PVN - 25/12378
From GDPRhub
| PVN - 25/12378 | |
|---|---|
 | |
| Court: | PVN (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 78 GDPR |
| Decided: | 10.11.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 25/12378 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Norwegian |
| Original Source: | Personvernnemnda (in Norwegian) |
| Initial Contributor: | n/a |
PVN concluded that Article 78(1) GDPR gives complainants the right to appeal only when a supervisory authority’s decision directly affects their own legal position, not merely to challenge the authority’s choice of sanctions.
English Summary
Facts
The data subject filed a complaint with the Norwegian Data Protection Authority (Datatilsynet) about their employer. The DPA handled the complaint and chose to use corrective measures toward the employer. The data subject attempted to appeal this decision to the Privacy Appeals Board (PVN), but the PVN rejected the appeal because the data subject did not have the right to appeal under the national law.
Later, The Civil Ombudsman stated that the data subject actually does have a right to appeal under Article 78(1) GDPR, which gives to the data subject the right to an effective judicial remedy against the DPA’s decisions. The Norwegian Civil Ombudsman argued that the CJEU rulings in SCHUFA and Land Hessen expand complainants’ right to bring legal action, suggesting they may challenge all aspects of complaint handling, including corrective measures.
PVN was then instructed to reconsider its decision.
Holding
Upon reconsideration, PVN concluded that the data subject still does not have the right to appeal DPA's decision. Under national law, the data subject is not considered a party to the case against the employer. A party is defined as a person “to whom a decision is addressed or who is directly affected by the case,” and PVN found it clear that the data subject did not meet this threshold.
Moreover the PVN examined the possible application of Article 78 GDPR. According to Article 78 GDPR, every natural or legal person shall have the right to an effective judicial remedy against a legally binding decision concerning them taken by a supervisory authority. So, the question was whether the right to an effective judicial remedy under Article 78(1) GDPR can be invoked by a data subject who has lodged a complaint with a supervisory body but who are not themselves the addressees of the decision subsequently taken.
According to Recital 143, any natural or legal person should have the right to an effective judicial remedy by the competent national court against a decision taken by a supervisory authority which produces legal effect concerning that person. This suggests that the right to an effective remedy can in principle only be invoked by the person or persons on whom the decision is. In that case, other affected parties will not automatically have the right to bring legal proceedings, not even the person who originally complained to the Data Protection Authority. This approach seems also to be followed in CJEU case law , arguing that a decision must produce a distinct change in the applicant’s legal position to be challengeable.
PVN concluded that Article 78(1) GDPR does not automatically extend appeal rights to complainants in all types of decisions. Complainants may appeal when their complaint is rejected, the authority finds no GDPR violation, or corrective measures directly affect their own privacy situation. However, they generally cannot appeal simply to challenge the supervisory authority’s choice of sanctions against a controller, because these decisions do not “concern them” under Article 78(1) GDPR.
PVN also highlighted the relevance of national procedural autonomy, supported by the Advocate General in SCHUFA: national rules determine standing, provided they respect EU law principles. The recent above CJEU cases concern the scope of judicial review, not who has standing, and therefore do not clearly expand the right of appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
denial The document is digitally signed by the following signatories: JORN < The signed document Contains A cover page with information about the signatures « All original documents with signatures on each page « Digital signatures The document is sealed by Posten Norge The signing was done with a digital signature provided by Posten Norge AS. Posten guarantees the authenticity and sealing of this document. How to see that the signatures are valid If you open this document in Adobe Reader, it should be at the top that the document has been certified by Posten Norge AS. This guarantees that the content of the document has not been changed after signing. PERSONAL PROTECTION COMMITTEE - Been date: Your date: 10.11.2025 Exempt from public access Was reference: Your reference: Offl.§ 13, f. popplyl.§ 24 (1) and V1. § 13 25112378 Case 2024-01 — new assessment of the issue of the right to appeal Decision of the Norwegian Data Protection Board on 10 November 2025 _ ) Datatilsynet reference: 20/03083-93. 1. Introduction | Decision of the Norwegian Data Protection Board on 24 May 2024 (PVN-2024-01) your complaint against the Norwegian Data Protection Board's decision of 28 November 2022 was rejected. The Board held that you did not have a right to appeal under Section 28 of the Public Administration Act. The Civil Liberties Ombudsman has later — in its statement on 21 May 2025 in case 2024/4601 — expressed a different view The Ombudsman holds that you have a right to appeal under Article 78(1) of the General Data Protection Regulation, which gives the right to an effective remedy against the decisions of the Norwegian Data Protection Board. On this basis, the Ombudsman has requested that the Board reconsider the issue of the right to appeal. Following the Ombudsman's statement, you have provided comments to the Board in emails and letters to the Board on 6 and 11 June, and 21 October 2024, and in emails on 23 June, 1 September, 3 October and 26 October 2025. The Board will now take a position on whether there are grounds for reversing the decision to reject the application. This must be done in accordance with Section 35, first paragraph, letter ¢ of the Public Administration Act, which requires that the decision to reject the application is "invalid". If the decision is valid, the deadline for reversing the application is unlimited. 2. Right of appeal 2.1 Some legal principles Pursuant to Section 22, second paragraph, of the Personal Data Act, the Data Protection Authority's decision can, as a general rule, be appealed to the Data Protection Board. The Personal Data Act does not provide further rules on the handling of complaints, and it is therefore the general complaints rules in the Public Administration Act that apply, cf. Prop. 56 LS (2017 2018) section 26.5 0g 27.5 Page 1 of 7 The document is digitally signed by: Sealed by Posten Norge Individual decisions can be appealed by “a party or other person with a legal interest in appealing”, cf. the Public Administration Act § 28. A “party” is a “person to whom a decision is directed or to whom the case directly applies, cf. the Public Administration Act § 2 first paragraph letter e. The Tribunal finds it clear that you are not a party to the case against your employer. The Public Administration Act does not define who has a “legal interest in appealing”. | Legal theory assumes that others than the parties may have a right to appeal if "the connection is of such a nature and strength that it is possible to give a legal claim to have the decision overturned", cf. Torstein Eckhoff and Eivind Smith, Administrative Law, 12th edition, Oslo 2022 p. 306. Hans Petter Graver and Henriette N. Tessebro believe that it must be required that the decision has "clear factual effects" for the person concerned, cf. Aiminnelig Administrative Law, 6th edition, Oslo 2024 p. 504. Both of these approaches mean that the scope of the right to appeal will depend, among other things, on a balance between the interests of the complainant on the one hand and the interests of the party on the other. The wider the right to appeal is, the more uncertain the party's position becomes. This is because the Data Protection Board — unlike the courts — has full competence in the appeal, and that the appeal process will likely result in a new decision on the merits being made, pursuant to Section 34, second paragraph, of the Public Administration Act. The Board assumes that you would have had a legal interest in appealing if the Data Protection Authority had failed to follow up on your complaint and dismissed the case. The Board further assumes that you would also have had a legal interest in appealing if the Data Protection Authority had concluded that there was no violation of the Act or Regulation and had therefore not intervened. In both cases, the consideration of effective protection of your rights suggests that you should be able to appeal the decision, so that the appeal body has an opportunity to consider the issue. The question in this case, however, is whether you also have a right to complain in a case where the case has been taken under reality processing, and where a decision has been made to use corrective measures, cf. Article 58(2) of the General Data Protection Regulation. | In such cases, the Board assumes that you will initially only have a right to complain if the breach constitutes an ongoing violation of your interests, and where the choice of corrective measures has an impact on whether — and if so when — the violation ceases. | In your case, however, the violation has ceased. The Board cannot see that it has been demonstrated that the Data Protection Authority's decision has demonstrable actual effects for you — beyond the interest that may lie in the request that the Data Protection Authority should have reacted more strictly. The requirement that there must be "clear actual effects" is therefore initially not met in your case. However, it has been common to assume that the right of appeal under the Administrative Procedure Act cannot be narrower than the right of appeal under Section 1-3 of the Dispute Act, cf. Inge Lorange Backer, Rettslig interess for seksmal, skenn og klage, Oslo 1984 p. 44 and Torstein Eckhoff and Eivind Smith, Forvaltningsrett, 12th edition, Oslo 2022 p. 306. The main point of view is that a person who can file a seksmal appeal regarding the validity of a decision, instead requests the right to appeal against it. 1 HR-2017-1130-A paragraph 37 The Supreme Court agrees with this premise, even though paragraph 57 emphasizes that the right of appeal and the right of appeal “do not necessarily coincide”. In determining who has the right of appeal, the scope of the right of appeal is therefore of some interest, although it will not necessarily be decisive. This is also the basis for the new Public Administration Act, cf. Public Administration Act 2025 Section 61 and Prop. 79 L (2024-2025) p. 457. The Act has not yet entered into force. Page 2 of 7 The document is digitally signed by: Sealed by Posten Norge The starting point according to the Dispute Act Section 1-3 is that it is first and foremost "the exercise of authority directed at" that has access to the record, cf. Ot.prop. no. 51 (2004-2005) p. 366. The addressee of the decision will naturally have access to the record. In other cases, certain others will also be able to file a lawsuit, but this assumes that the person filing the lawsuit "is clearly informed of the decision", cf. Ot.prop. No. 51 (2004-2005) p. 366: "In general, the claimant will have a sufficient connection in a case concerning the legality of the exercise of authority if the claimant is affected to such an extent that it appears natural that the person concerned acts as a claimant and makes a claim based on considerations that are safeguarded by the relevant administrative provision, see the report, part II, chapter 5.2 (p. 188). Also, where the claimant is clearly affected by the decision, there may be a sufficient connection. This represents a certain expansion of the right to appeal compared to current law, for example compared to Rt-1982-908. Whether the claimant would have a legal interest in appealing under Section 28 of the Administrative Procedure Act may also be considered, see Rt-1986-1164 and Rt-1993-445." This assessment criterion may raise difficult delimitation questions, cf. Jorgen Aandal Vangsnes, «Tilknytning som vilkar for sivilt seksmal», Jussens Venner 2018 pp. 306—328 with further references. For the Privacy Board, there is no reason to & go into it in more detail. The Board cannot see that there are circumstances in this case that indicate that you are “clearly affected” by the Datatilsynet’s decision. Your interest in the case is not in itself sufficient to & grant seksmal access pursuant to the Disputes Act § 1-3. The connection between the Administrative Procedure Act § 28 and the Disputes Act § 1-3 therefore indicates that you do not in principle have a right of appeal pursuant to the Administrative Procedure Act either. This does not seem to be given any weight by the Ombudsman, who notes that "the activities of the courts lie outside the Ombudsman's scope of work". The Ombudsman further notes that it is in any case "reasonable and natural" that the person who complained to the Data Protection Authority should have a right to complain. In the opinion of the Board, this issue cannot be assessed independently of the right to an effective remedy under Article 78 of the General Data Protection Regulation. If the Regulation gives you a right to a remedy, the starting point will be that you also have a right to complain under Section 28 of the Public Administration Act. We will return to this in the next point. If the Regulation is instead to be interpreted as not giving you a right to a remedy, it is not certain that the overarching "objective of ensuring that the complaints mechanism ensures a uniform and high level of protection for personal data - to which the Ombudsman refers in his statement - makes it "natural" that the right to complain under national law should extend further than the Regulation requires. In that assessment, the consideration of the party must also be taken into account. That the Complainant is not an "unauthorized person" is clear — but this is not decisive. Section 28 of the Public Administration Act cannot be interpreted as meaning that everyone who is not a party to the case has a “legal interest in bringing an action” 2.2 Article 78 of the General Data Protection Regulation Article 78 of the General Data Protection Regulation grants the right to an effective remedy against a supervisory authority The first paragraph of the provision reads as follows: “Article 78. Right to an effective remedy against a supervisory authority 1. Without prejudice to any other administrative or non-judicial remedy, every natural or legal person shall have the right to an effective remedy against a legally binding decision concerning them, taken by a supervisory authority” Page 3 of 7 The document is digitally signed by: Sealed by Posten Norge The provision grants the right to an “effective remedy” against “a legally binding decision concerning them, taken by a supervisory authority”. | In the preparatory work for the Personal Data Act, it is assumed that "the Norwegian rules on access to administrative decisions by the courts meet the regulation's requirement for an effective remedy against the supervisory authority", cf. Prop. 56 LS (2017-2018) section 29.3. The question in the present case is whether the right to an effective remedy under Article 78(1) can be invoked by a person who has lodged a complaint with a supervisory authority but who is not himself the addressee of the decision subsequently taken. | recital 143 states that “every natural or legal person [should] have the right to an effective remedy before the competent national court or tribunal against a decision taken by a supervisory authority which produces legal effects concerning that person”. This suggests that the right to an effective remedy can in principle only be invoked by the person or persons for whom the decision is binding (“which produces legal effects concerning that person”). In such a case, other affected parties will not automatically have a right to bring proceedings, nor will the person who at the time lodged a complaint with the Data Protection Authority. This instruction appears to be followed up in the judgment of the European Court of Justice on 26 November 2018 in case T-458/17 (Shindler) Section 30: “30 In that regard, it follows from settled case-law that an action for annulment must be available in the case of all measures adopted by the institutions, whatever their nature or form, 'which are intended to have legal effects that are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his legal position (judgments of 11 November 1981, IBM v Commission, 60/81, EU:C:1981:264, paragraph 9, and of 26 January 2010, Internationaler Hilfsfonds v Commission, C-362/08 P, EU:C:2010:40, paragraph 51)" | The commentary to Article 78 in Waltraut Kotschy, “Right to an effective judicial remedy against a supervisory authority”, in Kuner, Bygrave and Docksey, The EU General Data Protection Regulation (GDPR), Oxford University Press 2020 page 1130 summarises the legal situation as follows: “It is a measure, whatever its nature or form, which is ‘intended to have legal effects that are binding on, and capable of affecting the interests of, the applicant by bringing about a distinct change in his legal positionCi01 It is assumed here that the right to an effective remedy under Article 78 assumes that the decision innebaerer en merkbar endring (“a distinct change”) i klagerens (“his”) rettsstilling (“legal position”). | The statement from the Civil Ombudsman, however, assumes that two new decisions from the EU Court of Justice must be understood as meaning a certain extension of the right to six-monthly access, and if this is the case indirectly involving a corresponding extension of the right to appeal. The first decision is the judgment of the European Court of Justice of 7 December 2023 in cases C-26/22 and C-64/22 (SCHUFA Holding), which is a preliminary ruling The case concerned six complaints from two complainants who believed that the processing of their personal data in a debt register was in breach of the regulation. They had not been successful in their complaint by the national supervisory authority, which found that the processing was lawful. One of the interpretative questions the European Court of Justice was to decide on in the case was whether the right to judicial review in Article 78(1) of a decision from Page 7 The document is digitally signed by: Seal by Posten Norge national supervisory authority is limited to & assess whether the complaint from the data subjects had been processed and investigated to a reasonable extent, or whether it is instead subject to full judicial review | the decision reflects the European Court of Justice's first spersmalet like this (Danish version): "47 The referring court requests, with the first request, as stated below, whether the data protection regulation's article 78, subsection 1, shall be interpreted as follows, that the court proceedings of an appeal decision, which has been adopted by a supervisory authority, is limited to, if the authority has dealt with the complaint, investigated its subject to the extent possible and notified The complainant about the result of the investigation, or whether this decision has been taken full judicial review, which includes the authority of the court that is to hear said, to order the supervisory authority to take a concrete measure » The Privacy Board notes that the specific position indicates that this part of the decision appears to & apply to the scope of the courts' right of trial when a sexual complaint is first filed. In that case, this is one other than that the previous question of who has access to a remedy. | In the decision, the CJEU emphasises that Article 78 must be interpreted in the light of its wording, the context in which the provision is set and the objectives it is intended to serve (paragraph 48). | The following paragraphs discuss each of these points in more detail — but not on the basis of the question of who has access to a remedy. The main question is instead what requirements the regulation sets for how extensive judicial review must be. As regards the limitation inherent in the fact that the right to an effective remedy applies to “legally binding decisions concerning them”, the CJEU emphasises in paragraph 50 “that a supervisory authority’s rejection or rejection of a complaint constitutes a decision which has legal effects for the complainant”, inter alia with reference to recital 143. The Tribunal agrees with the Civil Ombudsman that the CJEU here assumes that a complainant has access to appeal in cases of rejection and refusal. This does not, however, entail any extension of the right to appeal, since in such cases the complainant will have a “legal interest in bringing an appeal”, cf. point 2.1 above. The decision does not say anything about whether the interpretation will be the same in cases where the supervisory authority has taken a decision to use corrective measures. The next decision is the judgment of the Court of Justice of the European Union of 26 September 2024 in case C-768/21 (Land Hesse), which is also a preliminary ruling. The case concerned an appeal from an individual who believed that the supervisory authority’s enforcement of his complaint had been inadequate and that the undertaking should be fined for infringement. The Court of Justice of the European Union was asked to rule on whether the supervisory authority has an obligation to take a decision to use corrective measures where there is a breach of the regulations, or whether this question has been left to the to the supervisory authority's review. It appears from the decision that the choice of corrective measures is subject to the supervisory authority's review, but that the margin of appreciation is not unlimited. As regards the scope of judicial review, the CJEU emphasises that the supervisory authority's decision shall be subject to "full judicial review" (paragraph 49). However, the judgment does not seem to say anything directly about the scope of the six-fold right. The Civil Ombudsman interprets these differently from what the Board has done so far. In the opinion of the Civil Ombudsman, the decisions "clearly point in the direction that the person who has complained to the supervisory authority may also demand a judicial review of the supervisory authority's handling of the complaint in its entirety" (paragraph 45). | In the following, the Board will attach some brief remarks to the matters highlighted by the Civil Ombudsman. Page5 of 7 The document is digitally signed by: Sealed by Posten Norge For the First, the Ombudsman points out that “both cases before the Court of Justice of the European Union [concerned] actions by individuals who considered that the supervisory authority’s enforcement of their complaints was incorrect or insufficient”, and that it was “on this factual basis that the Court of Justice of the European Union stated how the right of appeal should be understood” (paragraph 46). The Tribunal agrees with this. However, the fact that other countries’ procedural law allows for appeals from the original complainant does not, from the question of Article 78(1), mean that there must be access to appeals in such cases. Secondly, the Ombudsman points out that “the consideration of effective legal protection [implies] that it is not only the undertaking that has the right to judicial review of the supervisory authority’s decision, but that this also applies to the person protected by the regulations” (paragraph 48). It further states the following: “The Ombudsman finds it difficult to reconcile the decisions of the Court of Justice of the European Union with the understanding that and first of all, it is the person against whom the corrective action is directed, i.e. the business, who shall have the right to a judicial review pursuant to GDPR Article 78(1). If the provision in Article 78(1) were to be interpreted in this way, it would in practice mean that judicial review was reserved for cases where the business believes that the supervisory authority's enforcement of the matter is unlawfully strict. The Board has above established that the complainant will have a legal interest in appealing both if the Data Protection Authority has failed to follow up on the complaint and rejected the case, and if the Data Protection Authority, after a substantive examination, finds that the regulation has not been breached. When it comes to decisions on the choice of corrective measures, there will also be a legal interest in appealing if the breach constitutes an ongoing infringement of the complainant's privacy interest, and where the choice of corrective measures has a bearing on whether — and if so when — the infringement ceases. Based on this understanding, judicial review — or the right of appeal — is not reserved for cases "where the undertaking believes that the Authority's enforcement of the case is unduly strict." Thirdly, the Civil Ombudsman points out that "the consideration of effective legal protection [implies] that it is not only the undertaking that has the right to a judicial review of the Authority's decision, but that this also applies to the person protected by the regulations" (paragraph 49). It further states the following: "Even if If the CJEU emphasises that it is not the case that the individual who has been subjected to a personal data breach has any subjective right to the Danish Data Protection Authority to enforce a case in a particular manner, the consideration for effective enforcement of the GDPR to ensure uniform practice and a high level of protection is highlighted by the CJEU as a fundamental consideration. There would be an imbalance in the right to judicial review if the Danish Data Protection Authority's failure to adopt a corrective measure, including a fine, could not be brought before the court by the complainant to whom the case relates. This would lead to a fundamental imbalance in the possibility of judicial review of the Danish Data Protection Authority's exercise of authority in complaint cases. The Tribunal agrees with the Civil Liberties Ombudsman that it would entail a “bias in the possibility of judicial review of the Data Protection Authority’s exercise of authority in complaint cases” if one assumes that a decision on the use of corrective measures can only be appealed or brought before the courts by the person affected by the decision. Article 57 does not, however, provide grounds for claiming that the right to an effective remedy shall be equal for everyone who is to a greater or lesser extent affected by a decision. On the contrary, recital 143 provides good support for claiming that the right to an effective remedy can in principle only be invoked by the person or persons for whom the decision is binding (“who has legal effect for the person concerned”) Page 6 of 7 The document is digitally signed by: Sealed by Posten Norge That the person affected by a decision has a wider right to appeal and access to justice than others affected by the decision is well known in Norwegian law. administrative proceedings and civil proceedings. The consideration of an effective protection of the rights of the data subject under the Regulation must be weighed against the considerations of the party. In the Board's view, it can therefore be defended that the complaint has the right to appeal and a right of appeal in cases where the case is dismissed and where the Data Protection Authority assumes that there is no violation of the Regulation, but not in cases where the choice of corrective measures has no demonstrable actual effects for the person concerned. The Board adds that the Advocate General in the SCHUFA case took as a starting point "that the national rules for administrative procedure generally apply within the framework of procedural autonomy, subject to the principles of equivalence and effectiveness" (paragraph 48). This supports the fact that it will depend to some extent on the national procedural rules whether the complainant has access to a sixth instance — and therefore also whether the person concerned has a right of appeal under Section 28 of the Public Administration Act. 3 Summary and conclusion In the Board's view, you do not have a right of appeal — neither under Section 28 of the Public Administration Act in conjunction with Section 1-3 of the Dispute Resolution Act (section 2.1), nor under Article 78 of the Data Protection Regulation (section 2.2). The Board maintains that it was right to reject your complaint, cf. Section 34, first paragraph, of the Public Administration Act. The Board's decision of 24 May 2024 on rejection is therefore not overturned: The Board adds that the right to impose a violation fee "is time-barred five years after the violation has ceased", cf. the Personal Data Protection Act, Section 28. The period is interrupted by the Data Protection Authority giving advance notice of a decision to impose a violation fee. This has not happened in this case. The right to impose a fee is therefore time-barred. This letter has been approved electronically and therefore does not have a handwritten signature.
