More institutions - one project
Under the Statistics Act of Norway, de-identified individual data cannot normally be supplied to researchers abroad. However, de-identified individual data may be supplied to researchers abroad where this takes place via the country’s national statistics agency, and where their confidentiality regulations correspond to those in Norway.
If the recipient meets the general requirements set by Statistics Norway for the supply of statistics for research in Norway, and the data are completely anonymised (i.e. not even Statistics Norway can identify the individuals directly or indirectly), then individual data can be provided. The standard rules for supplying statistical data for research shall apply. Since this is anonymous data, there would be no obligation to obtain official permission or to report under the Personal Data Act, even where this relates to data on physical persons. Neither would the confidentiality provision under .AN' 2-4 of the Statistics Act apply, however the restrictions on use in N'2-5 of the Act would still apply. How the relevant research expertise should be verified must be evaluated separately for each case. Furthermore, consent from the primary register owner may be necessary in relation to links to registers, even where a link leads to anonymous data.
Data for research purposes can be loaned to researchers at approved research units in Norway and to students in Norway studying for a masters degree or PhD. Data can also be loaned to post graduates provided that they are under the supervision of an employee with research qualifications at such a research unit. Additionally, the specific research work must be documented in a project description. The basis for Statistics Norway’s delivery of data for research is the Data Inspectorate of Norway’s decision of 16 March 2006 (in Norwegian only). Furthermore, in practice, permission for use must always be sought from the body responsible for the register, cf. .AN' 13 d of the Public Administration Act.
When a research project is to be solved by two or more institutions in cooperation, it may be necessary for the researchers of more than one institution to handle the de-identified data. The formal regulation will have to be considered as early as possible to avoid unwanted delays in the delivery. There are two different ways to meet these requirements:
Statistics Norway only supplies anonymous or de-identified data. Prior to delivery, the data is de-identified to as great an extent as the purpose allows. Statistics Norway does not supply identifiable data.
Base data linked to enterprises and establishments however, can be supplied in an identifiable form, and includes details such as organisation number, name, address and industry. Click here for more details on base data (in Norwegian only).
A register (collection of data) in which directly identifiable data (e.g. personal ID number/organisation number, name and address) have been deleted, is known as a de-identified register. Where enough data has been removed from the register that it is no longer reasonably possible to identify individuals/enterprises, this is known as an anonymised register (collection of data).
De-identified registers (collections of data) that contain data on physical persons are subject to the Personal Data Act. In the event that a researcher has a need for such data, notice of the project must be submitted to the Ombudsman for Privacy in Research or the Data Inspectorate. With regard to sensitive personal data, a recommendation must be obtained from the Ombudsman or a concession from the Data Inspectorate.
Lists of names and address are not supplied. Personal ID numbers are always removed. With regard to questionnaires conducted by external parties, Statistics Norway can, under certain conditions, provide assistance in connection with dispatch.
The actual researcher is responsible for reporting to the Ombudsman or the Data Inspectorate, or where relevant seeking a recommendation from the Ombudsman or a concession from the Data Inspectorate. The majority of research institutes in Norway have appointed the Norwegian Social Science Data Services (NSD) as the Ombudsman for Privacy in Research. The Data Inspectorate has drawn up two sets of guidelines for researchers; one of which covers the obligations for reporting and concessions, and the other deals with the remainder of the requirements of the Personal Data Act and the Personal Health Data Filing System Act. Click here to access these documents (in Norwegian only).
Where data is subject to confidentiality, the researcher must apply for exemption before delivery can be made. It is the register owner's executive body that grants exemptions. This applies to the majority of data that are taken from an administrative register and are subject to .AN' 13 d of the Public Administration Act.
Scientists needing data from Statistics Norway for health research projects need concession from the Regional Committee for Medical Research Ethics (REK). REK is given the authority to grant concession to use as well as exemption from confidentiality according personal data for health research projects. However, this applies to these sorts of projects only, i.e. projects using scientific methods to obtain new knowledge within the field of health and illness. Other projects will have to apply to the Ombudsman for Privacy in Research or the Data Inspectorate and the register owner's executive body.
The research institution is recommended to consider if there is any possibility that the information requested will need to be updated during the project period. If so, this should be stated in the project description and in the applications to the Ombudsman or Data Inspectorate and to the executive bodies granting exemptions from confidentiality. The end of the period of observation should preferably not be described in a way which could interfere with later updating.
Personal data that Statistics Norway has archived and which were originally obtained on a voluntary basis, are always anonymised before delivery. Data of this nature cannot be linked to other data without the consent of the individual participant in the survey (cf. .AN' 11 of the Personal Data Act).
Neither notice to nor a concession from the Data Inspectorate, or recommendations from the Ombudsman for Privacy in Research are sufficient on their own for access to the supply of data. Statistics Norway carries out an independent assessment of the project and use of the data (cf. .AN' 2-5.2 of the Statistics Act).
The delivery of data requires a written application including a project description. The purpose of the survey and documentation of the need for individual identifiers must be provided. Further Statistics Norway will have to get copies of the applications to the different public institutions mentioned above and their answers, approvals and/or exemptions etc from the same.
A signed agreement with Statistics Norway and a confidentiality agreement (cf. .AN' 2-5 and 2-4 of the Statistics Act) are required for the delivery of both de-identified and anonymised registers (see agreement, in Norwegian only). When the project is completed, the data supplied is to be returned to Statistics Norway or deleted.