Background information
- Date of final decision: 21 June 2022
- Cross-border case or national case: National
- Controller: NAV
- Legal Reference: lawfulness of processing (Art. 6) and principles relating to processing of personal data (Art. 5)
- Decision: Infringement of the GDPR and fine imposed
- Key words: Employment, unauthorised publication
Summary of the Decision
Origin of the case
NAV notified the Norwegian Supervisory Authority, SA in February 2021 after concluding that the publication of CVs belonging to users in a follow-up process had no legal basis according to the General Data Protection Regulation. Publication of a CV has been a condition for being considered a true job seeker, which is a requirement for receiving benefits and services from NAV.
Key Findings
Employment services are important, but these services must be provided in accordance with the law. NAV implemented measures when this violation was discovered, and has remedied the situation
Decision
The Norwegian SA has decided to issue the Norwegian Labour and Welfare Administration (NAV) with a fine in the amount of EUR 500.000 (NOK 5 million) for making CVs available on the service arbeidsplassen.no without a legal basis for doing so.
For further information:
- Final decision to fine NAV (EN), Datatilsynet, Norwegian SA
- Endelig vedtak om overtredelsesgebyr til NAV (NO), Datatilsynet, Norwegian SA
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.