 No. 3. It follows from recital 45 that a special statutory provision is not required for each individual treatment. A law may be sufficient as a basis for several processing activities. The the legal basis can further specify the regulation's general conditions for legal processing of personal data. As mentioned in point 5.2, the church has been authorized to register members in their member register, cf. § 3 no. 10 cf. § 3 no. 5. It further followed from § 10 of the regulation on Den church's membership register that DNK obliged to keep the membership register up to date on the basis of information from the National Map Agency's cadastral register, the central population register and the Unit Register. The collection and use of population register information is, however, specially regulated in the National Register Act which entered into force on 1 October 2017. According to section 1-2, the purpose of the act is to contribute so that the information in the National Register can be used for official and public tasks administration, research, statistics and to look after basic societal needs. After this one the Act, information about kinship is subject to a duty of confidentiality, cf. the National Register Act § 9-1, and can therefore only be disclosed to public and private enterprises that are authorized by law to obtain this information, cf. § 10-2. Section 3 of the Church Act said nothing about the disclosure of confidential information about kinship from Folkeregisteret, and did not give authority as mentioned in the Folkeregister Act § 10-2 first paragraph. DNA also had no other legal authority for the disclosure of confidential information from The National Register. However, DNK had permission to release the birth notices through a decision dated 18 June 2001 according to the old National Register Act, and was thus entitled to receive the birth notices through the transition scheme in the National Register Act § 13-1 first sentence until it lapsed a year after the law came into force. The People's Register Act entered into force on 1 October 2017, and the right to receive birth notifications therefore ceased on 1 October 2018. If the party had applied within this year for "equivalent disclosure of information", it applied access until the register authority has made a decision in the matter, cf. the National Register Act § 13-1 second sentence. Based on the correspondence between DNK, the Ministry of Finance and The Norwegian Tax Administration, in the view of the Norwegian Data Protection Authority, it was clarified no later than 19 September 2018 that DNK did not have an application for processing for "equivalent disclosure" of information to processing, as DNK's current case did not include access to those subject to confidentiality the information about kinship. DNK's permission to receive confidential information about kinship therefore did not apply from 1 October 2018. 8 That later misunderstandings arose through DNK's communication with EVRY, and that as a result of this, it was decided that the collection of birth notices from the National Register of Citizens would not should be stopped, does not change the conclusion that the collection of birth notifications was in contrary to the National Register Act. We further point out that it is DNK as the data controller was responsible for ensuring and demonstrating that the processing of personal data takes place in line with the rules in the personal protection regulation, cf. article 5 no. 2 and article 24 no. 1. We show for the sake of order also due to the fact that it followed from point 3.1 of the current agreement between DNK and EVRY: "Access to the Services is dependent on permission from SKD (competent population registration authority). The customer is himself responsible for managing such an application. The customer is responsible for processing Data in accordance with applicable laws and regulations.” As DNK's collection of the relatives' birth notifications from 1 October to 14 November 2018 was contrary to the National Register Act, was not the basis for the collection of the relatives birth notices from the National Register of Citizens stipulated in national law, cf. article 6 no. 3. It is thus clear that this collection was not "necessary to fulfill a legal obligation incumbent on the controller, or "necessary to carry out a task in the public interest', cf. article 6 no. 1 letters c and e. The Norwegian Data Protection Authority clarifies for the record that unlawful collection of personal data does not will not be able to constitute a "legitimate interest" for the data controller, cf. Article 6 No. letter f. DNK thus had no legal basis in Article 6 for the collection of birth notices from the National Register of Citizens from 1 October to 14 November 2018, and the relevant processing of personal data was illegal. Continued storage of personal data collected through birth notifications from The population register from 1 October to 14 November 2018 Although it was eventually clarified from DNK's side that the transfer of birth notifications from The population register from 1 October to 14 November 2018 was not in line with the Population Register Act, DNK considered that the children who were registered through birth notifications in the period from 1 October to 14 November 2018 was correctly registered in accordance with § 3 of the Church Act, and let these the entries remain. All processing of personal data, including storage, requires a legal basis in the article 6 No. 1 to be legal. Furthermore, the starting point is that the controller is obliged to delete personal data without unjustified stay if they have been processed illegally, cf. Article 17 no. 1 letter d. The Danish Data Protection Authority has concluded above the collection of birth notifications from The population register from 1 October to 14 November 2018 was in breach of the Population Register Act, and that 9 it did not have a legal basis in the personal protection regulation article 6. The relevant the processing of personal data was thus illegal. However, it follows from Article 17 no. 3 letter b that Article 17 no. 1 does not apply if the processing is necessary to fulfill a legal obligation or to perform a task i public interest or exercising public authority as the data controller imposed. This provision refers to the processing of personal data that has a legal basis basis in Article 6 no. 1 letters c and e. The Danish Data Protection Authority is therefore assessing whether DNK had a legal basis in the Personal Data Protection Regulation article 6 no. 1 for further storage of the personal data collected through birth notices from the Population Register from 1 October to 14 November 2018. DNK has shown that you had a legal basis in Article 6 no. 1 letters c and e to store the personal information about the relatives received through birth notifications from the National Register of Citizens from 1 October to 14 November 2018 in their membership register. For the processing of personal data with a legal basis in Article 6 no. 1 letters c and e, it is required that the basis for the processing is laid down in national law, cf. Article 6 No. 3 DNK has, as mentioned, stated that the supplementary legal basis for storing the personal data about the relatives received through birth notifications from the National Register of Citizens from 1 October to 14 November 2018 in their membership register, the Church Act was § 3 no. 10 cf. § 3 no. 5. The Danish Data Protection Authority first assesses whether the basis for the storage of personal data about them relatives collected from birth notifications from the Population Register 1 October to 14 November 2018 was laid down in national law, cf. Article 6 no. 3. It follows from recital 45, as mentioned, that no special statutory provision is required for each simple treatment. A law may be sufficient as a basis for several processing activities. The legal basis can further specify the regulation's general conditions for legality processing of personal data. It follows from Section 3 of the Norwegian Church Act that DNK must register members in their membership register. However, the collection of the relevant birth notifications was in breach of the National Register Act § 10-2. It also follows from the National Register Regulations Section 10-2-1 that confidential information must not be used for purposes other than those for which permission has been granted. DNK did not have permission from The tax authorities to use the confidential information, and continued storage of the information was thus also in breach of the National Register Regulations § 10-2-1. The People's Register Act and associated regulations are a special regulation for population register information, and will follow The Norwegian Data Protection Authority's assessment here takes precedence over the older church law in the event of a conflict. We points out, however, for the record, that neither the Church Act nor related regulations required DNK to obtain the relevant birth notifications from the National Register of Citizens. 2FOR-2017-07-14-1201 10 Due to continued storage of the confidential national register information collected through birth notices were in breach of the national register regulations, was not the basis for continuation storage of the personal data from the illegally obtained birth certificates from The population register laid down in national law, cf. article 6 no. 3. DNK thus had no legal basis for the continued storage of personal data from birth notices collected from the Population Register from 1 October to 14 November 2018, and the the current processing of personal data was illegal. 5.3. Information to the registered about the processing of personal data - article 14 HEF has stated that DNK breached the information requirements in Article 5 of the Personal Data Protection Regulation letter a and articles 12-14 related to the processing of personal data about relatives. In our demand for an explanation of 12 August 2020, we asked DNK to explain how DNK has fulfilled the information requirements in Article 14 where children's personal data have been registered based on population register information until this scheme ceased on 1 October 2018. In the statement of 2 September 2020, DNK stated that DNK was covered by the exception in the personal protection regulation article 14 no. 5 letter c. However, it is indicated that it is nevertheless carried out some information measures, including through privacy statements on kirken.no and articles on the website. It follows from the personal protection regulation article 14 no. 5 letter c that article 14 no. 1-4 may not application if "collection or disclosure is expressly provided for in Union law or the national law of the Member States to which the data controller is subject, and which contains suitable measures to protect the data subject's legitimate interests". The Norwegian Data Protection Authority first assesses whether DNK's collection of birth notifications from the National Register of Citizens was expressly provided for by the national law of the Member States in which the data controller is subject to, and which contain suitable measures to protect the data subject's legitimate interests, cf. article 14 no. 5 letter c. With the wording "expressly", it is clear that something more than just the foundation is required here for the processing is stipulated in the national law of the Member State in which the data controller is subject to, as follows from Article 6 No. 3. For Article 6 No. 3, a special statutory provision for each individual treatment, cf. paragraph 45. A law may be sufficient as a basis according to article 6 no. 3 for several processing activities that are based on a legal obligation incumbent on the controller, or if the processing is necessary to carry out a task in the public interest or exercise public authority. Article 29 Data Protection Working Party, the predecessor of the Personal Protection Council (EDPB), has i Guidelines on transparency under Regulation 2016/679 stated that the exceptions in Article 14 b 11 3 "should, as a general rule, be interpreted and applied narrowly." Furthermore, it is specifically stated about the exception in article 14 no. 5 letter c in point 66: "Such a law must directly address the data controller and the obtaining or disclosure in question should be mandatory upon the data controller. Accordingly, the data controller must be able to demonstrate how the law in question applies to them and requires them to either obtain or disclose the personal data in question.” Such an interpretation, where the relevant collection or disclosure of the personal data must follow directly from national law and be mandatory for the data controller, harmonizes also with the principle of transparency in Article 5 no. 1 letter a. The principle applies in particular "further information to ensure fair and open treatment for the affected individuals persons as well as their right to obtain confirmation of and be informed about the personal data which applies to those who are processed", cf. paragraph 39. If the data subject can foresee from national law that a collection of your personal data takes place, that is the starting point not necessary to ensure fair and open processing that the data controller informs the data subject about the processing. However, such predictability presupposes that the collection in question follows directly from national law and is mandated by it data controller. It is clear that DNK's general duty to register minor relatives was express laid down in national law in the Church Act § 3. The specific collection of birth notices for However, members' children from the National Register did not follow § 3 of the Church Act. The collection of birth notices for members' children from the National Register of Citizens was thus not express laid down in section 3 of the Church Act, and the exception in article 14 no. 5 letter c thus did not apply application based on this provision. The current collection of birth notifications for members' children from the National Register of Citizens nor did it expressly comply with the National Register of Citizens Act or associated regulations. Of the current regulation on the Church of Norway's membership register § 10 on up-to-date information, given in in accordance with § 3 of the Church Act, it followed, however, that on the basis of information from the person who is registered, the central and local data controller is obliged to keep the membership register up to date. The central data controller is also obliged to keep the membership register up to date on the basis of information from the National Map Agency's cadastral register, the central population register and the Unit Register. The Norwegian Data Protection Authority is therefore considering whether the collection of birth notifications for members' children from The folk register expressly followed the regulations on the Church of Norway's member register § 10. According to Store norske lexikon, À jour is a French expression that is most often used in the meaning "updated", and the Norwegian Data Protection Authority considers that this is also the natural understanding of the wording. That DNK should keep the membership register up-to-date based on information from the National Register of Citizens, dictates, according to the Danish Data Protection Authority's assessment, that existing members and related information must 3 Point 57 12 is kept up-to-date on the basis of population register information, for example related to changes in names, contact details or deaths. The provision did not expressly state that it birth notifications for members' children are collected from the National Register of Citizens, and the provision can nor is it understood that DNK had a duty to collect birth notifications from The National Register. The Norwegian Data Protection Authority thus considers that the collection of birth notifications for members' children from The population register did not expressly comply with regulations on the Church of Norway's membership register § 10. The exception in Article 14 no. 5 letter c therefore did not apply to DNK's collection of birth notifications for members' children from the National Register of Citizens. The Norwegian Data Protection Authority then assesses whether DNK met the information requirements in Article 14 regarding the collection of birth notices for members' children from the National Register of Citizens. It follows from article 14 no. 1 letter d that the data controller must give the data subject information about "the affected categories of personal data" that are processed. It follows also of article 14 no. 2 letter f that the data controller must give the data subject information about "from which source the personal data originates", which is necessary to ensure fair and open treatment for the data subject. Furthermore, it follows from Article 12 No. 1 that the data controller must take appropriate measures for to present information to the data subject as mentioned in Article 14 in a "concise, open, comprehensible and easily accessible manner and in clear and simple language'. Article 29 Data Protection The Working Party has stated the following in its Guidelines on transparency under Regulation 2016/679 on the requirement that the information be provided in an "easily accessible manner": "The "easily accessible" element means that the data subject should not have to seek out the information; it should be immediately apparent to them where and how this information can be accessed, for example by providing it directly to them, by linking them to it, by clearly signposting it or as an answer to a natural language question (for example in an online layered privacy statement/ notice, in FAQs, by way of contextual pop-ups which activate when a data subject fills in an online form, or in an interactive digital context through a chatbot interface, etc."4 The provisions must also be seen in connection with the transparency principle in Article 5 no. 1 letter a, as well as paragraph 39, where it follows: "The principle of transparency requires that all information and communication in connection with processing of said personal data is easily accessible and easy to understand, and that the language used is clear and simple. The principle applies in particular to information to them registered about the identity of the data controller and the purposes of the processing as well as additional information to ensure fair and open processing 4 Point 11 13 for the affected natural persons as well as their right to receive confirmation of and be informed about the personal data concerning them, which is processed" In its statement of 11 May 2021, DNK has explained and submitted documentation for what information was given to the registered about the collection of birth notifications for members' children from the National Register of Citizens in the period from 20 July to 1 October 2018. From the documentation, it appears that DNK did not inform those registered in the current one the privacy statement from 2017 that birth notifications from the National Register of Citizens are processed, or otherwise that information is obtained from other than the registered person that members have children. The population register was not mentioned in the privacy policy. From the other documentation DNK has presented, the Norwegian Data Protection Authority can only see that the collection of birth notifications for members' children from the National Register of Citizens is mentioned in two contexts. The first is the Church Council's circular no. 2 of 3 September 2018 and circular no. 3 of 28. September 2018 to the parish offices, the ecclesiastical joint council offices, the parish offices and the diocesan offices. These were available to the general public at https://kirken.no/rundskriv and https://kirken.no/nb-NO/om-kirken/for-medarbeidere/rundskriv-fra-kirkeradet/. The other is the article "Adoption and belonging" of 23 October 2017, which was available at https://kirken.no/nb-NO/om-kirken/medlemskap/om-medlemskapet/adopsjon-og-tilhorighet/, and was available with a link from the About membership and Affiliation and membership pages. The relevant circulars from the Church Council were aimed at the church's subordinate bodies, and the one in question the article on adoption and belonging only appears to be relevant to a very small group registered – those who have adopted a child. It was not intuitive or clear to the registrants that they had to seek out these parts of kirken.no to find information about the treatment of theirs personal data, and these sources of information did not ensure an open and fair treatment. The Norwegian Data Protection Authority finds it clear that neither the circulars nor the article on adoption and affiliation met the requirements that the information should be "easily accessible" to them registered. The Norwegian Data Protection Authority thus finds that DNK has not provided information about the collection of birth notices for members' children from the Folkeregisteret in line with the requirements in article 12 no. 1. DNK has thus not given the registered person "readily accessible" information about "those affected the categories of personal data" that are processed or "from which source the personal information originates from", cf. article 14 no. 1 letter d and no. 2 letter f, cf. Article 12 No. 1. 6. About reprimand, right of appeal and further proceedings A reprimand is an administrative reaction with the purpose of highlighting criticism of those mentioned the violations of the rules. The imposition of a reprimand may be emphasized at a later date assessment of the imposition of an infringement fee if a corresponding breach occurs the regulations cf. the personal data protection regulation art. 83 no. 2 letter i. 5https://kirken.no/globalassets/kirken.no/personvernerklaering_2017.pdf 14DNK can appeal against the decision on reprimand. Any complaint must be sent to us within three weeks after this letter has been received, cf. the Public Administration Act §§ 28 and 29. If we If our decision is upheld, we will forward the case to the Personal Protection Board for complaint processing. 7. Publicity, transparency and confidentiality We would like to inform you that all documents are basically public, cf. Public Relations Act § 3. If you believe there are grounds for exempting all or part of the document from public inspection, we ask you to give reasons for this. The Norwegian Data Protection Authority has a duty of confidentiality regarding who has complained to us, and about the complainant's personal information relationship. The duty of confidentiality follows, among other things, from the Personal Information Act § 24 and Section 13 of the Public Administration Act. As a party to the case, you may nevertheless be made aware of such information from the Norwegian Data Protection Authority, cf. the Administration Act § 13 b first paragraph no. 1. You also have the right for inspection of the case's documents, cf. section 18 of the Public Administration Act. We draw your attention to the fact that you have a duty of confidentiality regarding information you receive from the Norwegian Data Protection Authority the complainant's identity, personal circumstances and other identifying information, and that you only can use this information to the extent necessary to safeguard its interests theirs in this case, cf. the Public Administration Act § 13 b second paragraph. We also point out that breach of this duty of confidentiality can be punished according to Section 209 of the Criminal Code. With best regards Jørgen Skorstad department director Anders Sæve Obrestad senior legal advisor The document is electronically approved and therefore has no handwritten signatures Copy to: BULL & CO ADVOKATFIRMA AS 15