Consent as main condition
In the Norwegian Personal Data Act, consent remains the main condition for processing personal data. Other criteria for the processing of data are seen as exceptions, and consent is usually given priority unless there are strong arguments to do otherwise (Kvalheim 2004).
Legal age for consent
The minimum age for legal consent is not specified in the Personal Data Act. The data controller must therefore assess the ability of a young person to understand the implications of giving consent. The Norwegian Data Protection Authority establishes that common practice is to settle 15 years of age as the minimum age for giving consent, unless sensitive personal data is gathered, in which case the minimum age is either 16 or 18. The age limit is nevertheless depending on the scope and degree of intervention in the actual research project.
Medical and health research is regulated by the Norwegian Health Research Act. According to this Act, minors aged 16 and over can give a legal consent to participate in medical and health research, unless stated otherwise in statutory provisions. The nature of the research activity may also increase the age to give legal consent (cf. Article 17 b)). Finally, in the case of research involving minors aged 16–18 entailing bodily intervention or testing medicinal products, consent shall be obtained from parents or other legal guardians.
Obligation to provide information
If the research project processing personal data requires the consent of the data subject, the data subject shall receive information at least about the following (cf. §§ 18 and 19 of the Personal Data Act):
- The institution responsible for the project (data controller).
- Contact information of the researcher (or, alternatively, of the student and the supervisor).
- Purpose of the project and use of the information provided.
- Description of the personal data that are being collected and processed.
- When the project will be completed, and if the data will then be erased, anonymized or stored.
- Whether any others (besides the data controller) are to access the personal information, and if so, who.
- If the information is obtained from sources other than the research participants themselves (from registers, records, etc.), they must be informed about which information is collected, and from where.
- Participation is voluntary and the participants may withdraw their consent as long as the project is in progress, without stating the reason.
The data subject should also be notified if the personal data will be transferred abroad, and if so, to where and why. Usually, this kind of information is provided to the data subject in an information letter.
According to § 14 of the Health Research Act, research participants can give broad consent to the use of personal health data and human biological material for specific, broadly defined research purposes. Participants are still entitled to receive information about the project at regular intervals. The Personal Data Act states that the processing of personal data should only be used for explicitly stated purposes (cf. §11 b). The principle of broad consent is, however, widely supported in Norway today. It has also been practiced by the Norwegian Data Protection Authority in approving large social science projects despite the fact that the Personal Data Act does not provide the same legal basis for the use of broad consent as does the Health Research Act (Kvalheim 2014). The use of broad consent has been of particular importance for large population studies, such as for instance HUNT and MoBa.
The Norwegian Mother and Child Cohort Study (MoBa)
The Norwegian Mother and Child Cohort Study (MoBa) provides an example of medical and health research based on broad informed consent and voluntary participation. It was conducted as a cohort study where healthy participants (mother, father and children) were recruited to participate between 1999 and 2008. More than 90,000 pregnant women and over 70,000 fathers were asked to partake in regular follow-up studies and examinations (Norwegian Institute of Public Health, 2013).
The study was based on survey data, administrative data and measurement data. The main purpose of the MoBa study was to generate knowledge about the causes of serious diseases. The participants consented to the use of the data in medical research. Moreover, they agreed to the data being linked with information from previous health studies that the participants have taken part in, as well as to other registers, for instance registers for health, social security and disease, or the registers for income, education and occupation, as well as information. Such registers may include the Norwegian Cancer Registry, the Cause of Death Registry and the Income and Education register from Statistics Norway. The participants also agreed to have blood samples stored and used in medical research.
A precondition for the MoBa study was the obtaining of broad consent from the participants. The MoBa letter of invitation can be found here:
Exemptions from consent
In line with the EU Directive 95/46/EC, the Norwegian Personal Data Act allows for the processing of sensitive personal data without consent: if the processing is necessary for historical, statistical or scientific purposes, and the public interest clearly exceeds the possible disadvantages for the data subjects (cf. Article 9 h)). However, to allow processing based on this provision, the researcher must, in addition, establish that it is impossible to obtain consent without seriously damaging the research. Otherwise this approach will be seen as violating the respondent’s privacy interests.
The degree of disadvantage for the data subject is linked to the extent to which the proposed use of data is considered to differentiate from the original use of data.
Regardless of these considerations, the Data Protection Authority tends to be very reluctant to use the exemption for research. The conditions of necessity and public interest are applied strictly, and overall non-consent alternatives are rarely accepted, as long as obtaining consent is feasible (Kvalheim 2004).
When research projects are exempted from consent, it is anyhow considered whether it is possible to give individual information about the processing to the data subjects, with the offering of a withdrawal possibility. This is seen as an argument to lower the disadvantages the non-consent based processing entails.
Exemption from the duty of confidentiality
If access to administrative data is sought without the consent of the data subject, the exemption from the duty of confidentiality from the relevant authority is required (cf. § 13 of the Public Administration Act). Moreover, if the purpose of the research project and/or the use of the data changes, it is required to notify the data subject and/or obtain a new consent for the processing. Extension of the exemptions from the duty of confidentiality from the relevant authorities is also required in case of postponement of the processing of the data.
See a sample of Norwegian administrative data sources and Authoritative bodies for exemption from confidentiality: [https://www.ssb.no/a/english/mikrodata_en/adm-reg_eng.html]
Different regulations apply in the case of personal health data. According to the Health Research Act, the regional committee for medical and health research ethics may decide that personal health data can or shall be handed over by health personnel for use in research, and that this may be done despite the duty of confidentiality. The same applies to data gathered by the health service. This may only be applied if the research in question is of significant interest to society, and the participants’ welfare and integrity are ensured (cf. Article 35).
Permission from the register owner is also required for access to confidential information without the consetn of the data subject. In particular, registers from these sources are widely used in research:
Norwegian Institute of Public Health (central health registers):
Norwegian Directorate for Education and Training:
Kvalheim,V. 2004. Implementation of the Data Protection Directive in Relation to Medical Research in Norway. In: D. Beyleveld, D. Townend, S. Rouille-Mirza and J. Wright, ed. 2004. Implementation of the Data Protection Directive in Relation to Medical Research in Europe. Ashgate. pp. 289-305.
Kvalheim, V. 2014. EU-parlamentet har vedtatt forslag om ny personvernlovgivning: Styrker personvernet – innsnevrer mulighetene for forskning, Personvernombudet for forskning, NSD, 27.03.2014 [online] Available at:<http://www.nsd.uib.no/personvern/om/eu.htmlZ [Accessed 03 April 2014].
Norwegian Institute of Public Health, 2013. What is the Norwegian Mother and Child Cohort Study? [online] Available at: <http://www.fhi.no/eway/default.aspx?pid=240&trg=MainContent_6894&Main_6664=6894:0:25,7372:1:0:0:::0:0&MainContent_6894=6706:0:25,7373:1:0:0:::0:0> [Accessed 04 March 2014].
The Health Research Act, 2008. ACT 2008-06-20 no. 44: Act on medical and health research [pdf] Available at: <http://www.ub.uio.no/ujur/ulovdata/lov-20080620-044-eng.pdf>. [Accessed 24. February 2014].
The Norwegian Data Protection Authority [online]. Available at: <http:// www.datatilsynet.no>. [Accessed 24. February 2014].
The Personal Data Act, 2000. Act of 14 April 2000 No. 31 relating to the processing of personal data [pdf] Available at: <http://www.datatilsynet.no/Global/english/Personal_Data_Act_20120420.pdf>. [Accessed 24. February 2014].
 Medical and health research is defined in the Norwegian Health Research Act as activity conducted using scientific methods to generate new knowledge about health and disease (cf. Article 4 a)).