Norges Høyesterett - 2021-2403-A
| Norges Høyesterett - HR-2021-2403-A | |
|---|---|
 | |
| Court: | Norges Høyesterett (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 4(11) GDPR Article 5(1)(a) GDPR Article 6(1) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 7(4) GDPR Article 9 GDPR Article 9(2)(a) GDPR Article 85 GDPR European Convention on Human Rights Article 10 European Convention on Human Rights Article 8 Grunnloven (The Constitution of the Kingdom of Norway) § 100 Personopplysningsloven (Personal Data Act) § 3 |
| Decided: | 07.12.2021 |
| Published: | 13.12.2021 |
| Parties: | Legelisten.no AS Legeforeningen (The Norwegian Medical Association) |
| National Case Number/Name: | HR-2021-2403-A |
| European Case Law Identifier: | |
| Appeal from: | Personvernnemda (Norway) 2018-14 (15/01355) |
| Appeal to: | |
| Original Language(s): | Norwegian |
| Original Source: | Norges Høyesterett (The Supreme Court of Norway) (in Norwegian) |
| Initial Contributor: | Rie Aleksandra Walle |
The Supreme Court of Norway ruled that the Privacy Appeal Board's decision regarding Legelisten.no was valid, agreeing that Legelisten had legal grounds in Article 6(1)(f) GDPR for publishing subjective user reviews of healthcare personnel on their website.
English Summary
Facts
In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals.
In one case in 2015, the DPA held that Legelisten did not have a legal basis for processing personal data related to the website reviews and, further, that Legelisten had to offer an opt-out arrangement for healthcare personnel not wanting their personal data published on the website. The decision was appealed to the Norwegian Privacy Appeals Board, who overturned parts of the DPA's decision, importantly relating to the (lack of) legal basis and the opt-out arrangement.
Following this, the Norwegian Medical Association brought an action to the Norwegian courts, claiming that the website had no legal basis as per Article 6(1)(f) GDPR for registering and publishing subjective user reviews of healthcare personnel.
Holding
After a balancing of the legitimate interests safeguarded by the website operator Legelisten against the interests of the healthcare personnel, the Supreme Court agreed with the Privacy Appeal Board's decision and found that Legelisten had a legal basis for the processing as per Article 6(1)(f) GDPR.
The Court emphasised that Legelisten.no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied what could reasonably be expected. Thus, the DPA's initial decision was overturned and the appeal appeal against the Privacy Appeals Board's decision was rejected.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
"Article 6. Legality of treatment1. The processing is only lawful if and to the extent that at least one of the following conditions is met: ... f) the processing is necessary for purposes related to the legitimate interests pursued by the data controller or a third party, unless the data subject's interests or fundamental rights and freedoms take precedence and require the protection of personal data, especially if the data subject is a child. "
