This report presents the findings from a project on estimating the prevalence of presumed victims of human trafficking in Norway. A main part of the report deals with issues related to privacy legislation and research into human trafficking. The method that forms the basis of the discussions in the project is called the Multiple Systems Estimation technique (MSE) and has been used in studies in selected European countries in recent years. The aim has been to calculate the prevalence of human trafficking, including how many people are trafficked but never come into contact with the authorities or assistance organisations. The United Nations Office on Drugs and Crime (UNODC) has played a central role in these studies and offered Norwegian authorities assistance in carrying out an MSE study in Norway. Fafo was commissioned by the Norwegian Police Directorate at the Coordination Unit for Victims of Human Trafficking (KOM) to be a Norwegian research partner in this project.
Several challenges prevented the implementation of the prevalence estimates, and the report provides an analysis of the obstacles and recommendations to remedy these. The report has been written with the intention of being a useful summary of methodological and privacy issues related to this type of prevalence estimation. On an overall level, the discussions in the report will also be useful in the authorities' further work to improve the reporting and statistical systems for the work against human trafficking in Norway. Most of the questions we address in this report also have a wider relevance.
Privacy and ethical considerations
An important part of Fafo's role in the first phase was to map privacy and ethical considerations in a complex legal landscape, as well as to obtain an overview of the potential access to data and whether these are suitable for the type of estimates made with MSE. The project highlighted that there were many seemingly unsettles issues pertaining to privacy legislation that made access to data difficult. The project goal of estimating prevalence was therefore set aside until further notice. The report provides an overview of legislation that regulates the use of personal data for research purposes, an analysis of obstacles to the implementation of the project and recommendations to remedy these.
The MSE technique is based on mapping the overlap between different organizations’ and authorities' registrations, that is, how many possible victims of human trafficking are registered on several lists. This requires the processing of personal data about victims of human trafficking. In many cases, it will not be possible to obtain consent from the data subjects for the processing of their personal data in an MSE project, for example because one does not know where they are or for other reasons cannot contact them in a safe way.
A considerable share of assistance to persons who are or may be exposed to human trafficking is provided by non-governmental organisations (NGOs). There are some challenges linked to the fact that it is not entirely clear how the sharing of personal data for research is regulated and works in practice for NGO actors whose confidentiality is not legally regulated. This is in contrast to public actors, where confidentiality, exceptions to confidentiality and duty to keep records, documentation and archives are clearly regulated in various parts of the legislation and where there is established practice and routines for sharing data for research purposes.
Privacy legislation includes provisions that regulate the processing of personal data for research, and these are not necessarily well known outside research circles or among actors without particular expertise in privacy and research. This report provides an overview of the current legislation and shows that there is a legal basis for processing personal data for research purposes even without the consent of the data subjects, based on the General Data Protection Regulation (GDPR) Article 6.1.e, 6.3 and the Personal Data Act paragraph 8 and 9. In addition to research purposes, these paragraphs also apply to archival purposes in public interest and statistical purposes. Paragraph 9 deals with the processing without consent of special categories of personal data (or what is often called sensitive data in everyday language).
In order for the processing to be legal, society's interest in the processing taking place must exceed the disadvantages for the individual. The processing must also take place in accordance with the guarantees in GDPR article 89.1, and the data subjects' rights in articles 12-22. These include, among other things, information to the data subject that the processing is taking place. Here, too, there are exceptions for purposes linked to scientific or historical research or for statistical purposes (GDPR article 89.2, Personal Data Act paragraphs 16 and 17). Exceptions must, however, be strictly enforced, and the main rule is that data subjects must receive information about the processing and can make use of their other rights (for example rectification, erasure).
The project highlighted that there is some doubt among several actors about the legal foundation for NGOs to share personal data in their registers for research purposes, and this therefore became a central topic for discussion about whether an MSE project can be carried out in Norway. For actors covered by the Public Administration Act, it is clear which paragraphs and procedures apply. The Public Administration Act regulates both confidentiality in general, exemption from confidentiality for research purposes and the researcher's duty of confidentiality in such cases, in Article 13. For information covered by the Public Administration Act, an application for access can be directed to the individual agency or body. As a general rule, the matter must be submitted to the Council for confidentiality and research (Rådet for taushetsplikt og forskning), particularly if the information to which access is sought is considered sensitive. Furthermore, there are separate rules relating to the use of police registers in the Police Databases Act (paragraph 33). Access can be granted on application to the Police Directorate.
The main privacy issue in this project has been whether organisations that are not covered by the Public Administration or Police Databases Act have the opportunity to share personal data for research without the data subject's consent. In cases where the information is not covered by a legally regulated duty of confidentiality, it follows that no exemption from the duty of confidentiality can be granted either. After consultation with Fafo's data protection officer in NSD (now SIKT), the conclusion is that there is a legal basis for the disclosure of information based on GDPR article 5.1.b. This section states that the processing of personal data for scientific research "shall not be considered to be incompatible with the initial purposes". This allows the organizations to have a legal basis to share data for research. This conclusion is also in line with a legal assessment of the basis for sharing personal data for research, carried out for the Directorate of Immigration by the law firm Simonsen Vogt Wiig.
The legal aspects are only one side of the matter, and independent ethical assessments must also be made of possible negative consequences for building trust with vulnerable groups if their personal data is shared for research. Here, however, it is important to make a realistic assessment, where the importance of research with vulnerable groups is also considered. From a research point of view, it is particularly problematic when it becomes systematically more difficult to develop solid research-based knowledge precisely about vulnerable and marginalized groups that are the subject of measures, and whether these measures are appropriate - this in itself constitutes an ethical question. There should therefore be very weighty and real reasons for placing limitations on the possibilities for research.
Data and registration practices
Another important question with regard to whether MSE can function in Norway is whether sufficient data are available. The project approached eight central actors with an invitation to participate in the project and we made a preliminary mapping of the scope of their registrations. It turned out that the number of registered identified victims of human trafficking is very low. For the MSE method to work, according to experts in the field, it is an advantage if there are at least 50 unique registrations (that is, individuals) per year in the lists combined. In Norway, the various actors appear to have registrations that are close to this critical limit, which will make the analyses more vulnerable. There is little consistency between the various actors in registration practice and which criteria are used as a basis for registration. There is particularly little access to records on minor victims of human trafficking. One of the biggest challenges is that there is no common definition or common inclusion criteria for registering what are (possible) cases of human trafficking. For example, if a starting point is taken with registered victims in a criminal case and the overlap with people who have spent a night in a shelter is checked, it is an open question as to what group the final estimate actually refers to. This does not mean that the MSE method cannot work in Norway in the future, but it will be necessary to establish a more consistent registration practice among relevant actors.
Organisation of the anti-trafficking field
The MSE project shows how the challenges associated with documentation and research in the field of human trafficking are ultimately also about how the work against human trafficking is organised. There is a lack of a central mechanism or function that has overall responsibility for ongoing documentation. As the situation is today, there is no record of how many are identified as possible victims of human trafficking in Norway, how many people receive assistance, or what kind of assistance they receive. The lack of documentation in the field is serious. This is related both to the possibility to monitor Norway's efforts against human trafficking at an overall level, and to keep track of whether vulnerable individuals with convention-based rights receive the assistance they are entitled to and need. Finally, there is a question of whether it would have been appropriate and possible to have some form of reporting scheme, for example, based on the grant scheme for work against human trafficking, or whether other organizational measures could have provided better monitoring and the necessary knowledge and documentation. As it stands today, it appears that there is little overall overview of results and adaptations in the authorities' work against human trafficking, beyond the situational picture provided in KOM's annual status reports.
