Norwegian Supervisory Authority with final decision to fine NAV

21 June 2022

Background information

  • Date of final decision: 21 June 2022          
  • Cross-border case or national case: National
  • Controller: NAV               
  • Legal Reference: lawfulness of processing (Art. 6) and principles relating to processing of personal data (Art. 5)
  • Decision: Infringement of the GDPR and fine imposed
  • Key words: Employment, unauthorised publication


Summary of the Decision


Origin of the case

NAV notified the Norwegian Supervisory Authority, SA in February 2021 after concluding that the publication of CVs belonging to users in a follow-up process had no legal basis according to the General Data Protection Regulation. Publication of a CV has been a condition for being considered a true job seeker, which is a requirement for receiving benefits and services from NAV.


Key Findings

Employment services are important, but these services must be provided in accordance with the law. NAV implemented measures when this violation was discovered, and has remedied the situation



The Norwegian SA has decided to issue the Norwegian Labour and Welfare Administration (NAV) with a fine in the amount of EUR 500.000 (NOK 5 million) for making CVs available on the service without a legal basis for doing so.


For further information:



The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.