After a number of cases from, among others, news about whistle-blowing, sexual harassment and bullying in the Armed Forces, the Chief of Defense decided to bring in external investigators. The consulting company PwC has been commissioned to review the notification systems in the Norwegian Armed Forces. Among other things, they must look at how objectionable conditions have consequences. PwC will also look at individual cases and how they have been handled. The mandate states that they must look at “a selection of notification cases within all types of objectionable conditions”. The consultants have selected 58 notification cases to be reviewed. The case files from the Armed Forces from the 58 cases have then been transferred to the consultants. This has happened without the affected parties being notified or consenting to the sharing of their detailed information. This is how one of those affected reacts to the fact that the information was shared without any information being given: “The credibility of the Armed Forces’ handling of these matters is gone if they have distributed personally sensitive information without consent. I had hoped for an orderly and traceable process, but the trust is gone.” Information on 119 people According to news’s knowledge, among other things, cases dealing with sexual harassment have been selected. Such cases may contain large amounts of sensitive personal data. Examples are detailed explanations or questioning of those involved, text messages, images/videos and descriptions of sexual relationships. In response to questions from news, the Norwegian Armed Forces states that the case files that have been transferred to PwC contain: 58 cases Involving 119 people (who are considered by the Norwegian Defense Forces to be central) The information in all the cases was not redacted before the cases were sent by letter afterwards Only after all the detailed information had been sent to the external consultants, the Norwegian Armed Forces notified those involved. In a letter dated 15 September 2022, the Norwegian Armed Forces informs those affected: Such a letter was sent to 119 people by the Norwegian Armed Forces – after the information about them had been shared with consultants at PwC. Photo: Øyvind Bye Skille / news “You are receiving this information letter because you have been involved in one or more of the cases being reviewed, either as a whistleblower, re-notified, witness, or because you are otherwise affected by one or more cases. During the review, your personal data in connection with the selected cases will therefore be made available to a limited number of lawyers in PWC.” Even if the information had already been sent to the consultancy at this point, the letter states that those involved can make a reservation. The Norwegian Defense Forces states that a reservation according to the privacy rules must be justified. Those involved will then be anonymised in the material. Everyone who received the letter was given a deadline of just over a week to register a possible reservation. Law professor: – Unsustainable news has submitted the handling of the sensitive information for law professor Dag Wiese Schartum. This is how he assesses that the Norwegian Armed Forces have transferred the case files with all the details – and then subsequently sent out a letter offering to withdraw. – Information about this must be given in advance, and not afterwards. The privacy regulations are such that you must make a number of assessments in advance before you even start using the information, says Schartum. Law professor Dag Wiese Schartum has looked at the letter that those affected received from the Norwegian Armed Forces. Photo: Olav Døvik / news Schartum is a professor at the Center for Forensic Informatics at the University of Oslo. He has worked with privacy for a long time, published a number of books and articles. The professor has also participated in several legal investigations on privacy. He now sits on the government’s privacy commission. – How do you view the fact that the Norwegian Armed Forces have transferred the information and then only afterwards sent letters to those involved? – I don’t think it’s tenable to do that, replies the law professor. The legal expert reacts to the Defence’s transmission, how they have informed those affected and what legal assessments have been made: Topic raised by the privacy expert about the Defence’s transmission of notification information The Personal Data Act and the Personal Data Protection Regulation (GDPR) apply since it is a question of handling personal data. The Norwegian Armed Forces are responsible for processing. Privacy expert reacts to the Defense writing that PwC is the data controller, and not a data processor with a data processor agreement. According to the rules, the processing must have a purpose. Law professor Schartum believes this is sufficiently described in the letter to those affected and by the mandate for the evaluation. The processing must have a legal basis. The law professor believes that the Armed Forces can have grounds via obligations in the Working Environment Act, but that this does not exempt them from informing in advance. The personal information in many notification cases will be sensitive, and thus be considered special information according to the GDPR. The law professor responds that this has not been clearly addressed and authorized. In the privacy rules, a data minimization principle applies. No more information than necessary shall be processed. Law professor Schartum questions that the Armed Forces do not gossip and share entire case files. Source: Professor Dag Wiese Schartum (UiO) That the notification cases may contain very sensitive information is a central theme. Although many will probably contribute to the evaluation, which will try to improve the Norwegian Armed Forces’ handling of objectionable matters, there may be circumstances which mean that individuals do not want PwC lawyers to read sensitive details. There may be coincidences where a person concerned knows people who work at PwC, or their family or relatives work there. For an affected person who has not shared heavy details from a difficult case with all friends, relatives and family, it can therefore be important to be able to control who gets access to the details from the notification case. Law professor Schartum is therefore surprised that the Norwegian Armed Forces have so little assessed the handling of the information against the special rules that apply to sensitive personal information. – You get into very personal relationships that most people don’t want to spread, and that is burdensome. Especially health issues and detailed information about sexual relationships and events are things people often want to keep to themselves, says Schartum. He does not know in detail which legal assessments have been made by the Norwegian Armed Forces and PwC, but based on the letter to those concerned and open information in the mandate of the external evaluation, he assesses the work as follows: – The documents I have seen do not give the impression that the work is sufficiently systematic and thorough. The Defence: The legality was assessed This is how the Defense responds that the information was forwarded to PwC before those affected were informed or allowed to give their consent: – We disagree that there is a duty to inform those involved in whistle-blowing cases, writes press officer Aleksander Engborg Hage on behalf of the defense leadership in an email to news. The Defense believes that the handling is within the legislation. Vice-Admiral Elisabeth Natvig leads the reference group that keeps track of the measures to improve the handling of whistle-blowing cases in the Norwegian Armed Forces. Photo: Øyvind Bye Skille / news – The legality was assessed, and it was concluded that this was within the regulations, they write. At the same time, the Norwegian Armed Forces confirm that time pressure was involved when they transferred the cases before informing those affected. – The armed forces must improve their ability to handle alerts. It must happen as quickly as possible, in line with the expectations of our employees, conscripts and the public. PwC’s review of the Norwegian Armed Forces’ handling of whistleblowing cases will largely contribute to this. Time was therefore a factor, writes press guard Hage to news. The Norwegian Defense Forces states that the transmission to PwC is considered by the agency to be something they must do in order to fulfill their duty to act under the Working Environment Act in whistle-blowing cases. – Such processing is expressly stipulated in Norwegian law to which the Norwegian Armed Forces are subject and thus exempt from the duty to provide information cf. the personal data regulation article 14, no. 5. The Norwegian Armed Forces informs news that there were five people who reserved their personal information to be handled by PwC within the deadline . By then, the information had already been sent to PwC. Although the Norwegian Armed Forces state that the legality was assessed before the information was shared, documents that news has obtained access to from the Norwegian Data Protection Authority show that the Norwegian Armed Forces are still assessing the privacy aspects of the case. Vice-Admiral Elisabeth Natvig, who has the second highest rank in the Norwegian Armed Forces, has personally requested a meeting about “personally sensitive information”. It was only the day after the Defense had sent out a letter to the 119 affected that the Defense contacted the Norwegian Data Protection Authority and asked for guidance, an email news has seen shows: The guidance meeting on privacy related to the PwC investigations of whistleblowing cases has yet to not found. news has been in contact with the Norwegian Data Protection Authority. The inspectorate will not comment on a case they have not yet dealt with. Unions point to danger to trust and legitimacy of evaluation The two largest unions in the Armed Forces are reacting to what has happened at the start of the evaluation. The trade union Befalets fuelsorganisation (BFO) has been contacted by several members who became skeptical when they received a letter from the Norwegian Armed Forces stating that their case had been transferred to PwC. – We understand very well that our members are skeptical that such cases are handed over for evaluation in this way, says union leader Jens B. Jahren to news. Head of BFO, Jens B. Jahren, says that several of their members reacted when they received the letter. Photo: Øyvind Bye Skille / news Jahren is himself a member of the reference group, which follows up on the measures regarding notification and the external evaluation from PwC. He says that BFO is aware that there are difficult legal issues, and that lack of time has, among other things, been an issue. – What we have been told is that it has happened due to a lack of time. There have been different legal interpretations, and it has been chosen to take the risk involved in transferring the information, says Jahren. He is concerned that when this has happened one must be tidy and provide good information. At the same time, he believes that it is problematic if this damages the review. – I think it would have strengthened the legitimacy of the work if you had followed what we consider to be the normal procedures, says Jahren. The other major trade union in the Armed Forces, the Norwegian Officers’ and Specialists’ Association (NOF), is also reacting. – My experience is that it appears clumsily handled. It would have been better if they asked first and didn’t come and ask afterwards, says confederation leader Torbjørn Bongo to news. Confederation leader Torbjørn Bongo in the Norwegian Association of Officers and Specialists (NOF) believes it is important to have confidence in the clean-up in the Armed Forces. Photo: Øyvind Bye Skille / news He is not aware that your association has received questions from members about the transfer of personal data. At the same time, he also fears that the procedure could damage confidence in the necessary clean-up. – Unfortunately, I don’t think the method of asking afterwards helps to build trust. I think rather that it can be perceived as negative by those who receive a letter stating that it has been transferred to external parties without their prior consent, says Bongo. The armed forces: Aware of conflicting legal interpretations The armed forces have also been submitted to the statements from the trade unions. Via its press guard, the defense management responds as follows: – Thorough legal privacy assessments were made before the course of action was chosen. The defense is aware that there are conflicting legal interpretations in this field, but believes that the choice stands. PwC does the same, writes press guard and staff sergeant Aleksander Engborg Hage. news has also asked for comments from the consulting company PwC, which started processing the personal data in the notification cases. They do not want to be interviewed, but refer to the Armed Forces. That the Norwegian Defense Forces asked for guidance from the Norwegian Data Protection Authority only after they had submitted the sensitive information, the Norwegian Defense Forces press officer says this about: – Based on the different legal interpretations, the Norwegian Defense Forces asked for a conversation with the Norwegian Data Protection Authority. As of now, the Norwegian Data Protection Authority has not had the opportunity to prioritize such a conversation, says Hage. Read more of news’s stories about the Armed Forces:
ttn-69
The defense sent sensitive notification cases to consultants before informing those affected
