IMI - European Commission Internal Market
Information System Exempt from public disclosure:
Offl. § 13, jf. personopplysningsloven § 24 første ledd 2.
punktum
Your reference Our reference Date
20/02273-14 15.01.2025
Rejection of complaint and closure of case
Datatilsynet refers to your complaint dated 15 October 2019 regarding processing of personal
data in relation to a recruitments process carried out by Pedersen& Partners, and
Datatilsynet’s letter to you dated 1 July and 20 October 2022.
Decision
Datatilsynet rejects your complaint.
Background
We informed you on 1 July that this is a so-called cross-border case. The case is cross border
because Pedersen & Partners is established in more than one EEA country and the processing
in question takes place in the context of the activities of such establishments. To ensure
uniform application of the GDPR in the EEA, data protection authorities across the EEA must
cooperate in the handling of cross-border cases.
The Dutch DPA has acted as lead supervisory authority in the handling of your complaint.
We, and five other DPAs, have been involved as concerned supervisory authorities.
Reasoning for our decision
The Dutch DPA has investigated the subject matter of your complaint to the extent
appropriate in accordance with Article 57(1)(f) GDPR and, based on such investigation, they
have not found any infringement of the GDPR. The Dutch DPA has therefore concluded that
your complaint should be rejected and that the case should be closed. All concerned
supervisory authorities, including us, agree with such conclusion.
Postal address: Office address: Phone: Ent.reg: Home page:
P.O. Box 458 Sentrum Trelastgata 3 +47 22 39 69 00 974 761 467 www.datatilsynet.no/en/
N-0105 OSLO N-0191 OSLO
Please find below information from the lead supervisory authority. This information explains
how your complaint has been handled and the reasons as to why your complaint should be
rejected. As your complaint is to be rejected, the supervisory authority that received your
complaint – in this case us – is the one which will adopt the final decision pursuant to Article
60(8) GDPR.
As this is a cross-border case, the information is written in English. We can provide a
translation into Norwegian language. If you wish to receive a translation, please contact us.
1. The NL SA has received a complaint against Pedersen & Partners (hereafter:
Pedersen) from the Norwegian Data Protection Commission (NO SA).
2. The NL SA has received this complaint with supplementary data on 10 February
2022. The complaint was assigned to a case handler at the AP in July 2022.
Pedersen’s establishment in the Netherland is, according to the privacy policy on
the website of Pedersen, controller. Therefore the NL SA accepted the role of LSA
in this case.
3. It followed from the file that complainant had applied for a job through the
website of Pedersen, but chose not to fill in (some of the) personal data as per the
application form on the website of Pedersen. Complainant’s job application was
subsequently rejected by Pedersen.
4. Complainant thereupon filed a complaint at the NO SA, arguing that the consent
form for the collection and processing of personal data for recruitment purposes
breached the GDPR and that the processing of data by Pedersen was not in line
with the GDPR. The NL SA has interpreted the complaint as an allegation of a
violation of Arts. 6 (1) and 7 of the GDPR by Pedersen.
5. The NL SA, upon analysis of the file, contacted the complainant through the NO
SA on 6 October 2022, informing the complainant that the NL SA was unable to
proceed with handling the complaint due to the fact that the complainant had not
yet informed the DPO of Pedersen of his complaint and that, furthermore, it was
not clear from the file how Pedersen had breached the GDPR.
6. On 6 November 2022 complainant replied to the letter of the NL SA through the
NO SA. With his letter, complainant sent a mail he had previously sent to the DPO
of Pedersen and the reply he had received from the lawyer of Pedersen. In his
letter, the complainant elaborates on his complaint, arguing that after a job
application is submitted, the data subject cannot request access to their data,
rectification of data or deletion of data from Pedersen.
7. The NL SA has contacted Pedersen and has also reviewed the online privacy
policy of this party. According to the information that the NL SA gathered,
2
Pedersen bases the processing of personal data of job applicants on consent (Art.
6 (1) (a) GDPR). This is a valid legal basis when all conditions for consent (Art. 4
(11) GDPR) are met. The NL SA has also reviewed the consent form of Pedersen
and has no reason to conclude otherwise than that the consent form fulfils the
conditions of Art. 4 (11) GDPR. This is especially the case when read in
conjunction with the privacy policy, which provides explicitly for the rights of
access, rectification and deletion of data.
8. In addition, the privacy policy also provides (prospective) job applicants that do
not wish to submit their personal data online with the possibility to contact a local
branch of Pedersen and to hand in a hard copy of the documents containing their
personal data for further processing by Pedersen.
9. Considering the above the NL SA finds no infringement of the GDPR in this case.
10. The NL SA deems this matter investigated to the extend appropriate ex Art. 57
(1)(f) GDPR and rejects the complaint ex Art. 60 (8) GDPR. The supervisory
authority with which the complaint was lodged (the regulatory authority in
Norway) shall adopt the decision and notify it to the complainant and shall inform
the controller thereof.
Ability to appeal
This decision has been adopted by us in accordance with Article 56 and Chapter VII of the
GDPR, and can therefore not be appealed to the Norwegian Privacy Appeals Board pursuant
to Section 22(2) of the Norwegian Personal Data Act (in Norwegian:
personopplysningsloven). This decision can nevertheless be challenged before Norwegian
courts in accordance with Article 78(1) GDPR.
Duty of Confidentiality
Parties to this matter have a duty of confidentiality under Section 13(b) of the Norwegian
Public Administration Act regarding the information they receive about the complainant’s
identity, personal matters and other identifying information, and such information can only be
used to the extent necessary to safeguard their interests in this case. Any breach of this duty of
confidentiality can be punished pursuant to Section 209 of the Norwegian Penal Code.
In light of the above, we have now closed our case on this matter.
Kind regards
3
Tobias Judin
Head of Section
Anne Eidsaa Hamre
Senior legal adviser
This letter has electronic approval and is therefore not signed
Copy: Pedersen & Partners
4