Personal privacy and expression online

Writing

Data protection cannot generally deal with individuals’ writings on the Internet, as they involve the expression of the person concerned. In such cases, the limits of constitutional rights are tested:

• freedom of expression,

• and privacy, respectively

When the limits of the constitutional rights of individuals are tested, it is the courts’ responsibility to resolve that conflict. Most complaints regarding expression, including on social media, are therefore dismissed from the Data Protection Authority and the parties are instructed to bring the dispute to the courts.

Publication of data

If an individual publishes information from data or databases containing personal data, the Data Protection Authority may in certain cases deal with the matter in a substantive manner, although the publication may be accompanied by some form of expression.

For example, the Data Protection Authority may generally deal with the disclosure of personal data, for example, a telephone number, address, bank information or health information about an individual, even if it appears with a text where someone expresses their opinions.

In that case, the writings themselves are not addressed, but just the disclosure of the information itself. Sometimes, however, these issues are so closely related that a complaint would be dismissed, but the Data Protection Authority evaluates this in each case.

Own data

Generally, you can publish your own data online, for example letters you have written, even if they concern other individuals. They would usually be considered to represent expression of your opinions. However, this may need to be evaluated in each case. It should also be noted that the publication could violate other laws than the Data Protection Act, but it is not the role of the Data Protection Authority to evaluate it.

Other data

The same does not apply to data from other individuals; they may not be published unless the person concerned agrees to the publication or if any other authority in the data protection legislation is considered, for example legitimate interests.