Consent or exemption from duty of confidentiality
There are two main conditions for access and reuse of administrative data. Either the processing should be based on the informed consent of the data subject, or it should be exempted from the duty of confidentiality. See Conditions for consent.
The Nord-Trøndelag health study (HUNT)
The Nord-Trøndelag health study (HUNT) is an example of a study where participants have given their broad consent to compare data from one study with other public records. HUNT is one of the largest health studies ever performed in Norway based on survey and measurement data that have later been combined with administrative data. HUNT is considered unique due to its longitudinal character and scope. In total, more than 100,000 persons from the County of Nord-Trøndelag in Norway took part in the study.
Each participant has signed a written informed consent form regarding the screening, subsequent controls, and the use of data and blood samples for research purposes and to compare data from the HUNT Databank with other public records, for example The Norwegian Prescription Database, The Medical Birth Registry, The Cancer Registry and The Cause of Death Registry.
The participants were informed through a personal letter and an information folder, followed by personal information at the screening sites and general information via newspapers, radio, television as well as the comprehensive HUNT homepage. The homepage is also used to provide general information regarding updates about ongoing research activities and significant results of the study. The information letter and letter of consent for HUNT is available here:
Individual information in registry research studies
The Norwegian Advisory Board has discussed cases in which individual notification would be unreasonably difficult to provide. This was a topic of debate in, for instance, a research project from 2009 which involved the linking of de-identified data about 3200 persons from a Caesarian registry to The Medical Birth Registry. In this case, the Advisory Board agreed with the Authority, saying that it is not disproportionately difficult to give notification to 3200 people. They further stated that this number of participants is considered as rather low in a registry-perspective. Additionally, exemption from the general rule of giving individual information should depend on the need for safeguarding the privacy of many people, rather than the right to privacy of a few (PVN-2009-07).
A case of exemption from both consent and the information duty
The issues of exemption from both consent and the information duty have also been brought up for debate in the Advisory Board. An example would be the case of a research project concerning 172 drug addicts. The drug addicts had taken part in a research project at an earlier time, and now the researchers wanted to do a follow up study linking the sensitive personal data to the Cause of Death Registry and the ambulance service’s call-out statistics. The Data Protection Authority agreed that the new purpose did not differ from the former research purpose. However, the Authority required new consents to allow this follow up project, arguing that control with one’s own sensitive personal data should be decisive.
The Board’s opinion differed, but a majority (four against three) concluded that collecting new consents was not necessary, compared to the public interest of the project, and that making new contact would be inadvisable in terms of causing a heavy burden for the data subjects. The practical difficulties and the amount of work it would take to retrieve participants, many of them without permanent abode, was also emphasized (PVN 2002/06).
The reuse of data
The reuse of personal data for a different purpose than the original one must be assessed according to the provisions of §§ 8 and 9 in the Data Protection Act. If the data that is sought to be reused was originally collected on the basis of consent (cf. §§ 8a, 9a), the reuse of data is restricted according to what the participants have consented to and been informed about. According to the Data Protection Authority it is disloyal to the participants if the researcher disregards the “agreement” they made with the participants, and decide to use the data for other purposes than what was agreed in the first place (Data Protection Authority 2005). The Data Protection Authority therefore often requires that new consents are collected in case of the reuse of data for new purposes.
The STAMI case
The STAMI case is relevant here as it deals with the need for obtaining informed consent for the reuse of collected data. STAMI (Statens Arbeidsmiljøinstitutt) applied the Data Protection Authority for approval to undertake studies in the research project "Exposure-related incidence of cancer and respiratory diseases among workers in the Norwegian silicon carbide industry". The purpose of the study was to investigate the prevalence of pulmonary fibrosis among former and current employees of silicon carbide industry in Norway, and to inquire the possible dose-response relationship between fibrosis and exposure to different dust components in the silicon carbide industry. About 2000 - 2500 people were involved in the study.
For parts of the study (subprojects 1, 2 and 5), STAMI wanted to process sensitive data consisting of already existing data such as x-rays, information from the Cancer Registry and from the occupational health care service without the consent of the data subjects. Information letters were to be sent out to all the participants, and they were given the opportunity to opt out of participation in the project. STAMI did, however, apply for the processing of sensitive personal data without consent on the basis of conducting a task in the public interest that also was necessary for historical, statistical or scientific purposes (cf. the Personal Data Act §§ 8d, 9h).
The Data Protection Authority refused to approve the application for the mentioned subprojects as they were not based on the informed and explicit consent of the participants. The case was then appealed to the Norwegian Advisory Board, who argued that research, as a defined purpose for processing personal data, holds a special position in the Personal Data Act. One of the provisions that underlines the importance of research is § 11, 2nd paragraph indicating that the subsequent use of personal data to "historical, statistical or scientific purposes" is not deemed to be incompatible with the original purpose. On the basis of this provision, the Norwegian Advisory Board argued that the law itself highlights the societal benefits of the processing of personal data for research purposes (PVN 2004/1).
The Norwegian Advisory Board also underlined the fact that participants were given the possibility to refuse participation in the project. On this basis, the Norwegian Advisory Board decided that in this research project, it would be sufficient to inform the participants of the study conducted without obtaining new consents, as the public interest of the processing of personal data clearly would exceed the disadvantages it might entail for individual participant. Thus, the Advisory Board overruled the decision by the Data Protection Authority.
A rise in costs for access to public data
Along with a few other countries, Norway is in a unique position when it comes to the quality of administrative data. This means that researchers can access high quality data on the population when it comes to social issues, economics and health. Recently, however, there has been some debate over the accessibility of such data. Some researchers claim that public data have become more difficult to obtain due to a rise in costs and long wait to make the data available at Statistics Norway, and there are also researchers who report that such factors have delayed their research (Jakobsen 2014).
The pricing of assignments from Statistics Norway is available here:
Transfer of personal data abroad
Chapter 5 in the Personal Data Act lays out rules for the transfer of personal data abroad. The basic conditions are specified in Article 29: personal data may only be transferred to countries that ensure an adequate/proper treatment of personal information. States that have implemented Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data satisfy the requirement for adequate/proper treatment. Exemptions to these basic conditions are specified in Article 30.
Chapter 2 (Section 2-11) of the Personal Data Regulations prescribes measures with regard to security of confidentiality. This provision requires the controller to prevent unauthorized access to personal information. Risk assessments must be carried out to identify and define the information that requires confidentiality and safeguard measures.
Regarding the availability of data/information (Section 2-12): measures must be taken to ensure access to personal information (in cases where availability is necessary). This provision imposes on data controllers to ensure the necessary accessibility of information in order to implement the agreed treatment of personal data. The definition of what information should be accessible and the specification of necessary safety measures will be the result of the risk assessment.
The Personal Data Act
Personal Data Regulations (in Norwegian)
Archives Act (in Norwegian)
Copyright Act (in Norwegian)
Data Protection Authority, 2005. Bruk av personopplysninger i forskning: Del II Hvilke regler gjelder for forskning?. [Online] Available at: <http://www.datatilsynet.no/Global/04_veiledere/forskningsinfo_del_II_1_0... [Accessed 07 April 2014].
Ethics and Informed Consent. HUNT Biosciences. [Online] Available at: <http://www.huntbiosciences.com/working-with-us/ethics-and-informed-consent> [Accessed 04 March 2014].
Jakobsen, Siw Ellen. 2014. Pris-hopp på offentlige opplysninger. Forskning.no, 09. April 2014. [Online]. Available at:
< http://www.forskning.no/artikler/2014/april/387168> [Accessed 15.April 2014].
PVN-2002-06. Klage på Datatilsynets vedtak i sak om delvis avslag på konsesjonssøknad fra Statens institutt for rusmiddelforskning (SIRUS). [Online]. Available at:
<http://www.personvernnemnda.no/vedtak/2002_6.htm>. [Accessed 01. April 2014].
PVN 2004/1. 2004. Klage på Datatilsynets vedtak om vilkår om samtykke for konsesjon for delstudie 1 og 2 – Statens Arbeidsmiljøinstitutt – STAMI. Personvernnemda. [Online]. Available at:
<http://www.personvernnemnda.no/vedtak/2004_1.htm> [Accessed 04.April 2014].
PVN-2009-07. Personvernnemndas avgjørelse av 2. september 2009. [Online] Available at: <http://www.personvernnemnda.no/vedtak/2009_7.htm>. [Accessed 28. February 2014].
Statistics Norway. [Online]. Available at: <https://www.ssb.no/a/english/mikrodata_en/adm-reg_eng.html>. [Accessed 24. February 2014].
The Nord-Trøndelag Health Study. The HUNT study - a longitudinal population health Study in Norway. [Online] Available at: <http://www.ntnu.edu/hunt> [Accessed 04 March 2014].
The Public Administration Act, 1967. Act of 10 February 1967 relating to procedure in cases concerning the public administration as subsequently amended, most recently by Act of 1 August 2003 No. 86 [pdf] Available at: <http://www.ub.uio.no/ujur/ulovdata/lov-19670210-000-eng.pdf>. [Accessed 24. February 2014].