NOU 2022: 11 – Your privacy – our shared responsibility

Description, not analysis

This card describes the document. Interpretation and analysis are Rebekka's work in the next phase.

Reading status

Chapters 1–3 and 6 have been read closely. Chapters 4–5 and 7–14 are described only from the summary in chapter 1, so claims about them cite pp. 12–17.

Document type and genre

• A Norwegian Official Report (Norges offentlige utredninger, NOU) by a commission appointed by Royal Decree on 23 June 2020, submitted to the Ministry of Local Government and Regional Development on 26 September 2022 (title page; p. 18) [U].
• The title is Ditt personvern – vårt felles ansvar (‘Your privacy – our shared responsibility’), with the subtitle Tid for en personvernpolitikk (‘Time for a privacy policy’) (title page) [U].
• An NOU is a report that is normally sent on public consultation before the government decides on follow-up [T – general knowledge of the genre, not from the document].

Author, mandate and origin

• The Privacy Commission (Personvernkommisjonen) was to ‘assess the state of privacy in Norway’ (vurdere personvernets stilling i Norge) (cover letter; p. 18) [U].
• The mandate refers to the Granavolden government platform and to the Storting's request resolution 588 (2017–2018) on children's privacy (p. 18) [U].
• The mandate asks the commission to map, among other things, the public sector's processing of personal data (personopplysninger) for purposes other than the original purpose, privacy in the justice sector, consumers' possibilities and children's privacy (p. 21) [U].
• The mandate also describes the benefits of using personal data: public and private organisations can become more efficient and provide better services (pp. 18–19) [U].
• Chair: John Arne Moen; deputy chair: Ingvild Næss; 14 members in total from business, public administration and academia; the secretariat was in the ministry (pp. 22–23) [U].
• The commission finished its work on 18 July 2022, and the report has not been updated for changes after that date (p. 23) [U].
• The commission held 18 plenary meetings and three input seminars, and commissioned six external reports (pp. 23–25) [U].
• The commission is unanimous except on one recommendation, to investigate a general ban on behavioural advertising, where it split into a majority and a minority (pp. 12, 16) [U].

Structure

• Ch. 1 Introduction and summary (pp. 9–17)
• Ch. 2 Mandate, composition and work (pp. 18–25)
• Part I: Ch. 3 What is privacy and why is it important? (pp. 29–33); Ch. 4 Legal regulation (pp. 34–44); Ch. 5 The technological landscape (pp. 45–55)
• Part II: Ch. 6 Privacy in the digital public administration (pp. 59–85); Ch. 7 The justice sector (pp. 86–117); Ch. 8 Schools and kindergartens (pp. 118–146); Ch. 9 Consumer privacy (pp. 147–182)
• Part III: Ch. 10 Regulatory complexity and national room for manoeuvre (pp. 185–193); Ch. 11 Technology in the service of privacy (pp. 194–201); Ch. 12 Transparency (pp. 202–208); Ch. 13 Guidance, supervision and complaints (pp. 209–226); Ch. 14 Economic and administrative consequences (pp. 227–230)
• References (pp. 231 ff.)

How privacy and private data are defined and framed

• Privacy (personvern) is defined starting from the individual's inviolability, integrity and private life; it is closely tied to privacy, self-determination and self-expression (p. 29) [U].
• The commission adopts Schartum's understanding of privacy as the protection of private spheres (psychological, bodily, geographical, communication and an ‘information sphere’, opplysningssfære) (p. 29) [U].
• The commission distinguishes between personvern (privacy in a broad sense) and personopplysningsvern (protection of personal data), but uses personvern for both (p. 30) [U].
• Contextual privacy (kontekstuelt personvern): the interest in controlling information about oneself persists after it has been shared (p. 30) [U].
• Privacy is described both as an individual right and as a collective societal good (samfunnsgode) (pp. 9–10, 31) [U].
• The commission compares this with the environment and climate debate and the ‘tragedy of the commons’ (allmenningens tragedie): many small individual choices can cause great harm to society (p. 32) [U].
• Privacy is a precondition for freedom of expression, democracy and the rule of law (pp. 9, 31) [U].
• The commission uses the term viderebehandling (further processing) for using personal data for purposes other than the original one (pp. 22, 59) [U].
• The public administration processes personal data about all residents ‘from birth until death’, often with the national identity number as identifier (p. 59) [U].
• The right to privacy sets limits on the authorities' control and surveillance; the commission mentions the expressions ‘control society’ (kontrollsamfunnet) and ‘surveillance society’ (overvåkningssamfunnet) (p. 30) [U].
• Extensive surveillance can produce a panopticon effect and chilling effects (nedkjølingseffekter), with Bentham's panopticon and the Snowden revelations as examples (pp. 32–33) [U]. The word nedkjølingseffekt recurs in several chapters (among others pp. 14, 81, 101, 119, 203) [U].
• Privacy is described as ‘a shared responsibility’ (et felles ansvar) (p. 11) [U].
• Trust (tillit) in public authorities is described as a precondition for a well-functioning democracy; the commission notes that the OECD in 2021 measured Norwegians' trust in government at 77% (p. 61) [U]. Further processing contrary to residents' expectations can be experienced as a breach of trust (p. 62) [U].
• A national privacy policy must involve thorough risk assessments (risikovurderinger), also when designing regulations and services (p. 11) [U], and presupposes transparency (åpenhet) about the processing of personal data (p. 12) [U].

Problems the document describes

• Digitalisation happens at the expense of privacy (p. 9) [U].
• Privacy is often treated as a field for experts, and people associate it with consent requests and finger-wagging (p. 9) [U].
• No public body has overall responsibility for assessing the total use of personal data in the administration; assessments are made in silos (pp. 11, 71–72) [U].
• The digitalisation strategy states that privacy should be built in, but says little about how; privacy considerations have been given too little space (p. 61) [U].
• The ‘once only’ principle (kun én gang) and seamless services create an expectation of further processing (p. 60) [U].
• The relationship between the data subject and the authorities is marked by an asymmetrical balance of power, because public processing is based on law, not consent (p. 61) [U].
• Too many measures are laid down in regulations rather than statutes, so the Storting loses oversight (p. 72) [U].
• Privacy consequences are assessed poorly in legislative work; section 13g of the Public Administration Act is used as an example (pp. 73–75) [U].
• Profiling and machine learning, with examples from NAV, the Tax Administration, Denmark and the child benefits scandal in the Netherlands (pp. 64–68) [U].
• Public bodies' use of large technology companies, for example Facebook (pp. 81–82) [U].
• From the summary: surveillance pressure in the justice sector, commercial exploitation of pupils' data, and consumers' very limited possibilities (pp. 14–16) [U].

Solutions and measures proposed

• A national privacy policy (nasjonal personvernpolitikk) covering both public and private sectors, with ten overarching considerations (pp. 11–12) [U].
• An annual privacy policy statement to the Storting (pp. 11, 73) [U].
• An advisory and independent body for principled and ethical questions on the use of personal data in the administration, modelled on the Danish Data Ethics Council (p. 73) [U].
• Measures with major impact on privacy should be laid down in statute, not regulations (p. 84) [U].
• Assessments of privacy consequences in legislative work should be published, and a new guide should be made (p. 84) [U].
• Profiling to detect illegal activity should always be seen as intrusive and requires a solid legal basis; the precautionary principle should apply (pp. 81, 85) [U].
• Investigate a consent-based implementation of the ‘once only’ principle (p. 85) [U].
• The division of responsibility should to a greater extent be laid down in law or regulations where sharing personal data is part of a larger collaboration between public bodies (pp. 14, 85) [U].
• From the summary: transparency (åpenhet) is a basic precondition for democratic participation, privacy and the rule of law, and results of automated processes with direct significance for residents must be explainable (p. 17) [U].
• From the summary: a ban on remote biometric identification in public spaces, a ban on behavioural marketing to children, a committee on police methods, a national competence and testing centre for schools, a rights platform for residents, use of the Government Pension Fund Global's investor power, and more resources for the Data Protection Authority (pp. 13–17) [U].

Actors mentioned

Actor	Role in the document	Page
Ministry of Local Government and Regional Development	Recipient of the report; secretariat; responsible for digitalisation policy	title page, 23, 60
The government	Should develop a national privacy policy	11, 73
The Storting	Should gain more influence and an annual statement	11, 72
Data Protection Authority (Datatilsynet)	Supervisor and guide; should be strengthened	12, 17
Norwegian Digitalisation Agency (Digitaliseringsdirektoratet)	Resource centre for data sharing; assessed Facebook differently from the Data Protection Authority	61, 82
NAV, Tax Administration, Lånekassen, Husbanken, UDI	Examples of automation, profiling and sharing	63, 66–67, 77
Police / justice sector	Processing of personal data in fighting crime	14, 86 ff.
Municipalities, schools and kindergartens	Lack competence and resources	15
Large technology companies	Dominant actors; used by public bodies	15–16, 81–82
Children and young people	Vulnerable group; interviewed for the report	11, 22
The EU	Sets the framework; Norwegian authorities should influence it	11–12, 60

Document chain

• Builds on NOU 2009: 1 Individ og integritet by the previous privacy commission (p. 29) [U].
• The Granavolden platform and request resolution 588 (2017–2018) (p. 18) [U].
• Sections 102 (added in 2014) and 113 of the Constitution, Article 8 ECHR, the GDPR and the Personal Data Act (pp. 18, 29, 68) [U].
• The digitalisation strategy for the public sector 2019–2025, the National Strategy for Artificial Intelligence, white paper Meld. St. 22 (2020–2021) Data som ressurs and the Digitalisation Circular (p. 60) [U].
• White paper Meld. St. 25 (2018–2019) Framtidas forbrukar, the Data Protection Authority's Det store datakappløpet (2015) and the Consumer Council's Out of control (2020) (pp. 19–20) [U].
• Prop. 166 L (2020–2021) on section 13g of the Public Administration Act, and the Instructions for Official Studies (Utredningsinstruksen) (pp. 73–75) [U].
• OECD (2022) Drivers of Trust in Public Institutions in Norway (p. 61, note 14) [U].
• Mona Naomi Lintvedt's report on legal basis for control data and profiling (digital annex) (pp. 25, 80–81) [U].
• The work was delimited from the Freedom of Expression Commission, the Expert Group on Digital Learning Analytics and the Committee on Harmful Media Effects (p. 21) [U].

Key quotes

“Samtidig ser Personvernkommisjonen en gjennomgående tendens til at digitaliseringen skjer på bekostning av personvernet.” (p. 9)

“Personvern er med andre ord en forutsetning for et åpent samfunn og et velfungerende demokrati.” (p. 9)

“Dermed er personvern også en kollektiv og solidarisk verdi.” (p. 10)

“Et sterkt personvern er derfor både et individuelt gode og et kollektivt samfunnsgode.” (p. 31)

“Etter Personvernkommisjonens vurdering har personvernhensyn fått for liten plass i digitaliseringen av offentlig sektor.” (p. 61)

“Forholdet mellom den registrerte og myndighetene, bærer preg av en asymmetrisk maktbalanse.” (p. 61)

“I personvernperspektiv kan vi si at personopplysninger blir brukt som «råstoff» for å produsere nye personopplysninger.” (p. 63)

“At det er lov å dele og viderebehandle personopplysninger betyr ikke nødvendigvis at det skal eller bør gjøres.” (p. 72)

Observations that may be worth examining

• The mandate describes personal data both as something to be protected and as a ‘unique potential for analysis and service development’ (p. 18). How are these two held together in the rest of the document? [T]
• Privacy is framed as a societal good and compared with climate and the commons (p. 32). What consequences does that framing have for who is given responsibility? [T]
• The commission asks for a privacy policy that can ‘balance’ the digitalisation policy (p. 73). How is the relationship between the two policy fields described? [T]
• Trust appears in many places (pp. 9, 61–62, 72). What role does trust play in the justifications? [T]
• Who is given responsibility for privacy: the individual, the state, the Data Protection Authority, the municipalities or the companies? [T]
• Is the OECD report in note 14 (p. 61) the same as oecd2022trust in the source list? This needs checking when the PDF is available [T].

Open questions for Rebekka

• Which chapters of the NOU matter most for your question? Should chapters 7 (justice) and 9 (consumers) be read closely?
• Do you want to follow the document chain further, for example to the consultation responses or the government's follow-up?
• Do you use NOU 2009: 1 as a point of comparison?
• How should personvern be translated in the thesis, given the NOU's distinction between personvern and personopplysningsvern (p. 30)?