Overview of Statistics Norway’s reports on processing personal data
The duty to report the processing of personal data to the Norwegian Data Protection Authority is not applicable where a data protection officer has been appointed, cf. Section 7-12 of the Personal Data Regulations. Instead, the data protection officer is responsible for maintaining a publicly accessible overview of reports on the processing of personal data.
The scope of Statistics Norway’s duty to report has been discussed thoroughly with the Norwegian Data Protection Authority, and it was determined that Statistics Norway’s statistical activity is covered by two reports (r) on the processing of personal data and one licence (l), in addition to reports for Statistics Norway’s administrative processing of personal data.
Statistics Norway’s processing of personal data in relation to statistical activity is warranted under the provisions of the Statistics Act. Processing also encompasses sensitive personal data, but is exempt from the duty to acquire a licence, cf. Section 33, fourth paragraph of the Personal Data Act.
Statistical activity:
| Method of processing/purpose | Processing operations | Legal authority |
| (r) Producing official statistics | Collection, assembly, storage and distribution | Personal Data Act, Section 33 (4), cf. Statistics Act, Sections 1-1 and 2-5 |
| (r) Analysis and research | (Collection,) storage and assembly | Personal Data Act, Section 33 (4), cf. Statistics Act, Sections 1-1 and 2-5 |
| (l) Producing special statistics for customers (special user-financed assignments) | Collection, assembly, storage and distribution | Personal Data Act, Section 33 (1) |
Own administration:
| Processing |
| (r) Access control |
| (r) Access control |
| (r) Occupational health service |
An overview of reports on Statistics Norway’s processing of personal data is available here.