The defense sent sensitive notification cases to consultants before informing those affected
After a number of cases from, among others, NRK about whistle-blowing, sexual harassment and bullying in the Armed Forces, the Chief of Defense decided to bring in external investigators.
The consulting company PwC has been commissioned to review the notification systems in the Norwegian Armed Forces. Among other things, they must look at how objectionable conditions have consequences.
PwC will also look at individual cases and how they have been handled. The mandate states that they must look at “a selection of notification cases within all types of objectionable conditions”.
The consultants have selected 58 notification cases to be reviewed.
The case files from the Armed Forces from the 58 cases have then been transferred to the consultants. This has happened without the affected parties being notified or consenting to the sharing of their detailed information.
This is how one of those affected reacts to the fact that the information was shared without any information being given:
“The credibility of the Norwegian Armed Forces’ handling of these cases is gone if they have distributed personally sensitive information without consent. I had hoped for an orderly and traceable process, but the trust is gone.”
Information on 119 people
According to NRK’s knowledge, among other things, cases dealing with sexual harassment have been selected.
Like cases can contain large amounts of sensitive personal data. Examples are detailed explanations or questioning of those involved, text messages, images/videos and descriptions of sexual relationships.
In response to questions from NRK, the Norwegian Defense Forces states that the case files that have been transferred to PwC contain:
- 58 cases
- Involves 119 people (who are considered central by the Norwegian Armed Forces)
- The information in all the cases was not slandered before the cases were sent over
Letter afterwards
Only after all the detailed information had been sent to the external consultants did the Norwegian Armed Forces notify those involved.
In a letter dated 15 September 2022, the Norwegian Armed Forces inform those affected:
“You are receiving this information letter because you have been involved in one or more of the cases being reviewed, either as a whistleblower, re-notified, witness, or because you are otherwise affected by one or more cases. During the review, your personal data in connection with the selected cases will therefore be made available to a limited number of lawyers in PWC.”
Even if the information had already been sent to the consulting company at this point, the letter states that they can make a reservation.
The Norwegian Defense Forces states that a reservation according to the privacy rules must be justified. Those involved will then be anonymised in the material.
Everyone who received the letter had the first time in just over a week to register a possible reservation.
Law professor: – Not tenable
NRK has submitted the handling of the sensitive information to law professor Dag Wiese Schartum.
This is how he assesses that the Norwegian Armed Forces have transferred the case files with all the details – and then subsequently sent out a letter offering to withdraw.
– Information about this must be given in advance, and not afterwards. The privacy regulations are such that you must make a number of assessments in advance before you even start using the information, says Schartum.
Schartum is professor at the Center for Forensic Informatics at the University of Oslo. He has worked with privacy for a long time, published a number of books and articles. The professor has also participated in several legal investigations on privacy. Now he sits in the government privacy commission.
– How do you view the fact that the Norwegian Armed Forces have transferred the information and then only afterwards sent letters to those involved?
– I don’t think it’s tenable to do that, replies the law professor.
The legal expert reacts to the Defense’s transmission, how they have informed those affected and what legal assessments have been made:
The fact that the notification cases may contain sensitive information is a central theme.
Although many will probably contribute to the evaluation, which will try to improve the Norwegian Armed Forces’ handling of objectionable matters, there may be circumstances which mean that individuals do not want PwC lawyers to read sensitive details.
There may be random people who work at PwC, or there may be family or relatives working there. For an affected person who has not shared heavy details from a difficult case with all friends, relatives and family, it can therefore be important to be able to control who gets access to the details from the notification case.
Law professor Schartum is therefore surprised that the Norwegian Armed Forces have so little assessed the handling of the information against the special rules that apply to sensitive personal information.
– You get into very personal relationships that most people don’t want to spread, and that is burdensome. Especially health issues and detailed information about sexual relationships and events are things people often want to keep to themselves, says Schartum.
He does not know in detail which legal assessments have been made by the Norwegian Armed Forces and PwC, but based on the letter to those concerned and open information in the mandate of the external evaluation, he assesses the work as follows:
– The documents I have seen do not give the impression that the work is sufficiently systematic and thorough.
Defence: The legality was assessed
This is how the Norwegian Armed Forces respond that the information was sent to PwC before they were informed or allowed to give their consent:
– We disagree that there is an obligation to inform those involved in whistle-blowing cases, writes press officer Aleksander Engborg Hage on behalf of the defense leadership in an email to NRK.
The Defense believes that the handling is within the legislation.
– The legality was assessed, and it was concluded that this was within the regulations, they write.
At the same time, the Norwegian Armed Forces confirm that time pressure was involved when they transferred the cases before informing those affected.
– The armed forces must improve their ability to handle alerts. It must happen as quickly as possible, in line with the expectations of our employees, conscripts and the public. PwC’s review of the Norwegian Armed Forces’ handling of whistleblowing cases will largely contribute to this. Time was therefore a factor, writes press guard Hage to NRK.
The Norwegian Defense Force states that the agency’s submission to PwC is considered something they must do in order to comply with their duty to act according to the working environment in whistle-blowing cases.
– Such processing is expressly stipulated in Norwegian law to which the Armed Forces are subject and thus exempt from the obligation to provide information, cf. the personal information regulation, article 14, no. 5.
The Norwegian Defense Forces informs NRK that there were five people who objected to their personal data being handled by PwC within the deadline. By then, the information had already been sent to PwC.
Although the Norwegian Defense Ministry states that the legality was assessed before the information was shared, documents NRK has been given access to by the Norwegian Data Protection Authority show that the Norwegian Defense Ministry is still assessing the privacy aspects of the case.
Vice-Admiral Elisabeth Natvig, who has the second highest number of calls in the Norwegian Armed Forces, has personally requested a meeting about “personally sensitive information”.
It was only the day after the Norwegian Defense Forces had sent out a letter to the 119 affected that the Norwegian Defense Forces contacted the Norwegian Data Protection Authority and asked for guidance, shows an email NRK has seen:
The guidance meeting on privacy related to the PwC investigations of whistleblowing cases has not yet taken place.
NRK has been in contact with the Norwegian Data Protection Authority. The inspectorate will not comment on a case they have not yet dealt with.
Trade unions point to a danger to trust and legitimacy in evaluation
The two largest trade unions in the Armed Forces are reacting to what has happened at the start of the evaluation.
The trade union Befalets fuelsorganisation (BFO) has been contacted with several members who became skeptical when they received a letter from the Norwegian Armed Forces stating that their case had been transferred to PwC.
– We understand very well that our members are skeptical that such cases are handed over for evaluation in this way, says union leader Jens B. Jahren to NRK.
Jahren himself is a member of the reference group, which follows up on the measures surrounding notification and the external evaluation from PwC. He says that BFO is aware that there are difficult legal issues, and that lack of time has, among other things, been an issue.
– What we have been told is that it has happened due to a lack of time. There have been different legal interpretations, and people have chosen to take the risk involved in transferring the information, says Jahren. He is concerned that when this has happened one must be tidy and provide good information.
At the same time, he believes that it is problematic if this damages the review.
– I think it would have strengthened the legitimacy of the work if you had followed what we consider to be the normal procedures, says Jahren.
The other major trade union in the Armed Forces, the Norwegian Officers’ and Specialists’ Association (NOF), is also reacting.
– My experience is that it appears clumsily handled. It would have been better if they asked first and did not come and ask afterwards, says confederation leader Torbjørn Bongo to NRK.
He is not familiar with your association has received questions from members about the transfer of personal data.
At the same time, he also fears that the procedure could damage confidence in the necessary clean-up.
– Unfortunately, I don’t think the method of asking afterwards helps to build trust. I think rather that it can be perceived as negative by those who receive a letter stating that it has been transferred to external parties without their prior consent, says Bongo.
Defence: Aware of conflicting legal interpretations
The defense has also been submitted to the statements from the trade unions.
Via its press guard, the defense leadership responds as follows:
– Thorough legal privacy assessments were made before the course of action was chosen. The defense is aware that there are conflicting legal interpretations in this field, but believes that the choice stands. PwC does the same, writes press guard and staff sergeant Aleksander Engborg Hage.
NRK has also asked for comments from the consulting company PwC, which started processing the personal data in the notification cases. They do not want to be interviewed, but refer to the Armed Forces.
That the Norwegian Defense Forces asked for guidance from the Norwegian Data Protection Authority only after they had handed over the sensitive information, the Norwegian Defense Forces’ press officer says this about:
– Based on the different legal interpretations, the Norwegian Defense Forces asked for a conversation with the Norwegian Data Protection Authority. The Norwegian Data Protection Authority has not had the opportunity to prioritize such a conversation, says Hage.
Read more of NRK’s stories about the Armed Forces: