Before anyone processes personal data, there must be a lawful basis in Article 6 of the Regulation. There are six:
- Consent from the data subject.
- Contract: the processing is necessary to perform a contract with the person, or to take steps at their request before the contract is entered into.
- Legal obligation: the law requires the processing, for example payroll data for the tax authorities.
- Vital interests: to protect life and health, when necessary.
- A task in the public interest or the exercise of official authority.
- Legitimate interests: the organisation or a third party has a legitimate interest, and the person's interests and rights do not override that interest. Public bodies cannot use this basis in their tasks.
It is the employer who chooses and documents the basis. You should still know what applies to your tasks.
Consent: what is required?
Consent under Articles 4 and 7 must be:
- freely given: the person has a real choice
- specific: it applies to a particular purpose
- informed: the person knows what they are saying yes to
- unambiguous: an active act, not a pre-ticked box or silence
You must be able to document that consent was given. The person can also withdraw consent at any time, and withdrawing must be as easy as giving it.
Consent in employment
An employee depends on the employer. That is why consent is seldom a safe basis between employer and employee, since it can be hard to say no. The employer should rather use another basis, for example the contract (the employment contract), a legal obligation or legitimate interests. Consent can work for something that is genuinely voluntary, for example putting a photo of you on the website. Then you must be able to say no without consequences.
Special categories
For health data and other special categories, an exception in Article 9 is needed in addition to a basis in Article 6. For employment there are separate rules in § 6 of the Personal Data Act. Always ask how you should handle such data, and do not share it "just to be safe".
The duty to inform
People have the right to know what happens to their data (Articles 13 and 14). The organisation must tell them, among other things:
- who the controller is
- the purpose and the basis
- who receives the data
- how long it is stored
- what rights the person has
This is usually done through a privacy notice or an information letter. Employees are entitled to this kind of information about how the organisation processes their own data.
Children
Norway has set the age limit for a child's own consent at 13 years for information society services (§ 5 of the Personal Data Act). For younger children, consent from parents or guardians is required. Children's personal data deserves extra care.
You must follow the employer's instructions
Under Articles 29 and 32(4), people who have access to personal data may only process it on instructions from the controller. Looking up a celebrity, a neighbour or a former partner in a system you have access to is not part of the job, and it is unauthorised access even if you share nothing further.