Basis for processing under the General Data Protection Regulation (GDPR)
Supreme Court judgment 7 December 2021, HR-2021-2403-A, (case no. 21-055809SIV-HRET), civil case, appeal against judgment.
The Norwegian Medical Association (Counsel Cecilie Tandberg Hallan) v. The State represented by the Privacy Appeals Board (The Office of the Attorney General represented by Stein-Erik Jahr Dahl)
Justices: Skoghøy, Matheson, Kallerud, Falch, Thyness
Legelisten.no is a website for sharing information about doctors and other healthcare personnel. The Norwegian Medical Association had brought an action claiming that the website had no legal basis – so-called basis for processing under Article 6 (1) (f) of the GDPR – for recording and publishing subjective user reviews of healthcare personnel on the Internet. After a balancing of the legitimate interests pursued by the website against the interests of the healthcare personnel, the Supreme Court found that the website had a basis for the processing. It was emphasised that Legelisten.no is an important source for the general public to acquire information regarding health service providers. The measures taken to limit privacy drawbacks also satisfied the requirements that may reasonably be imposed. The appeal against the Court of Appeal's judgment was dismissed.