Norwegian municipality accused of breaching whistleblower’s confidentiality, faces hefty fine from Data Protection Authority
The Norwegian Data Protection Authority (Datatilsynet) has accused the Eidskog municipality of multiple breaches of confidentiality. The municipality is alleged to have publicly disclosed a whistleblower’s full name, contact information, health details, and financial circumstances. Despite these claims, the municipality contends that it has mainly adhered to the transparency rules outlined in the Public Administration Act and Freedom of Information Act.
The Data Protection Authority believes the violations of the Personal Data Act are so severe that the municipality should pay a fine amounting to half a million Norwegian Kroner. However, due to the lengthy processing time of the case, the fine has been reduced by half. While the whistleblower agrees with the decision of the Data Protection Authority and hopes that it marks the end of the case, the municipality is considering an appeal.
The whistleblower, who alerted the authorities to questionable practices related to the reassessment of property tax, also claims to have been bullied and harassed as a result of the whistleblowing. Four years ago, the whistleblower and the Eidskog municipality reached a legal settlement.
The municipality allegedly lacked adequate procedures for handling whistleblower complaints. Even after the appointment of an interim town clerk to review the case and propose a solution, the dispute escalated, leading to the clerk’s dismissal against his recommendation. The whistleblower subsequently sued the municipality to have their case heard.
Despite the severity of the whistleblower’s allegations, including claims of physical and mental health violations, the fine was reduced due to the lengthy processing time of the case. The Data Protection Authority received the complaint in December 2020 and took three and a half years to finalize the decision, due to parallel legal processes and extensive documentation.
The whistleblower believes that the decision of the Data Protection Authority is correct, and hopes that it signifies the end of the saga. However, the municipality, who still has the option to appeal the decision, disagrees. They claim they tried to balance the right to access public documents and the complainant’s right to privacy in a challenging case with significant public interest. The municipality will carefully consider the decision after the summer vacation, as the deadline for an appeal is set for September 13.