All employees and service providers at NTNU are subject to a duty of secrecy regarding certain information. The duty of secrecy means an obligation to prevent unauthorized persons from gaining access to information of a personal or business-related nature.

Norsk versjon: Taushetsplikt

What does the duty of secrecy mean for you?

As an employee or service provider for NTNU, you are required to prevent unauthorized persons from gaining access to or knowledge of information that you become aware of through your service or work concerning:

• an individual’s personal affairs,
• technical devices and procedures, as well as operational or business matters of competitive importance, and
• other matters which, by their nature and content, are confidential or subject to secrecy.

The duty of secrecy applies both during and outside working hours.

You must keep yourself informed about applicable laws and regulations that are relevant to the duty of secrecy and ensure that your handling of information complies with these requirements.

The duty of secrecy also applies after you have ended your employment or assignment.

Breach of the duty of secrecy may result in employment-related sanctions, liability for damages, and criminal liability.

Additional information about the duty of secrecy

The duty of secrecy applies to everyone who performs work or services for NTNU. This includes, for example, employees, elected or appointed office holders, temporary staff, hired consultants, and contractors.

Provisions on the duty of secrecy in the Public Administration Act

Sections 13 to 13 e of the Public Administration Act contain provisions on the duty of secrecy.

The main provision in section 13 states the following:

Any person rendering service to, or working for, an administrative agency shall be under a duty to prevent others from gaining access to or obtaining knowledge of any matter disclosed to him or her in the course of service or work concerning:

• an individual’s personal affairs, or
• technical devices and procedures, and operational or business matters which it is of competitive importance to keep secret in the interests of the person to whom the information relates.

Personal affairs do not include place of birth, date of birth, national identity number, citizenship, marital status, occupation, place of residence, or workplace, unless such information reveals a client relationship or other matters that must be regarded as personal.

The duty of secrecy also applies after the person has ended their service or work. Such information may not be used in the person’s own business activities or in service or work for others.

Personal affairs

Personal affairs are information that people would normally wish to keep private. This may include information about family and home circumstances, physical and mental health, character, and emotional life.

It is further established that certain personal data shall not be regarded as “personal affairs”. This includes place of birth, date of birth, national identity number, citizenship, marital status, occupation, place of residence, and workplace. However, the duty of secrecy still applies to such information if it reveals a client relationship or other circumstances that must be considered personal.

A residential address is normally not sensitive, but it will be regarded as sensitive if it relates to a prison, psychiatric hospital, crisis centre, or similar institution. If a person has a protected or confidential address, this information is also subject to secrecy.

The national identity number, i.e. date of birth and personal number, is not regarded as a personal affair under the Public Administration Act, but it is still protected under the Personal Data Act and the Freedom of Information Act. Under section 26, fifth paragraph, of the Freedom of Information Act, national identity numbers and similar identifiers may in all cases be exempt from public access. Under section 12 of the Personal Data Act, national identity numbers may only be used where there is a justified need for secure identification and where such use is necessary to achieve secure identification.

Technical devices and procedures, and operational or business matters

The duty of secrecy also applies to technical devices and procedures, as well as operational or business matters that it is of competitive importance to keep secret in the interests of the person to whom the information relates. This includes matters related to operations, such as how activities are organized. It may also include matters that are still at the planning stage, such as plans for mergers or demergers.

The duty of secrecy presupposes that the information is not generally known or publicly available elsewhere, cf. section 13 a nr. 3 of the Public Administration Act. Furthermore, the information must be of some significance and of such a nature that it is natural to assume that the organization regards it as confidential.

How long does the duty of secrecy apply?

The duty of secrecy continues to apply after employment or service has ended. As a general rule, however, the duty of secrecy lapses after 60 years, unless otherwise determined, cf. section 13 c, third paragraph, of the Public Administration Act. It may also lapse if no legitimate interest requires that the information be kept secret, cf. section 13 a nr. 3 of the Public Administration Act.

Duty of secrecy for researchers

Researchers’ duty of secrecy follows from section 13 e of the Public Administration Act.

How to handle information subject to secrecy

NTNU has its own guidelines for the processing of personal data. Anyone who works with personal data subject to secrecy must be familiar with the data protection regulations.

Breach of the duty of secrecy

Breach of the duty of secrecy may lead to employment-related sanctions such as termination, disciplinary action, summary dismissal, or suspension, cf. Statsansatteloven section 20, 25, 26 and 29.

Persons affected by a breach of the duty of secrecy may claim compensation for damage suffered as a result of the disclosure of information, cf. Skadeerstatningsloven section 2-1, GDPR article 82 and the Personal Data Act section 30.

Breach of the duty of secrecy may also lead to criminal sanctions, such as fines or imprisonment, cf. the Penal code section 209 and 210.

Extended duty of secrecy in certain professional fields

In certain professional fields, an extended duty of secrecy applies, for example for healthcare personnel.

Each individual unit is responsible for informing staff about the scope of the duty of secrecy and for preparing confidentiality declarations where necessary.