This course gives you knowledge, but it is the employer who is the controller and who has the duties under the law. Read this lesson to understand what must be in place behind the scenes, and what you can expect from the organisation.
What the employer must do itself
- Have policies and procedures for data protection and information security that are adapted to the organisation.
- Keep a record of processing activities (Article 30). Organisations with fewer than 250 employees are in principle exempt, but the exemption does not apply if the processing may involve a risk to people's rights, is not occasional, or includes special categories or data on criminal convictions. In practice, many small organisations must therefore keep a record too.
- Give instructions on how the systems are to be used, and make sure employees follow them (Articles 29 and 32(4)).
- Have data processing agreements with suppliers that process data (Article 28).
- Carry out risk assessments and, when the processing is likely to result in a high risk, a data protection impact assessment (Article 35).
- Have suitable security measures: access control, logging, encryption, backups (Article 32).
- Have a procedure for breaches and for rights requests.
- Give information to the people the data is about (privacy notice, employee information).
- Appoint a data protection officer where the law requires it (Article 37): public bodies, and organisations whose core activity is regular and systematic monitoring on a large scale, or large-scale processing of special categories or data on criminal convictions.
- Make sure employees have the necessary knowledge. Training is a common and important organisational measure.
An online course can be part of this, but it does not replace the organisation's own training on its own systems, procedures and risks.
What Datatilsynet can do
Datatilsynet can:
- give guidance and answer questions
- carry out inspections and demand information
- issue orders, for example to stop processing or to put things right
- impose coercive fines (tvangsmulkt, Personal Data Act § 29)
- impose administrative fines (overtredelsesgebyr, § 26)
Administrative fines
The fines follow Article 83. The amount must be effective, proportionate to the infringement and dissuasive. There are two levels:
- Up to EUR 10 million or 2 per cent of the organisation's worldwide annual turnover, whichever is higher, for breaches of, among other things, the requirements on security, records, data protection by design and notification of breaches.
- Up to EUR 20 million or 4 per cent, whichever is higher, for breaches of the basic principles, the conditions for consent, the rights of data subjects and the rules on transfers to countries outside the EEA.
Datatilsynet can also impose fines on public bodies. Decisions can be appealed to the Privacy Appeals Board (Personvernnemnda).
Fines are imposed on the organisation, not on the individual employee. That does not mean employees can act as they like. Serious misuse, for example snooping, can lead to employment-law consequences from the employer. Other laws, for example rules on confidentiality and criminal penalties, may also apply.
Compensation
Anyone who has suffered damage because of a breach of the rules has the right to compensation from the party responsible (Article 82). Article 82 covers both financial and non-material damage, and § 30 of the Personal Data Act says that the responsible party can also be ordered to pay redress (oppreisning) as seems reasonable.
Your role
- Know the rules and procedures for your position.
- Process only what you need, and only for the purpose the organisation has decided.
- Protect the data in your everyday work.
- Report breaches quickly and honestly.
- Pass on requests from people who want to exercise their rights.
- Ask when you are unsure, and take part in training.
Good data protection routines are not bureaucracy. They build trust between the organisation, its customers and its employees.