The Personal Data Act and the GDPR

The Personal Data Act implements the EU General Data Protection Regulation (GDPR) in Norwegian law. The rules apply when a business processes information that can be linked to an individual, including when the information is part of AI tools, machine translation, transcription, speech recognition, chatbots, summarization, or automated case processing.

The business must have a valid legal basis and a clear purpose for the processing. The information must be relevant, limited to what is necessary, accurate, adequately secured, and not stored longer than the purpose requires. The processing of special categories of personal data additionally requires that a condition in GDPR Article 9 is met.

When an external supplier processes personal data on behalf of the business, roles and responsibilities must be clarified. A data processing agreement, documented instructions, control of subcontractors, and an assessment of whether data is transferred or made available outside the EEA may be necessary.

The use of an AI or language tool is not risk-free just because a human reviews the final result. The business must also assess whether the information could be lawfully entered into the tool, how the vendor processes it, whether it is stored or used for model training, and whether the output may contain inaccurate, discriminatory, or unnecessarily detailed personal data.

If a planned processing is likely to result in a high risk to the rights and freedoms of individuals, the organization must carry out a data protection impact assessment before the processing begins. In the case of fully automated decisions with legal effects or similarly significant effects, the organization must also consider the specific rules in GDPR Article 22.

The Personal Data Act and the GDPR regulate the collection, use, sharing, storage, security, and deletion of personal data. The regulations establish requirements for lawful basis, purpose, data minimization, accuracy, transparency, information security, accountability, and the rights of data subjects.

The regulations also govern the relationship between data controllers and data processors, the transfer of personal data outside the EEA, data protection impact assessments, and certain fully automated decisions.

Text, audio, and documents processed in AI and language tools may contain names, contact information, health data, information about work, finances, children, migration, or other details related to identifiable individuals.

When such information is entered into machine translation, transcription, chatbots, or generative AI, the business may simultaneously grant a vendor access to the information. The business must therefore assess the legal basis for processing, the supplier’s role, storage, model training, subcontractors, the location of processing, security, and any transfers outside the EEA.

AI-generated texts, summaries, and translations may also contain inaccurate personal data or alter the meaning of information about a person. The requirement for accuracy and the need for human quality assurance are therefore of practical importance throughout the entire workflow.