Personsvern

Personsvern refers to the protection of individuals' privacy and personal data in relation to how information about them is collected, stored, used, and shared by both public authorities and private entities. In Norway and the European Economic Area, personvern is governed by a framework designed to ensure transparency, security, and control over one’s data, covering areas such as health, employment, finance, and online activity. The central law is the General Data Protection Regulation (GDPR), which sets rules for lawful bases of processing, individual rights, and international transfers. In Norway, GDPR is implemented through the Personal Data Act (personopplysningsloven) and related regulations, administered by Datatilsynet, the Norwegian Data Protection Authority.

Key principles include lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; and integrity and confidentiality. Processing should have a legitimate basis, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests, with specific conditions and safeguards.

Data subjects have rights to access their data, rectification, erasure (right to be forgotten), restriction of processing, objection, data portability, and rights related to automated decision-making and profiling. Controllers and processors must implement technical and organizational measures to protect data, conduct data protection impact assessments for high-risk activities, and, in certain cases, appoint a data protection officer. Cross-border transfers require appropriate safeguards through mechanisms recognized by GDPR. Cookies and similar tracking technologies typically require informed consent where not strictly necessary.