Personvernnemnda (Norway) - PVN-2022-19
From GDPRhub
(Redirected from Datatilsynet (Norway) - PVN-2022-19)
| Personvernnemnda - PVN-2022-19 | |
|---|---|
 | |
| Authority: | Personvernnemnda (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 17(1)(a) GDPR Article 17(1)(c) GDPR Article 17(3)(b) GDPR Article 17(3)(d) GDPR The Archives Act (arkivlova) |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 28.02.2023 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | PVN-2022-19 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Norwegian |
| Original Source: | Norwegian Privacy Appeals Board (Personvernnemnda) (in NO) |
| Initial Contributor: | Maximilien Hjortland |
Child welfare services did not violate the data subject's right to erasure under Article 17 GDPR when refused to delete information on the data subject's ethnicity, because the information was deemed worthy of archiving under national law and essential to the case.
English Summary
Facts
Information of the ethnicity of a child's parent (the data subject) appeares in a journal note of the child welfare services of a Norwegian municipality (the controller). The journal note is a reproduction of what information the data subject themself had provided to the controller.
Additionally, the data subject had expressed to the controller that they feel that the child welfare case is about racism and represents a witch hunt against them from the municipality's side because of their family's belonging to a minority group.
The data subject requested the controller to delete information on their ethnicity pursuant to Article 17 GDPR from their child's records, because they viewed that such information was irrelevant with regard to the controller handling their child's case. The controller refused to delete the information, because it argued to have a statutory obligation to document and archive the information under national law. The data subject complained about the controller's refusal to delete the data to the Norwegian DPA.
The DPA found that the exceptions under Article 17(3)(b) and (d) GDPR applied in this case, since the controller had vuewed the information as worthy of archiving in accordance with archiving obligations laid down by national law. Therefore, the Norwegian DPA held that the controller had not violated the data subject's right to erasure under Article 17 GDPR by refusing to delete the data.
The data subject complained about the DPA's decision. The case was transmitted the to the Norwegian Privacy Appeals Board for an assessment.
Holding
In its decision, the Norwegian Privacy Appeals Board clarified that Article 17(3)(b) GDPR makes an exception to the right to erasure when the processing of personal data is necessary to fulfill a legal obligation and Article 17(3)(d) GDPR when the processing is necessary for archival purposes in the public interest.
Furthermore, the board found that, since the case had been closed, the purpose of continued storage of the information was archival purposes in the public interest in accordance with national law. It follows from Article 5(1)(b) GDPR that further processing for archival purposes in the public interest is not considered incompatible with the original purpose.
Essentially, the board viewed that deletion of the information on the data subject's ethnicity depends on whether the information is necessary to understand the context and content of the journal note and the child welfare service's handling of the case of concern. The board considered it to be a sufficient justification, when the controller argued that the information is essential to understanding why the family has the understanding of the case that they have as well as the reactions the family have had during and after the case.
In addition, the board held that there must be a high treshold for making a decision on the deletion of personal data in the child welfare records, in line with previous practice (see PVN-2018-02).
Eventually, the board unanimously rejected the data subject's complaint.
Comment
This case can be viewed as interesting in light of the principle of minimisation stipulated under Article 5(1)(c) GDPR. However, the DPA nor the Privacy Appeals Board did not apply the priciple of minimisation. It should be noted, that even if an exception to the right to erasure applies, it should not exclude the applicability of the data protection principles included in Article 5 GDPR. Therefore, it could be argued, that in this case it would have been worhty of assessing whether the controller's refusal to delete the data pursuant to national archiving obligation complies also with the data minimisation principle of the GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
PVN-2022-19 Demand for deletion of personal data in child welfare records
The Norwegian Data Protection Authority's reference:
22/03062-5
ANONYMIZED VERSION
The Norwegian Privacy Board's decision on 28 February 2023 (Mari Bø Haugstad, Bjørnar Borvik, Hans Marius Graasvold, Heidi Talsethagen, Morten Goodwin, Malin Tønseth)
The case concerns a complaint from A against the Norwegian Data Protection Authority's decision on 30 September 2022, where the Norwegian Authority concluded that the child welfare service in municipality X has not breached the Personal Data Act by rejecting requests to delete information in the son's child welfare record.
Background of the case
A contacted the Danish Data Protection Authority on 5 April 2022 with a request for assistance to delete information in the son's child welfare record that the father is a tater.
In a letter dated 10 March 2022, the child welfare service in X municipality has refused A's request to delete the information about the father in the son's record.
In a decision on 30 September 2022 to A, the Norwegian Data Protection Authority explained the rules relating to the child welfare service's documentation and archiving obligation and the right to erasure in the Personal Protection Regulation Article 17. The Norwegian Data Protection Authority concluded that the Child Protection Service in X municipality has not breached the Personal Data Act by rejecting the deletion request and closed the case.
A filed a timely complaint against the Norwegian Data Protection Authority's decision on 20 October 2022.
The Norwegian Data Protection Authority assessed the complaint, but found no reason to change its decision. The Norwegian Data Protection Authority forwarded the case to the Personal Protection Board on 16 November 2022. The parties were informed about the case in a letter from the board on 24 November 2022, and were given the opportunity to make comments. A gave his comments in e-mails to the tribunal on 29 November 2022 and 23 January 2023.
The child protection service has explained its view in a letter to the tribunal on 31 January 2023 by sending a letter from the child protection service to A on 10 March 2022. In the letter, the child protection service explains its view and justifies the rejection of A's request for deletion.
A has given his comments on the letter in an e-mail to the tribunal on 6 February 2023.
The case was dealt with in the committee's meeting on 24 January and 28 February 2023. The privacy committee had the following composition: Mari Bø Haugstad (chair), Bjørnar Borvik (deputy chair), Hans Marius Graasvold, Heidi Talsethagen, Morten Goodwin and Malin Tønseth. Secretariat manager Anette Klem Funderud was also present.
The Norwegian Data Protection Authority's assessment in brief
The Danish Data Protection Authority first explains the child protection service's statutory documentation obligation in the Child Protection Act § 1-4 and archiving duty in the Archives Act § 9, as well as the National Archives' regulations on preservation and disposal in child protection cases, cf. § 7-28 no. 9 letter d and points out that there are strict rules for what is required to be archived in a child protection case.
The Norwegian Data Protection Authority then starts from the fact that the right to deletion in this case must be assessed based on whether the personal data is no longer "necessary for the purpose for which it was collected or processed", cf. the Personal Protection Regulation article 17 no. 1 letter a.
The Norwegian Data Protection Authority assumes that the information about the father's ethnicity is correct, and that there is therefore no question of incorrect information. What is considered "necessary" for adequate documentation in the individual child protection case requires child protection expertise as well as insight into the individual case, which the Norwegian Data Protection Authority determines that the authority does not have. It is therefore difficult for the Norwegian Data Protection Authority to verify assessments of what is considered to be necessary information for the child protection service to fulfill its documentation obligation. However, the Norwegian Data Protection Authority clarifies that it is very important that all information that is considered relevant is registered in a child protection record, and refers to the Norwegian Personal Protection Board's statements in case PVN-2018-02 that "there must be a high threshold for making a decision on the deletion of personal data in child protection journal".
The Norwegian Data Protection Authority determines that when the municipality has assessed information as worthy of archiving, section 9 of the Archives Act with regulations will prevent the information from being deleted, cf. the personal protection regulation article 17 no. 3 letters b and d.
After an overall assessment, the Norwegian Data Protection Authority finds no basis for concluding that the child protection service has breached the privacy regulations by refusing requests for deletion of information about the father's ethnicity in accordance with the privacy regulation article 17 no. 1.
As's view of the case in brief
They have several times asked the children's welfare service why it is necessary to write that the father is a Tater when he is ethnically Norwegian. They have also tried to explain the disadvantage of using the word tater several times. They have tried repeatedly to take this up with the mayor of the municipality and the director of the municipality, but never get an answer to this.
They had a meeting with the state administrator on 18 January 2022. After that, the state administrator sent a letter to all municipalities in Y about minorities, as there was clearly little knowledge about this. The mayor has still not responded to their inquiry.
In 2015, the state and church had to apologize to the travelers for what they had to go through. It was a dark story that should not be repeated. Everyone knew what the travelers had to go through, both from lobotomization, sterilization and that children were deprived of their parents without a decision. The children were often called fantungs/damn tater kids etc. This story was told by the father to the child welfare services during a conversation with them about his own upbringing. Nevertheless, they choose to write in the journal that the father is a tater.
Father does not use taters about himself as taters are considered by many to be derogatory and stigmatizing. This group was met with many prejudices for many years in Norway, as his mother was also treated. She was deprived of all her children on the grounds that she was of Travelers, including one of the complainants (father) in this case. Father was often called "your fan tongue" when he was a child because he belonged to the travelers. Why is there such a need for child protection to write something he says violates his identity?
Father has become disabled because of the upbringing the state gave him, stole him from mother because she was a traveller. Father is afraid that using the word "tater" would affect his children. That is why he never uses the fact that he himself is a Tater of a minority. He may say that he belongs to the travelers. However, he also does not want this information to appear in the child welfare service's medical record, as he believes it is unnecessary.
For the father, the use of the word "tater" implies hateful speech which is covered by section 185 of the Criminal Code. That the father should feel discriminated against/persecuted because the child protection service is suspended from keeping this in the record is incomprehensible.
The son was 4 years old at the time (2018) and had to take a hearing and vision test which turned out to be difficult because he thought it was scary. They tried several times without success, and experienced being reported to child protection because of this. It was completely unnecessary as the health center was actually supposed to forward such cases to the specialist health service, which they never did. Instead, the case was dismissed with a finger pointed at the parents. They were told that they had to have confidence in the health service at X in the future, otherwise child protection would be concerned. The case was dropped, but they still got this finger. The parents believe this is due to prejudice against the father's minority background and nothing else.
The municipality's view on the matter in brief
It was the health center that reported concerns to the child welfare service in June 2019. The case was dealt with in accordance with the current legislation both with regard to review of the report and further investigation, see current Act on Child Welfare Services Section 4-3.
After a conversation with A and an investigation report, the child protection case was closed. A's comments on the report were stored in the son's folder with other documents in the case. Incidentally, complaints from A that are addressed to the child welfare service are stored in the case's documents.
A has complained to child welfare and to the state administrator that an investigation case was established and how this was carried out. The state administrator has found no basis for establishing a supervisory case against the child protection service.
As regards the information that the father belongs to a national minority, in the case it is only reproduced from what the father himself says.
The Child Protection Service received an e-mail from the father on 4 February 2021 in which he asks whether information regarding health and ethnic background had been deleted. The request was answered the same day. It is shown here that the case has been closed on the part of the child protection services, and the documents in the case have been locked in accordance with the current rules in the Child Protection Act and the Archives Act. The Child Protection Service will not take any further action in the matter. This relationship was appealed and the case was forwarded to the state administrator the following day.
In its briefing to the state administrator, the child welfare service wrote the following:
"When it comes to information about the father being the father, this appears in a journal entry dated 18.06.19. It is the father himself who comes up with this information. Both in this conversation and in other contact with the family, they convey that their understanding of the case is that this is about racism and a witch hunt on the part of the municipality. The father's association with a minority or upbringing is not taken into account in the further case documents. In the investigation report, the family's understanding of the case is only briefly shown. The information appears to be essential as it helps form a basis for understanding why the family has the understanding they have of the case as well as the reactions the family has had during and after the case."
In its letter, the state administrator has referred A to the Norwegian Data Protection Authority as the proper authority for appeals regarding the demand for deletion of information in the son's child welfare record.
The child welfare service neither can nor sees reason to correct/delete information in the son's child welfare record.
The Norwegian Privacy Board's assessment
Request for deletion
Article 17 no. 1 of the Personal Protection Regulation gives the data subject the right to have information about him deleted under certain conditions. The relevant options for requesting deletion in this case are Article 17 No. 1 letter a (no longer necessary for the purpose for which they were collected) and Article 17 No. 1 letter c (the data subject objects to the processing pursuant to Article 21 No. 1 and there are no more weighty reasons for the processing).
Article 17 no. 3 letter b and d makes an exception to the right to deletion if the processing of personal data is necessary to fulfill a legal obligation (letter b) or for archival purposes in the public interest (letter d).
About the exceptions in article 17 no. 3 letters b and d, the ministry says in Prop. 56 LS (2017-2018) page 81:
"Article 17 no. 3 letter d makes exceptions to the right to erasure under the same conditions as in article 14 no. 5 letter b. The data subject is therefore not entitled to deletion if this would make it impossible or seriously hinder the fulfillment of the purposes of processing for archives, research and statistics in accordance with Article 89 no. 1. It can also be mentioned that the data subject does not have the right to deletion either if the processing is necessary to fulfill a legal obligation under Union law or national law or to carry out a task in the public interest, cf. Article 17 no. 3 letter b. This means that the Archives Act's rules on cassation and limited right of disposal in the same way as in day will go before the court of
deletion, cf. section 28 first paragraph of the current law. In contrast to the current Personal Data Act, the regulation does not give the Norwegian Data Protection Authority any competence to make a decision on deletion that precedes the archives legislation, sml. applicable Personal Data Act § 27 third paragraph and § 28 fourth paragraph."
The information that the father is a tater appears in the child protection service's journal note on 18 June 2019 in connection with the child protection service's follow-up of a report of concern from the health center about A's son. According to the child welfare service, the journal note is a reproduction of what the father himself says. A agrees that he told the child protection service about his background, including his experiences with bullying and what he experienced as a witch hunt from the authorities because of his family's belonging to a national minority. He still believes this is irrelevant to the child protection service's handling of the case about his son.
It has been stated that the child welfare case, after a conversation with A and an investigation report, was closed. The purpose of continued storage of the information is now based on archival purposes in the public interest, cf. the provisions on archival material in the Archives Act. It follows from the Personal Protection Regulation article 5 no. 1 letter b that further processing of information for archival purposes in the public interest is not considered incompatible with the original purpose.
The Archives Act with regulations has rules on the archiving and preservation of documents. According to section 1, the purpose of the act is:
"to secure archives that have monal cultural or research value or that contain legal or important administrative documentation, so that these can be preserved and made available for posterity".
It follows from the National Archivist's regulation of 19 December 2017 no. 2286 section 7-1 letter c that the purpose is, among other things, to:
"ensure that archives are not disposed of before legal and administrative documentation needs have ceased."
In the regulations, part III, it is established which types of cases cannot be deleted ("made subject to cassation"), see § 7-23 and § 7-28, ninth paragraph. In § 7-28 ninth paragraph letter a, it is determined that "Procedures, routines and case management processes for the child protection service, including handling of reports of concern" shall be preserved for posterity and shall not be made the subject of appeal.
It follows from this that the journal note itself cannot be required to be deleted. The question is whether the information about the father's belonging to an ethnic minority can be required to be deleted, even if the journal note is otherwise archived. According to the tribunal's assessment, it must depend on whether the information about ethnic affiliation is necessary to understand the context and content of the journal note and the child welfare service's processing of the report of concern.
The child protection service has indicated that A and the family have otherwise communicated that they feel that the child protection case is about racism and represents a witch hunt against them from the municipality's side. This is reproduced in the journal note. The father's ethnicity and association with a minority group are not mentioned in the later case documents, and the investigation report only briefly shows the family's understanding of the case. In line with previous practice, the tribunal assumes that there must be a high threshold for making a decision on the deletion of personal data in the child welfare record, cf. PVN-2018-02. Child protection considers the information to be essential because it forms the basis for understanding why the family has the understanding they have of the case as well as the reactions the family has had during and after the case. The tribunal considers this to be sufficient justification from the child protection service that the information in the journal note is necessary to understand the child protection service's processing of the report of concern.
A is not successful in his appeal.
Conclusion
The Norwegian Data Protection Authority's decision not to order the deletion of information in the child protection record is upheld.
The decision is unanimous.
Oslo, 28 February 2023
Mari Bø Haugstad
Manager
