The Norwegian Data Inspectorate has responsibility for ensuring enforcement of the Personal Data Registers Act of 1978. The purpose of the Act is to safeguard the protection of individual and social privacy.
The framework for the Data Inspectorate’s activities is defined by the Personal Data Registers Act of 1978. These activities can be summarized as three main responsibilities:
The Data Inspectorate shall process applications for licences for personal data registers and other activities that are subject to licensing according to the Personal Data Registers Act, and decide whether or not to grant such licences
The Data Inspectorate shall control that laws and regulations applying to the use of personal data are complied with
The Data Inspectorate shall provide information concerning the protection of privacy, data security and the rules that apply to personal data registers
The Data Inspectorate’s administration has 19 permanent members of staff (31 December 1996), and is led by a Director General. The Data Inspectorate has a board consisting of seven members, who deal with matters of principle submitted by the administration. In 1996, 20 cases were dealt with by the board and 6 049 cases by the administration.
Of these, the following cases are described in the annual report for 1996:
Electronic registration of medical registers
There are a number of electronic medical research registers in Norway. Many of these registers contain large amounts of sensitive information. The Data Inspectorate prescribes strict conditions for the gathering of such information, for receipt of the respondent’s consent and for security and storage of the information.
Disclosure of information by the Customs and Excise Service to an employer
This issue concerns the disclosure by a public institution of information concerning a person to that person’s employer. The question of the breaching of the duty to observe confidentiality has been submitted to the Ministry of Finance for assessment.
A new central computer-aided system for the Customs and Excise Service
The Customs and Excise Service is currently developing a new computer-aided system, which will place demands on organization, access, storage, linking of data registers, centralization, information flow and security. The Data Inspectorate has been involved in parts of the work to help in ensuring the security of personal data in the system.
Use of personal data in journalism
Personal data registers owned by media enterprises are excepted from the government licence requirement. Other external personal data registers are increasingly of interest to the media in their work. The Personal Data Registers Act prescribes limitations concerning the right of persons or bodies to retrieve information from specific registers. In the view of the Data Inspectorate, the media do not normally have a valid need to retrieve information from registers belonging to credit reference agencies.
Research and the Personal Data Registers Act
Each year, the Data Inspectorate deals with several hundred applications for the establishment of personal data registers for research purposes. Regulation of research projects by the Personal Data Registers Act gives rise to several issues: information to the respondents, voluntary participation by respondents, whether or not reminders shall be sent out when the response percentage is low, the length of the period for storage of the data, and whether it shall be possible to use the data for follow-up projects or other research purposes at a later date.
A new social security system in Oslo
Oslo Municipality keeps registers containing sensitive personal data concerning over 80 000 persons in a new system, where strict requirements are placed on information security. The system is a logically classified computer system, where the social security offices have access to encrypted social security data via a network, and also have access to the remainder of the municipality’s administrative system. The social security system and network are operated by two different data processing enterprises.
Network: Global electronic communication
The development of information technology increases the potential for electronic communication between different parties. Municipalities wish to be able to communicate with each other by electronic means, as do hospitals and doctors. In order to communicate with each other, institutions and individuals connect up to shared external computer networks, which results in the opening up of closed systems. This may lead to everyday simplifications and efficiency improvements, but also introduces new hazards.
Surveillance
Use of surveillance as an instrument is currently under development. An appropriate area for this is the transport sector. Satellite tracking is increasingly employed for taxi services, goods transport and emergency vehicles. An area of increasing interest to public transport operators is that of electronic ticket systems. Use of video surveillance seems to be in process of replacing other means of solving difficult situations at workplaces and in other localities.
Measures against money-laundering: the duty to report and to demand proof of identity
Provisions concerning the duty to demand proof of identity and the duty to report in connection with money-laundering are given in both the Financial Services Act and in the regulations pursuant to the Act. In responses to requests for comments, the Data Inspectorate has questioned whether clerical staff in financial institutions have the appropriate competence to make an accurate judgment as to whether a criminal offence has been committed and should be reported. Questions have also been raised concerning information to customers and the use of information that is excessive to the purpose for which it is held.
Information to registered persons
There is currently a discussion about the question of informing persons who are either registered or who are in process of being registered. This subject is treated in the EU Council Directive on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of such Data. The duty to inform private persons about whom inquiries are made by credit reference agencies is prescribed by the Personal Data Registers Act. The Data Inspectorate’s new licensing conditions in relation to credit reference agencies require that the registered person shall be informed when individual items of information are registered.