Privacy and Data Protection

All organisations – whether in the public or private sector - process personal data to a greater or lesser extent. This may include data on employees, citizens, users, customers, patients, suppliers, partners, etc. Data protection legislation lays down rules that govern the collection, use and storage of personal data, as well as rules that grant certain rights to individuals whose personal data is being processed (the data subjects).

This course starts by examining the right to privacy, including the right to protection of personal integrity, private life, self-determination (autonomy), and self-fulfillment. It then delves into data protection legislation, primarily the EU data protection framework and covers the following topics: fundamental requirements for the processing personal data; duties of data controllers and data processors; rights of the data subjects; the role of the data protection officer; requirements regarding information security and internal control; transfer to third countries; the role of the national and European data protection supervisory authorities, and remedies for breach of data protection law.

Emphasis is placed on European data protection legislation, particularly the EU General Data Protection Regulation/GDPR (2016/679), Article 8 of the European Convention on Human Rights, Articles 7 and 8 of the Charter of Fundamental Rights of the EU, as well as case law pursuant to these instruments. The role of national legislation that supplements the GDPR will be highlighted, taking Norway’s implementation of the GDPR as an example. Students will also learn about the interaction of data protection legislation with other general and sector-specific legislation that lay down requirements on confidentiality, privacy and information security.

The language of instruction is English.

There are no specific requirements for this course.

After completing the course, the student should have the following overall learning outcomes defined in terms of knowledge, skills and general competence:

Knowledge:

The student will have:

• Basic knowledge of the legal rules and policies on privacy and data protection at the European level and the rationale for such rules
• Good understanding of the principles, rules and logic of the GDPR, and of the role of national legislation that supplements the GDPR
• Basic understanding of how data protection legislation interacts with other general and sector-specific legislation that lay down requirements of confidentiality, privacy and information security

Skills:

The student will be able to

• Identify, systematize and formulate data protection legal issues and questions
• Properly apply relevant data protection legal rules to concrete cases
• Address and discuss central theoretical issues in privacy and data protection law

General competence:

The student will be able to

• Identify, discuss and critically assess the relevant legal framework
• Reflect critically and solve different questions on privacy and data protection
• Master and communicate fundamental data protection terminology in English, both orally and in writing.

The course is based on lectures, group work, and self-study.

Teaching in this course is held with physical attendance on campus.

The course has an expected workload of between 250 and 300 hours.

The following coursework requirements must have been approved in order for the student to take the exam:

• Coursework 1: The students are required to work in study groups. Each group must work on 3 different group assignments consisting of practical exercises and subsequently discuss each assignment orally in class. The 3 group assignments will be allocated in 3 different classes. The oral presentation will last 15 minutes. If a student lacks 2 of 3 oral presentations together with the group, the student must present a fifteen-minutes oral presentation on a given topic in the final class.

The purpose of the group assignment is to encourage students to learn to use good English legal jargon in the field of privacy and data protection law, and to prepare them for the written exam.

In lack of participating in 2 of the 3 group sessions in class, the student must present a fifteen-minute oral presentation on a given topic in the final class.

The exam in the course is an individual school exam over a period of 5 hours.

The exam must be written in English.

Lovdata Pro exam mode is permitted exam material.

Grade scale A – F

The exam papers are assessed by one examiner.