A. Significant changes to privacy or data protection law
In 2004, the Data Inspectorate of Norway drew up proposals for amendments to the data protection regulations. The proposals aim to alleviate some aspects of the licensing obligation for research projects recommended by an ethical committee. The amendments came into force on 1 July 2005.
B. Significant changes to other laws affecting privacy or data protection
The Currency Register Act
A new register was added to the Currency Register Act for control and investigation purposes in relation to currency exchange and money flows in and out of the country.
The Data Inspectorate was of the opinion that the original proposal for full detail registration of minor amounts and storage over ten years would be a needlessly extensive infringement of individual privacy. In its debate on the draft legislation, the Storting, the Norwegian Parliament, opted for some reduction of the storage period and the degree of detail for registration of minor amounts.
The Working Environment Act
A statutory provision has been added to the Working Environment Act for regulations requiring that all employees be issued with special ID cards.
During the round of consultations, the Data Inspectorate had difficulty in seeing how such ID could help prevent social dumping and improve the working environment, as the initiative purported to do.
Furthermore, a legal authorisation has been introduced to give employers more control with employees, including the right to test them for intoxication under given conditions.
C. Initiatives taken to assist organisations and agencies meet their privacy obligations or otherwise enhance privacy
Guidelines
The Data Inspectorate assists in the formulation of three industrial norms, for an umbrella organisation for voluntary professional and industrial bodies, one industrial norm for security of information in the health sector, and one for processing of personal information in sports.
Consultations
Police methods
A public committee that assessed the police's need for methods presented its work in the spring of 2004. One of the Data Inspectorate's senior advisers sat on the committee, and raised some primary objections to the majority's proposals. In the Data Inspectorate's subsequent submission to the round of consultations, there was particular objection to the proposals for data reading and electric room surveillance. Data reading is a highly integrity-violating method. By this method, non-communicated information can be subject to closer scrutiny by the police. This may be done, for example, by the police installing spyware on a computer used by the suspect. The software records every keystroke, also data that are subsequently deleted. The Data Inspectorate sees it as problematic that thoughts, associations and wishes that were never even intended for communication to others could be used to help prove someone's guilt.
A streamlined public sector
During the year, the Data Inspectorate was consulted in matters that raise key questions about the public sector's processing of personal information. Common to many of the initiatives is the desire to achieve a more cost-effective and user-oriented public administration, in line with the government's modernisation programme. Some of the proposed measures entail keeping large amounts of personal data in central databases, or establishing portals to enable the exchange of personal data between various administrative bodies. Examples of this are the Ministry of Modernisation's plans for a common public IT architecture and establishment of a basic public authority database for the use of various administrative bodies. In addition come the Ministry of Health and Care's "Norwegian Patient Register" and the Ministry of Education and Research's central register of pupils in relation to national tests.
If we gather data systems that were formerly distributed, the Data Inspectorate’s view is that strict mechanisms must be built in to reduce the possibility of personal data being needlessly distributed or abused.
In several of the cases, there has been virtually no evaluation with regard to privacy and security of information.
The reports advocate the principle of reuse and more efficient exploitation of various types of basis data across all public administration. A considerable part of the information exchanged will naturally consist of personal data. The fact that public administration will thereby gain easier access to ever increasing amounts of information about individual citizens, without being in direct contact with them, could, seen in isolation, contribute to a very efficient administration. On the other hand it could also contribute to an effective shift of power from individual citizens to the authorities.
Norwegian Patient Register
In 2004, the Ministry of Health and Social Affairs proposed to change the Norwegian Patient Register into a register tied to identity. This is something the Data Inspectorate is strongly opposed to. During the round of consultations, the Data Inspectorate pointed out that a person- specific Norwegian Patient Register, with a centralised mapping of the health condition of individual Norwegian citizens and their use of hospitals from birth to death, would have a negative effect on the privacy of virtually everyone in Norway.
The proposed Norwegian Patient Register is a key register. By abstracting a few items of information from it, it is possible to identify each of us in most other health registers – regardless of whether these registers are basically made anonymous or pseudonymous. If we take existing health registers in conjunction with the proposed patient register, we can see that information mapping is well-nigh comprehensive.
Inspections
Increased focus on inspections
The Data Inspectorate decided in 2004 to organise some of its inspection activity into major projects. This method of organisation was chosen for sectors where it was considered important to add resources to undertake a particularly thorough, and thereby resource-demanding, mapping operation. Project-based inspections were made within the following areas:
· Women's refuge centres
· Electronic communications in the health sector
· The National Insurance Service
· Medical research
The Data Inspectorate appointed a project group which inspected 50 research projects during the spring of 2004. Inspections were made of 26 different health enterprises, teaching institutions, research institutions, and manufacturers of pharmaceuticals. The project uncovered several issues that the Data Inspectorate considers serious. The Data Inspectorate found breaches of concessionary conditions, illegal storage of sensitive personal data, lack of internal control and lack of clearly defined areas of responsibility. A separate report in Norwegian has been drawn up, setting out findings and tendencies in connection with the project.
Fully automatic road toll stations
Even though no sensitive personal data are processed at the fully automatic road toll stations, the Data Inspectorate decided in the autumn of 2004 that the fully automatic road toll stations should be obliged to acquire a license. The justification for being able to impose this requirement is that such processing will clearly violate important personal privacy interests. In the opinion of the Data Inspectorate, important personal privacy interests will clearly be violated if individuals cannot decide for themselves whether they want to leave traces of where they are travelling at any time along Norwegian roads. With the systems currently in use, road users are not offered solutions that leave them a real choice, whether it be information, availability, costs and functionality.
Testing for intoxicants
Securitas had established a system for testing its employees for intoxicants, based on their consent. However, the Data Inspectorate feels that the employer's right to govern and the consent of employees are not sufficient legal basis for conducting intoxication tests. Although the Data Inspectorate must be careful when querying a granted consent, there is no doubt that many employees feel under an obligation to consent to this type of infringement. The consequence of refusing to agree to testing for intoxicants could easily be that they would be denied a job.