Norway: Datatilsynet requests clarification from ME DATA on Coronavirus reporting service
The Norwegian data protection authority ('Datatilsynet') announced, on 2 June 2020, that it has sent a letter ('the Letter') to ME DATA AS in relation to the compliance of a self-report service for COVID-19 ('Coronavirus') symptoms with data protection law. In particular, Datatilsynet noted that the service named 'World Citizen Report' processes information, such as the data subject's test history, symptoms, and infection control measures which fall within the special categories of data under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Therefore, Datatilsynet requests clarification on, among other things, ensuring valid consent to the processing of data, the procedures for deleting personal data, the sharing of personal data with third parties when a person signs up to the service, the retention period of the data, as well as the implementation of a Data Protection Impact Assessment ('DPIA'). Lastly, Datatilsynet specified that ME DATA should respond by 12 June 2020.