Datatilsynet (Norway) - PVN-2022-21

Datatilsynet - PVN-2022-21

Authority:	Datatilsynet (Norway)
Jurisdiction:	Norway
Relevant Law:	Article 6(1)(e) GDPR Article 6(3) GDPR Article 17 GDPR Article 17(1) GDPR Article 17(3)(b) GDPR Article 17(3)(d) GDPR Arkivlova § 9 bokstav c
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	28.03.2023
Published:	07.04.2023
Fine:	n/a
Parties:	Norwegian Labour and Welfare Administration at municipality X (NAV)
National Case Number/Name:	PVN-2022-21
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Norwegian
Original Source:	Personvernnemnda (PVN) (in NO)
Initial Contributor:	n/a

After the case was being sent back and forth between the state administrator and the DPA, the PVN eventually rejected the data subject's erasure request under Article 17(1)(c) due to data being stored for archival purposes in the public interest.

English Summary

Facts

The data subject made a request under Article 17 GDPR for erasure of their personal data from submitted applications for social security assistance to the Norwegian Labour and Welfare Administration at municipality X (NAV). NAV refused to delete the personal data and cited the Norwegian Archives Act which requires storing the information for archival purposes. After this refusal the data subject contacted the State Administrator, which was stated on NAV's initial decision, to be the competent appeal body. The State Administrator rejected the complaint and informed that the Norwegian DPA is the correct complaint body in the case.

The data subject contacted the DPA asking for assistance in requesting erasure of their personal data from NAV's archives. The DPA disagreed with the State Administrator, and viewed the State Administrator is the competent appeal body in the case. The DPA argued that they are not competent to order deletion of archive-worthy material and closed the data subject's case. The DPA stated that a dispute about what is the correct inerpretation of the Norwegian Archives Act must be reported to the State Administrator. In addition, the DPA established that their decision to close the case was not a decision itself that could be appealed.

The data subject then again contacted the State Administrator, which maintained its original view. The State Administrator stated that the DPA is the competent appeal body for rejections of requests to delete personal data according to Article 17 GDPR. The State Administrator also provided guidance on his understanding of the applicable rules.

The data subject the again contacted the DPA requesting clarification on who is the competent appeal body, and requested the DPA to assist the data subject in their case. The DPA maintained its own view, and repeated, that it does not have the competence to review the NAV's assessment of the extent to which the information is required to be archived. The data subject then appealed against this decision, but The DPA rejected the complaint on the grounds that it had been submitted after the appeal deadline of three weeks and did not find any special reasons that made it reasonable for the complaint to be nevertheless processed. The data subject wrote an e-mail to the DPA that it was still unclear to them, which body is the correct appeal body regarding their case.

The data subject also contacted the Civil Ombudsman which rejected the case and referred the data subject to the Norwegian Privacy Appeals Board (PVN). The data subject then timely appealed the rejection decision. The DPA found no grounds to change its decision, and sent the case to the PVN.

Holding

The PVN held that the conditions for trying the appeal had clearly been met after the appeal deadline being missed and gave the data subject compensation for missing the appeal deadline.

The PVN emphasized, firstly, that the DPA is the competent supervisory authority when it comes to requests for deletion pursuant to Article 17(1) GDPR, and secondly, that the DPA must also decide on the scope of the exceptions that follow from Article 17(3)(b) and 17(3)(d) which goes also to requests for erasure of data in archived documents from public authorities. The PVN viewed that the DPA had not carried out a substantive assessment of the data subject's erasure request. Given the history of the case, the PVN did not deem it appropriate to send the case back to the DPA for a new assessment. Therefore, the PVN eventually decided on the data subject’s erasure request claim as the first instance.

The PVN stated, firstly, that Article 17(1) GDPR gives the data subject the right to have personal data about them deleted under certain conditions, and secondly, that the relevant option for demanding deletion in this case was Article 17(1)(c) (the data subject objects to the processing pursuant to Article 21(1) and there are no more weighty reasons for the processing). The PVN also established that Article 17(3)(b) and (d) include both an exception to the right to erasure: if the processing of personal data is necessary to fulfill a legal obligation or for archival purposes in the public interest.

The PVN eventually held that the data subject cannot demand that the information is erased from NAV's archive, if continued storage of the information is justified for archival purposes in the public interest under Article 6(1)(e) GDPR, Article 6(3) GDPR, (and the Norwegian Personal Data Act § 8). The PVN noted that under Article 5(1)(b) further processing of personal data for archival purposes in the public interest is not considered incompatible with the original purpose.

The PVN referred to the State Administrators interpretation of the applicable rules and agreed with that interpretation of the law. In the State Administrators guidance, they viewed that under Section 6 of the Norwegian Archives Act, together with the provisions in Chapter 2 of the Norwegian Archives Regulation, that NAV has indeed an obligation to archive all case documents in social security assistance cases. Consequently, the NAV's rejection of the data subjects request for erasure was deemd to be legal under Article 17(3)(d) GDPR.

The PVN decided that the data subject is not successful in their request for the erasure of data in the NAV's archive, in accordance with Article 17(3)(b) and 17(3)(d).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.

The Norwegian Privacy Board's decision on 28 March 2023 (Mari Bø Haugstad, Bjørnar Borvik, Hans Marius Graasvold, Ellen Økland Blinkenberg, Morten Goodwin, Malin Tønseth)
The case concerns a complaint from A about the Norwegian Data Protection Authority's decision to reject his complaint because it was submitted too late.
Background of the case
A contacted NAV/X municipality (NAV) and requested the deletion of information in three applications for social assistance, cf. Article 17 of the Personal Data Protection Regulation.
NAV refused the erasure request on 26 January 2021, citing, among other things, the Archives Act § 9 letter d. The decision states that the decision can be appealed to the state administrator. A then complained to the state administrator, who on 16 April 2021 rejected the complaint and informed that the Norwegian Data Protection Authority is the correct complaint body. A contacted the Norwegian Data Protection Authority on 22 April 2021 and asked for assistance in deleting the information from NAV.
In a letter to A on 29 April 2021, the Norwegian Data Protection Authority disagrees with the state administrator in that the state administrator is not the right complaint authority. The supervisory authority then explains that the supervisory authority does not have the competence to order the deletion of archive-worthy material and closes the case. The Norwegian Data Protection Authority writes that a dispute about what is the correct application of the Archives Act must be reported to the state administrator, possibly in consultation with the National Archives. In the letter, the Norwegian Data Protection Authority states that the decision to close the case is not a single decision according to Section 2 first paragraph letter b of the Public Administration Act, cf. letter a, and that the decision cannot therefore be appealed.
As A had moved in the meantime, the Data Protection Authority's letter did not arrive and the Data Protection Authority sent the letter again on 19 May 2021 with the correct address.
A contacted the state administrator again on 26 August 2021. In a letter to A on 27 October 2021, the state administrator maintained that it is the Norwegian Data Protection Authority and not the state administrator that is the correct appeal body for refusals to delete personal data according to the Personal Data Protection Ordinance Article 17. The state administrator also provided guidance on his understanding of the rules . A copy of the letter was sent to the Norwegian Data Protection Authority.
A sent an e-mail to the Norwegian Data Protection Authority on 28 October 2021 and requested that the Norwegian Data Protection Authority clarify who is the complaint and supervisory body in this case and requested that the Norwegian Data Protection Authority process his deletion request.
In a letter to A on 25 January 2022 with the heading "Notice to complaints", the Norwegian Data Protection Agency agrees that the Norwegian Data Protection Authority is a complaint and supervisory body with regard to A's request for deletion, but that the question of whether the information can be deleted depends on the scope of the prohibition of cassation in the Archives Act. As the Norwegian Data Protection Authority does not have the competence to review NAV's assessment of the extent to which the information is required to be archived, the Danish Data Protection Authority does not consider it appropriate to process the case, cf. the Personal Data Protection Regulation article 57 no. 1 letter f and closes the case.
A appealed against the Norwegian Data Protection Authority's decision on 15 May 2022. In a decision on 18 May 2022, the Norwegian Data Protection Authority rejected the complaint on the grounds that it had been submitted after the appeal deadline of three weeks. The Norwegian Data Protection Authority did not find that there were special reasons that made it reasonable that the complaint should nevertheless be tried, cf. the Administration Act section 31 first paragraph letter b. The letter was returned to the Norwegian Data Protection Authority due to an incorrect address (A had moved) and was then sent out to new and received by A before 30 September 2022.
In an email to the Norwegian Data Protection Authority on 1 October 2022, A stated that the complaint had not been fully processed by the state administrator and that the state administrator referred him to the Norwegian Data Protection Authority. It was therefore still unclear to him who is the correct appeal body. A stated that he also contacted the Civil Ombudsman for clarification, but that the Civil Ombudsman rejected the case and referred him to the Personal Protection Board.
A timely appealed the rejection decision on 21 October 2022. The Norwegian Data Protection Authority found no grounds to change its decision and sent the case to the Personal Data Protection Board on 21 November 2022. A was informed about the case in a letter from the board, and was given the opportunity to make comments. A has given comments in e-mails to the tribunal on 28 and 29 November 2022.
The case was dealt with in the board's meeting on 28 March 2023. The privacy board had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Hans Marius Graasvold, Ellen Økland Blinkenberg, Morten Goodwin and Malin Tønseth. Secretariat manager Anette Klem Funderud was also present.
As's view of the case in brief
He refers to the case documents and the Norwegian Data Protection Authority's rejection of his complaint, first received by him on 30 September 2022.
He asks the Personal Protection Board to retrieve the documents in the case, including the Swedish Archives' statement to the State Administrator in Y. He has only been given access to the request for a statement. The core of the case for him is to have personal data deleted from NAV because the original application was never completed and was therefore not complete. The specific situation was resolved privately without the need for social assistance.
It is unclear who will process the complaint and thus also who can order NAV to delete the archived information. He has also brought the case before the Civil Ombudsman, which indicates that it is only when the Personal Protection Board has taken a decision on the case that he can bring the case before the Ombudsman. He therefore asks the Personal Protection Board to decide on the erasure request.
The status now is that the matter is a toss-up between NAV, the State Administrator in Y, the Norwegian Data Protection Authority and the Norwegian Archives, and no one is really taking a position on the matter.
He is complaining about the Norwegian Data Protection Authority's decision to reject his complaint.
The Norwegian Privacy Board's assessment
Whether the complaint is to be rejected as submitted too late
It is the Norwegian Data Protection Authority's decision on 25 January 2022 that closes the case and it is this decision that is being appealed. The deadline for complaining about a decision is three weeks from the time the party was notified of the decision, cf. section 29 of the Administration Act. There is no clear information about when A received the Data Protection Authority's letter dated 25 January 2022, but A's complaint is dated 15. May 2016, i.e. almost four months later. Even if the postal process sometimes takes a long time, the tribunal assumes that the appeal deadline of three weeks has been exceeded by several weeks and that the appeal has been submitted too late, cf. section 29 of the Public Administration Act.
Even if the complainant has missed the appeal deadline, the appeal can be processed as long as the party cannot be blamed for having missed the deadline or for delaying the appeal afterwards, or for special reasons it is reasonable for the appeal to be tried, cf. section 31 first paragraph of the Administration Act letters a and b. When assessing whether the complaint should be taken up for consideration, emphasis must also be placed on whether a change to the decision could cause harm or inconvenience to others, cf. second paragraph.
In Norwegian Law Commentary, notes 841 and 842, Professor Jan Fridthjof Bernt states the following about when exceeding the deadline is excusable:
"The postponement of the deadline will primarily be excusable if information has not been given about the appeal deadline as mandated in [Administrative Act] § 27, but also subjective circumstances such as an accident, serious illness or the like will, depending on the circumstances, be a basis for taking the appeal under consideration, despite because it is presented too late.”
About "special reasons", Bernt further states in note 843:
"In the bill, Ot.prp. no. 3 (1976-77) pp. 91-92, it is specifically mentioned that it will often be reasonable to deal with complaints about the "application of law" because "the question of law is not thereby brought out of the world". One presumably aimed at the fact that the body may later still have to assess this again, and that it may come to the fore through a court case, among other things. if the person concerned is prosecuted for having violated the decision."
In the tribunal's assessment, the conditions for trying the appeal, even if the appeal deadline has been missed, have clearly been met. The tribunal refers to the Norwegian Data Protection Authority's case management, which has not turned out to be successful for A. He has ended up being referred back and forth between various public authorities who do not agree on who has the competence to make a decision in the case.
The Norwegian Data Protection Authority first closed the case in a letter to A on 29 April 2021 and stated that the decision to close the case was not a single decision according to Section 2 first paragraph letter b of the Public Administration Act, cf. letter a, and that he therefore had no right of appeal against the decision. After a new round of processing the case at the state administrator's office, which maintains that they are not the right authority to handle deletion requests under Article 17 of the Personal Data Protection Regulation, the case ends up again at the Data Protection Authority. When the Norwegian Data Protection Authority then closes the case again on 25 January 2022 in a letter with the heading "Notice to complaints", the Norwegian Data Protection Authority agrees with the state administrator that the Norwegian Data Protection Authority is the right complaint body, but nevertheless concludes that the Norwegian Data Protection Authority does not consider it appropriate to process the case. No information is provided as to whether the decision can be appealed and the possible deadline for this.
The tribunal therefore assumes that the delay is excusable. In the tribunal's view, A cannot be "accused of having missed the deadline", cf. section 31 second paragraph letter a of the Administration Act.
Whether the Norwegian Data Protection Authority's decision is a single decision that gives the right to appeal
It is the Norwegian Data Protection Authority's letter of 25 January 2022 with the heading "notice to complainant" that is being appealed. According to section 28 first paragraph of the Public Administration Act, it is individual decisions that can be appealed.
It does not appear from the Norwegian Data Protection Authority's letter closing the case that there is a decision. The Authority writes both that it is the right appeals and supervisory body when it comes to requests for deletion, but also that it does not have the competence or authority to review NAV's own assessment of the request for deletion. Furthermore, the Danish Data Protection Authority states: "It is therefore within the Danish Data Protection Authority's jurisdiction and competence to process your request for deletion, but for the above-mentioned reasons we do not see it as expedient". The tribunal perceives these statements as contradictory and assumes that this may have led to the case being sent back and forth between the state administrator and the Norwegian Data Protection Authority.
The tribunal emphasizes that it is the Norwegian Data Protection Authority that is the supervisory authority when it comes to requests for deletion pursuant to Article 17 no. 1. This means that, among other things, the Norwegian Data Protection Authority must decide on the scope of the exceptions that follow from Article 17 no. 3 letters b and d. This applies also demands for the deletion of archived documents from public authorities. When the Norwegian Data Protection Authority processes a deletion request, the Norwegian Data Protection Authority has the opportunity to obtain a statement from the National Archivist in cases where the Norwegian Data Protection Authority deems it necessary to be able to make a decision on the deletion request. The fact that the public authority's own assessment of whether the information is necessary for archival purposes must be given great weight does not change the fact that the Norwegian Data Protection Authority is the right authority to receive and process deletion requests pursuant to Article 17.
Despite the pointed out ambiguity in the Norwegian Data Protection Authority's letter of 25 January 2022, the tribunal considers overall that the letter must be understood as a rejection decision that can be appealed.
Whether A can demand his personal data deleted from NAV
The Norwegian Data Protection Authority has not carried out a substantive assessment of As's deletion claim. Given the history of this case, the tribunal sees it as not appropriate to send the case back to the Norwegian Data Protection Authority for a new assessment of this issue. The tribunal will therefore decide on A's deletion claim.
Article 17 no. 1 of the Personal Protection Regulation gives the data subject the right to have information about him deleted under certain conditions. The relevant option for demanding deletion in this case is Article 17 No. 1 letter c (the data subject objects to the processing pursuant to Article 21 No. 1 and there are no more weighty reasons for the processing).
Article 17 no. 3 letter b and d makes an exception to the right to deletion if the processing of personal data is necessary to fulfill a legal obligation (letter b) or for archival purposes in the public interest (letter d).
About the exceptions in article 17 no. 3 letters b and d, the ministry says in Prop. 56 LS (2017-2018) page 81:
"Article 17 no. 3 letter d makes exceptions to the right to erasure under the same conditions as in article 14 no. 5 letter b. The data subject is therefore not entitled to deletion if this would make it impossible or seriously hinder the fulfillment of the purposes of processing for archives, research and statistics in accordance with Article 89 no. 1. It can also be mentioned that the data subject does not have the right to deletion either if the processing is necessary to fulfill a legal obligation under Union law or national law or to carry out a task in the public interest, cf. Article 17 no. 3 letter b. This means that the Archives Act's rules on cassation and limited right of disposal in the same way as in day will go before the court of
deletion, cf. section 28 first paragraph of the current law. In contrast to the current Personal Data Act, the regulation does not give the Norwegian Data Protection Authority any competence to make a decision on deletion that precedes the archives legislation, sml. applicable Personal Data Act § 27 third paragraph and § 28 fourth paragraph."
This means that A cannot demand that the information about him be deleted from NAV's archive if continued storage of the information is justified for archival purposes in the public interest, cf. the personal data protection regulation article 6 no. 1 letter e, cf. article 6 no. 3, cf. the Personal Data Act § 8.
The tribunal assumes that NAV's purpose for collecting the personal information was originally to process three applications for social assistance. The case has been closed at NAV and the purpose of continued storage of the information is now based on archival purposes in the public interest in line with the provisions of the Archives Act. It follows from the Personal Protection Regulation article 5 no. 1 letter b that further processing of information for archival purposes in the public interest is not considered incompatible with the original purpose.
The Archives Act with regulations has rules on the archiving and preservation of documents. The legal starting point is a ban on cassation, cf. Archives Act section 9 letter c, and implies that public archives cannot be disposed of without a permission to cassation.
The tribunal refers to the State Administrator in Y's explanation of the rules in a letter to NAV, with a copy to A and the Norwegian Data Protection Authority, 27 October 2021:
"It follows from Section 6 of the Archives Act, together with the provisions in Chapter 2 of the Archives Regulations, that NAV has a duty to archive all case documents in cases about social assistance. Consequently, erasure is also excluded under Article 17 no. 3 letter d.
We therefore consider that A does not have the right to have any documents or personal data deleted in his cases that deal with applications for social assistance. On the contrary, according to the archive regulations, NAV has an obligation to have all these documents in its archive."
The tribunal agrees with this understanding of the law. That the registered information, in As's view, gives a misleading impression that the situation does not change NAV's filing obligation.
The fact that A believes that the case in NAV was not complete does not change NAV's filing obligation.
A is not successful in his request for deletion.
The decision is unanimous.
Conclusion
A is given compensation for missing the appeal deadline.
The Norwegian Data Protection Authority's decision is a single decision that gives the right to appeal.
A is not successful in his demand for the deletion of information in NAV's archive, cf. the personal data protection regulation article 17 no. 3 letters b and d.
Oslo, 28 March 2023
Mari Bø Haugstad
Manager