Data protection (personvern) is about the right to decide over information about yourself and to be treated fairly and safely. At work you meet personal data every day: in customer lists, personnel files, e-mail, timesheets and systems.
Which rules apply?
- The General Data Protection Regulation (GDPR) is the EU's common data protection law. It also applies in Norway, because it has been incorporated into the EEA Agreement.
- The Personal Data Act (personopplysningsloven, the Act on the processing of personal data, LOV-2018-06-15-38) makes the Regulation Norwegian law. The Act also has Norwegian rules of its own, for example on the national identity number (fødselsnummer, § 12) and on the processing of sensitive data in employment (§ 6).
- The Data Protection Authority (Datatilsynet) is the Norwegian supervisory authority. It gives guidance, carries out inspections and can impose administrative fines.
- In employment, chapter 9 of the Working Environment Act (arbeidsmiljøloven) on control measures and access to e-mail also applies (lesson 8).
What is personal data?
Personal data is any information that can be linked to a living person, directly or indirectly. Examples:
- name, address, telephone number, e-mail address and national identity number
- photos, audio recordings and video recordings of people
- IP addresses, usernames and location data
- salary, absence, assessments and the details in a CV
Information that has been anonymised so that no one can trace it to the person is no longer personal data. It is not enough to remove the name if the person can still be recognised from other information.
Special categories
Some information is more vulnerable, and it has stricter rules. Article 9 of the Regulation names information about:
- racial or ethnic origin
- political opinions, religion and philosophical beliefs
- trade union membership
- genetic and biometric data (when used to identify a person)
- health data
- sex life and sexual orientation
The main rule is that these may not be processed, unless one of the exceptions in Article 9 applies. In working life, sick leave, sick notes and trade union membership are typical examples. Handle them carefully, and share them only with people who need them.
What is "processing"?
Processing is everything you do with personal data: collect, record, store, read, change, send, share, disclose, delete and copy. Even looking at a piece of information in a system is processing.
Who is who?
- The data subject is the person the information is about: a customer, patient, colleague or applicant.
- The controller (behandlingsansvarlig) is the organisation that decides the purpose of the processing and the means used. It carries the main responsibility under the law.
- The processor (databehandler) is an organisation that processes data on behalf of the controller, for example a payroll provider or a cloud service. There must be a written data processing agreement (Article 28).
- A data protection officer (personvernombud) is an internal or hired adviser that some organisations must have, including public bodies (Article 37).
As an ordinary employee you are not the controller yourself. You act on behalf of your employer and must follow your employer's instructions. That does not mean you can leave all responsibility to others. You must know the rules that apply in your job, and you must speak up when something is wrong.
What does the course cover?
The course is an introduction for employees. It does not replace the employer's own policies, and it does not give legal advice in individual cases.