Changes in The Patients’ Rights Act

In 2017, the Norwegian Parliament adopted amendments to the Patients’ and Users’ Rights Act, allowing healthcare professionals to withhold information from children under the age of 12 when there are compelling reasons for doing so. 

The knowledge gathered by ChangeFactory from children shows that one of the main reasons children do not tell health services about the things they struggle with most is that they do not know who will be told what they have shared. That is why the young people celebrated when this amendment to the law was proposed and later adopted.

The change in the law

§3-4 Information when the patient or service user is under 18 years of age

If the patient or service user is under 16 years of age, both the patient or service user and the parents or others with parental responsibility shall be provided with information.

If the patient or service user is between 12 and 16 years of age, information shall not be provided to the parents or others with parental responsibility if the patient or service user, for reasons that should be respected, does not wish this.

Regardless of the age of the patient or service user, information shall not be provided to the parents or others with parental responsibility if compelling considerations relating to the patient or service user weigh against doing so.

Changefactory's Privacy Policy

1. Introduction

Here you can read about what personal data Changefactory processes. Changefactory is committed to protecting your rights when we process personal data.

Personal data is all information that can be linked to you as a person, such as name, telephone number, photos, films and audio recordings.

2. Data controller

The CEO (in his/her absence, the chairman of the board) of Changefactory is the data controller for the foundation’s processing of personal data.

3. When does Changefactory process personal data about you?

Changefactory processes information about you when:

  • You, as a child or young person, participate in activities or projects with Changefactory where it is considered necessary to collect personal data
  • You (and possibly your caregivers) have consented to your participation in a survey
  • You are a member of Changefactory
  • You have applied for a job
  • A job seeker has listed you as a reference
  • You work at Changefactory
  • You have registered for an event organised by Changefactory
  • You are a journalist and we have had contact regarding statements, events, etc.
  • You have requested a lecture
  • We are going to have or have had meetings
  • You are a partner
  • We have contacted you regarding with recruitment for surveys
  • When you contact us via email, telephone, website or social media

4. What personal information we store

Changefactory does not collect and store more information than is necessary to fulfill the purpose of the processing. The personal information we collect is generally obtained from you.

Changefactory has good procedures for storing your personal information in a secure manner. This is done by storing the information in areas with access control where we limit who has access to the information about you.

You have the right to access the information that Changefactory has registered about you and can request that Changefactory update, limit, archive or delete information about you.

4.1. Children and young people

Changefactory is particularly concerned with protecting the rights of children and young people. We therefore have good procedures that ensure that the information we have about you is stored in a safe and secure manner.

4.1.1. Survey participants

When you agree to participate in a survey where we talk to you outside of school, we need some information from you so that we can contact you. We will always ask if it is okay for you to participate in the survey and for us to store information about you. In this way, you consent. Your contact information is stored on a disc that only those working on the survey have access to. The information is deleted when the survey is completed and the report is complete.

When Changefactory conducts surveys outside of school, this is done, among other things, by talking to you in an interview. The minutes from the interview are initially anonymised immediately, and no later than the same day the interview was conducted. This means that any personal data in the minutes that can be linked to you as an individual is removed.

The processing basis for processing personal data when we conduct surveys is either Article 6(1)(a) of the General Data Protection Regulation on consent or Article 6(1)(e) on public interest. Letter a of consent means that you (and guardians for you under 16 years of age) have agreed that you can participate in the survey and provide us with the information. Letter e of public interest means that Changefactory is allowed to process the information pursuant to sections 8 and 9 of the Norwegian Data Protection Act, because it is necessary for purposes related to scientific or historical research.

4.1.3. Member register

When you register as a member of Changefactory, we register your name, date of birth and telephone number in our member register. The basis for this processing is the data protection regulation art. 6 no. 1 letter a regarding consent. We store this information about you in order to be able to provide you with information and offers related to membership. The information is stored on a disk that only factory workers working with members have access to. The information is deleted when you are no longer a member.

4.1.4. Especially about photos, films and audio recordings of children and young people

Changefactory invites children and young people to take photos, films or audio recordings (e.g. podcasts). This is done as part of disseminating knowledge from children and young people. Before we do this, we obtain written consent from the child and from the caregiver for those under 16 years of age.

Changefactory publishes pictures, films and audio recordings with children on our websites, social media, public streaming services and in reports. CF obtains written approval from children and young people for the use of pictures/film and for where the picture/film can be published.

The basis for processing this is basically the Privacy Regulation art. 6 no. 1 letter a on consent and exceptionally letter f on legitimate interests. Pictures, films and audio recordings are deleted when the child or caregiver requests it.

4.1.6. Caregiver for children under 16 years of age

When a child or young person is under 16 years of age, we also obtain consent from caregivers to process personal data about the child. Changefactory then receives contact information for the caregiver from the child.

The basis for processing is the Data Protection Regulation art. 6 no. 1 letter b because the processing is necessary to fulfill an agreement to which the data subject is a party. The information will be deleted when the child reaches the age of 16 or in accordance with point 4.1.1 or 4.1.2.

4.2. Job seekers and employees

4.2.1. Job seekers

If you apply for a job at Changefactory, we need to process information about you to assess your application. The recruitment process involves processing the information you provide to us through the documents you send us, including your application, CV, diplomas and certificates. In addition to any interviews, Changefactory may also conduct its own investigations, for example by talking to references.

To assess applications and other submitted documents, conduct interviews and call references, the basis for processing is Article 6(1)(b) of the General Data Protection Regulation. This means that we may process personal data when it is necessary to take measures at the job seeker’s request before an agreement is concluded.

If we also conduct other investigations, for example by calling someone who has written a certificate and who is not a reference, the basis for processing is Article 6(1)(f), which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the interests or fundamental rights and freedoms of the individual. The legitimate interest is to find the right candidate for the position.

Applications will be deleted no later than when the recruitment process has been completed.

4.2.2. Employees

When you are employed by Changefactory, we process some personal data about you. This includes contact information, information needed for payment of wages and police clearance. Changefactory has routines for deleting user accounts, including e-mail and formatting of PCs, when an employee leaves.

The basis for processing contact information, information needed for payment of wages and police clearance is Article 6, first paragraph, letter b, stating that it is necessary to fulfill an agreement and Article 6, paragraph 1, letter c, stating that the processing is necessary to fulfill a legal obligation.

Information that we are obliged to keep under the Norwegian Bookkeeping Act is stored for 5 years, which is the requirement under the law.

4.3. Other

4.3.1. E-mail

We use e-mail in much of our work. CF has its own email accounts for employees, which are only used for as long as an employee works at CF.

We ask that you do not send special categories of personal data unencrypted by email. This is, for example, personal data about racial or ethnic origin, political opinion, religion, or health information.

4.3.2. Lecture agreement

If you have requested a lecture or similar for your business, we will store your contact information for the current and following years. The purpose is to plan and administer lectures, keep an overview of and follow up on completed lectures and prepare anonymous statistics for reporting and internal prioritisation and planning.

The basis for this processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration of the individual’s privacy. The legitimate interest is to administer, keep an overview of and follow up on lectures and prepare statistics.

4.3.3. Registration for events

When registering for an event, we will ask for information about your name, contact information and place of work. The purpose of the information is to provide information to participants, administer and organise events, prepare participant lists, follow-up of participants afterwards and for anonymous statistics for reporting.

The basis for processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration for the individual’s privacy. The legitimate interests are to carry out events in a good manner.

4.3.4. Partners

We process contact information for our partners. The purpose is to be able to arrange meetings, events and disseminate knowledge.

The basis for processing is Article 6(1)(f) of the General Data Protection Regulation, which allows us to process information that is necessary to safeguard a legitimate interest that outweighs the consideration for the individual’s privacy. The legitimate interests are to be able to contact our partners.

5. Your rights

Changefactory processes your personal data in accordance with the Personal Data Act and applicable regulations.

You have the right to access the information that Changefactory has registered about you, and you can request that the information be updated, archived, restricted or deleted. We have routines for deleting and archiving personal data.

You can object to the processing of the personal data we have registered about you. You also have the right to complain to the Data Protection Authority when processing personal data that is not in line with the rules.

6. Contact information

To request deletion, correction or access to personal data, you can send an email to samtykke@forandringsfabrikken.no.

If you have any questions or other inquiries, you can contact:
Viola Gunvaldsen Breunig
Legal advisor
Tel: +47 977 44 911
Email: viola@forandringsfabrikken.no

Changes in The Patients’ Rights Act