The Personal Data Act is intended to ensure that information about you is used in a way that is respectful of you. The purpose of this Act is to protect people from having their right to privacy violated through the processing of personal data.
Personal data
An item of personal data is an item of data that can be linked to an individual person. For example, this means that a name, age, address and telephone number are items of personal data if they can only be linked to you. Images that can be identified as a certain person are also a form of personal data, even if no name is attached to the image.
The Norwegian national identity number consists of your date of birth (the first six digits) and your personal number (the last five digits). Your national identity number is an item of personal data.
Consent
As a starting point, other people are not permitted to use your personal data unless you have first given your consent, i.e. you’ve agreed to allow them to do so. Your consent should be voluntary and given willingly, and can be withdrawn at any time.
This is the general rule, but there are exceptions. For example, in a number of contexts, the central and local governments are allowed to record and use your personal data without your prior approval.
The general rule is that once you have turned 15, you can agree to the collection and use of your personal data. If you are younger than this, anyone who wants to use your personal data must generally obtain your parents’ consent. If sensitive personal data is involved (such as criminal acts, health, sexuality, etc.) your parents’ consent is often required until you reach 18.
Information and access
-
If you give out your personal data, you have the right to know who is collecting this data, what it will be used for, whether it will be transferred to other people and if so, who will have access to it.
-
You have the right to know what data other people hold about you, what the information is going to be used for and how they have obtained the information.
-
You can request that incorrect or incomplete information be corrected.
-
Data that is no longer required for the original purpose should be deleted.
