5 ms·

In Norway it is quite clear who is liable, the 3rd party. Anyone that holds personal data needs to acquire a license to do so from Datatilsynet (data protection

by tyfon 10y ago

In Norway it is quite clear who is liable, the 3rd party. Anyone that holds personal data needs to acquire a license to do so from Datatilsynet (data protection authority) and they can only use it for the purpose specified/granted in the license. Most of the banks here just provide downloadable csv/excel files after logging in with BankID (national electronic ID thing, https://www.bankid.no/en/company/ https://www.bankid.no/en/company/). If you upload that file to a 3rd party, the 3rd party still needs a license etc to keep/process it and is liable.

lucaspiller 10y ago
I'd argue the same would be true in the UK too - under the Data Protection Act, any company who holds personal information is required to register with a government authority [0], and the act makes it fairly clear what responsibilities and actions need to be taken regarding the handling of data. https://ico.org.uk/for-organisations/register/ https://ico.org.uk/for-organisations/register/
- grabeh 10y ago
  It's a little bit more nuanced than that. The Act places an obligation on data controllers to register and to comply with the various obligations under the Act. This excludes data processors (with controllers then making sure they place relevant obligations on controllers contractually). Potentially a service provider might argue they're a data processor although if they're taking decisions over how the data is used they could easily fall within the data controller category. Under current law, it's the data controller who would be liable for any loss of data (although they would normally look to cover off liability contractually with the processor). In any event, liability really depends on who is taking the decisions over the use of the data. If the third party just takes a feed of the data from the bank then takes various decisions over its use, they could well be a data controller. If on the other hand a bank contracts with a third party to provide an account aggregation service to its customers and they are passing data for this very specific purpose then the service provider could well just be a processor. The above is also going to change with the new General Data Protection Regulation coming into force next year...
closeparen 10y ago
>Anyone that holds personal data needs to acquire a license to do so from Datatilsynet That sounds ridiculous. Are YCombinator executives at risk of being fined/jailed in Norway since they presumably did not get a license for the Hacker News users table? Would a Norwegian teenager land in legal trouble for running an unlicensed phpBB forum? Do SaaS programmers need code review from the government on their pull requests? When Amazon or Netflix trains a new recommendations model?

by tyfon 10y ago

lucaspiller 10y ago

I'd argue the same would be true in the UK too - under the Data Protection Act, any company who holds personal information is required to register with a government authority [0], and the act makes it fairly clear what responsibilities and actions need to be taken regarding the handling of data. https://ico.org.uk/for-organisations/register/ https://ico.org.uk/for-organisations/register/

grabeh 10y ago
It's a little bit more nuanced than that. The Act places an obligation on data controllers to register and to comply with the various obligations under the Act. This excludes data processors (with controllers then making sure they place relevant obligations on controllers contractually). Potentially a service provider might argue they're a data processor although if they're taking decisions over how the data is used they could easily fall within the data controller category. Under current law, it's the data controller who would be liable for any loss of data (although they would normally look to cover off liability contractually with the processor). In any event, liability really depends on who is taking the decisions over the use of the data. If the third party just takes a feed of the data from the bank then takes various decisions over its use, they could well be a data controller. If on the other hand a bank contracts with a third party to provide an account aggregation service to its customers and they are passing data for this very specific purpose then the service provider could well just be a processor. The above is also going to change with the new General Data Protection Regulation coming into force next year...

closeparen 10y ago

>Anyone that holds personal data needs to acquire a license to do so from Datatilsynet That sounds ridiculous. Are YCombinator executives at risk of being fined/jailed in Norway since they presumably did not get a license for the Hacker News users table? Would a Norwegian teenager land in legal trouble for running an unlicensed phpBB forum? Do SaaS programmers need code review from the government on their pull requests? When Amazon or Netflix trains a new recommendations model?