The Norwegian Data Protection Authority has decided to issue the Norwegian Labour and Welfare Administration (NAV) with a fine in the amount of NOK 5 million (EUR 500,00) for making CVs available on the service arbeidsplassen.no without a legal basis for doing so.
NAV notified the Data Protection Authority in February 2021 after concluding that the publication of CVs belonging to users in a follow-up process had no legal basis according to the General Data Protection Regulation. Publication of a CV has been a condition for being considered a true job seeker, which is a requirement for receiving benefits and services from NAV.
“The decision to issue a fine is in line with the advance notice issued to NAV earlier this year. Employment services are important, but these services must be provided in accordance with the law. NAV implemented measures when this violation was discovered, and has remedied the situation,” says then acting Director of the Data Protection Authority, Janne Stang Dahl.
In its response to the Data Protection Authority, NAV had no comments regarding the notice.