§ 28. Duty of confidentiality and disclosure of information from the National Population Register
Debt collectors (inkassatorer), employees, assistants and complaints board (nemnd) members must keep personal matters and business matters they learn about through the debt collection case confidential. But the duty of confidentiality (taushetsplikt) has exceptions. Among other things, information can lawfully be used for credit information purposes, given to Økokrim if money laundering (hvitvasking) or terrorist financing is suspected, and obtained from the National Population Register (Folkeregisteret) when needed for an estate of the deceased (dødsbo).
Machine-translated from Norwegian. The Norwegian text is the one that applies. Read the original in Norwegian.Norsk English العربية Polski Українська
The text of the law (unofficial translation)
A debt collector, the debt collector's employees and other assistants, and the members of the complaints board under § 22 and others who carry out work for the complaints board, have a duty to keep confidential from unauthorised persons what they learn in connection with the business about anyone's personal matters or operational and business matters. This does not apply if no legitimate interest calls for confidentiality.
The first paragraph does not prevent information from being handed over to or lawfully used in enterprises that carry on credit information business in accordance with the Credit Information Act (kredittopplysningsloven).
The first paragraph does not prevent information from being given to Økokrim about matters that give rise to suspicion of money laundering or terrorist financing. A transfer in good faith of information as mentioned in the first sentence does not constitute a breach of the duty of confidentiality and does not give grounds for criminal liability or liability to pay compensation (erstatning), unless there is gross negligence.
A debt collector may request that contact information for estates of the deceased be disclosed from the National Population Register. The population register authority may, notwithstanding the duty of confidentiality, disclose the information when it is necessary for carrying out debt collection assignments under this Act.
What does this mean?
§ 28 is about the duty of confidentiality. It means that people who work with debt collection (inkasso) cannot freely tell others what they know about you, your finances, your case or your business.
Debt collection often involves sensitive information. It may be that you owe money. It may be that you have payment problems. It may be that you have a dispute with a shop, bank or supplier. For business owners, the case may reveal operational problems, customer relationships or financial difficulties.
That is why the law says that the debt collector, employees, assistants and complaints board members have a duty of confidentiality. “Assistants” can be people who help the debt collector. This could be someone who works with systems, case handling, mailings or other practical follow-up. “Complaints board” refers to the complaints scheme under § 22.
The duty of confidentiality applies towards unauthorised persons. Unauthorised persons means people who do not have a legitimate reason (saklig grunn) to receive the information. The debt collector can of course use information internally to handle the case. But they cannot share it with your neighbour, your employer, friends, family or unrelated companies.
The rule covers both personal matters and operational and business matters. Personal matters can be finances, address, death, family circumstances and other private information. Operational and business matters typically concern information about a company, such as financial problems, customers, agreements or internal operations.
But the duty of confidentiality is not absolute. The law has several exceptions. Some information can be used in credit information business if this is done lawfully. Information can be given to Økokrim if money laundering or terrorist financing is suspected. The debt collector can also obtain contact information for estates of the deceased from the National Population Register when it is necessary for the debt collection assignment.
Who has a duty of confidentiality?
The duty of confidentiality applies to more than just the debt collection agency (inkassobyrå) as a company.
It applies to the debt collector. This means the enterprise that runs the debt collection business (inkassovirksomhet). It applies to the debt collector's employees. This means case handlers, managers and others who gain access through their work.
It also applies to other assistants. This makes the rule broad. Debt collection cases can involve technical suppliers, mailing services or others who assist with the assignment. If they learn confidential information through the business, they must not share it with unauthorised persons.
The duty of confidentiality also applies to members of the complaints board under § 22 and others who work for the complaints board. This is important because a complaint to the board often contains a lot of documentation. You may submit payment receipts, emails, health information, information about financial difficulties or details about your company. Those who handle the complaint must keep it confidential.
What does “personal matters” mean?
Personal matters are information that concerns your private life. In debt collection cases, this can be more than many people think.
The fact that you have received a debt collection claim can in itself be personal. How much you owe, who you owe money to, payment history, payment agreements (betalingsavtaler), objections (innsigelser) and contact information can also be private information.
If you explain that you cannot pay because you lost your job, became ill or have run into financial problems, this is obviously personal. The debt collector cannot share such information with unauthorised persons.
This means, for example, that the debt collection agency must be careful about how they contact you. They must not reveal the case to family members or your employer. Nor should they send information in a way that unnecessarily reveals the debt collection case to others.
What does “operational and business matters” mean?
This mainly concerns business owners. If a company has a debt collection case, the information can be sensitive even if it is not about a private individual.
A claim can reveal that the company has liquidity problems. It can reveal who the company does business with. It can show disagreements with customers or suppliers. It can also reveal internal matters.
The duty of confidentiality therefore also protects businesses. The debt collector cannot freely tell others that a particular company has a debt collection case, or spread details about the case without a lawful reason.
When does the duty of confidentiality not apply?
The first paragraph says that the duty of confidentiality does not apply if no legitimate interest calls for confidentiality. This means that if there is no reasonable reason to keep the information secret, the duty of confidentiality may fall away.
This must be assessed carefully. Debt collection cases often involve information that there actually is a legitimate interest in protecting. The debt collector should not use this exception lightly.
A simple example could be completely harmless information that is already public and does not harm anyone. But the more the information concerns finances, private life or business matters, the stronger the case for confidentiality.
What about credit information?
The second paragraph says that the duty of confidentiality does not prevent information from being handed over to or lawfully used in enterprises that carry on credit information business under the Credit Information Act.
This does not mean that the debt collector can share everything with anyone. It means that lawful credit information business can take place within its own rules. Payment default records (betalingsanmerkninger) and credit information have their own framework.
For you as a debtor (skyldner), this is important. A debt collection case can in some cases affect credit information. But it must be done according to the rules. The duty of confidentiality in § 28 does not stop lawful use of credit information.
What about Økokrim?
The third paragraph says that the duty of confidentiality does not prevent information from being given to Økokrim if money laundering or terrorist financing is suspected.
This is a serious exception. Money laundering means hiding where money really comes from, often money from criminal acts. Terrorist financing means financing terrorist acts or terrorist organisations.
If the debt collector, in good faith, sends information to Økokrim because of such a suspicion, this is not a breach of the duty of confidentiality. Nor does it give grounds for criminal liability or liability to pay compensation, unless there is gross negligence.
Gross negligence means a serious lack of care. It is more than a small mistake. The law thus protects those who report in good faith, but not those who act in a very irresponsible way.
What about estates of the deceased and the National Population Register?
The fourth paragraph concerns estates of the deceased. When a person dies, there may still be unpaid claims. The debt collector may then need contact information for the estate. The estate of the deceased is what the deceased leaves behind financially, that is, rights and debts after the death.
The debt collector can ask the National Population Register for contact information for estates of the deceased. The population register authority can disclose the information when it is necessary for the debt collection assignment.
This is practical. If the debt collector does not know who is handling the estate, the case may come to a halt. At the same time, the rule is limited. The information must be necessary for carrying out the debt collection assignment.
What happens if the duty of confidentiality is breached?
A breach of the duty of confidentiality can be serious. It can harm your private life, your finances or your business. It can also be a breach of the Debt Collection Act.
§ 32 says that violation of § 28 can be punished. This shows that the law takes the duty of confidentiality seriously.
If you believe the duty of confidentiality has been breached, you should document what happened. Who received the information? When did it happen? What was said or sent? Do you have screenshots, letters, emails or witnesses?
Then write to the debt collection agency and ask for an explanation. If the matter is serious, you can complain further to the appropriate body.
Examples
Kari receives a debt collection claim for an unpaid dentist's bill. She calls the debt collection agency and explains that she has been ill and has therefore not managed to keep up with her post. The case handler can record the information in the case. But the case handler cannot tell this to Kari's employer, partner or neighbour. These are personal matters. If the debt collection agency calls Kari and someone else answers the phone, they must be careful. They should not explain details of the debt collection case to the person who answers. The duty of confidentiality still applies.
Arne runs a small carpentry business. The company gets a debt collection case after a dispute with a supplier. In his complaint to the complaints board, Arne attaches emails showing prices, customers and delivery problems. The complaints board can use the documents to handle the case. But the board members and those who work for the board cannot pass the information on to unauthorised persons. These are operational and business matters. If the complaints board states that the Debt Collection Act has been breached, the statement can nevertheless be sent to the Financial Supervisory Authority of Norway (Finanstilsynet) under § 24. This is a statutory reporting rule, not random sharing.
Common mistakes
- Believing that the debt collection agency can tell your employer why they are calling
- Sharing too much private information verbally without asking for a written channel
- Believing that the duty of confidentiality prevents all lawful credit information
- Forgetting that the complaints board also has a duty of confidentiality
- Believing that information can never be given to Økokrim
What should you do?
If you contact the debt collection agency, use a written channel when the matter involves private information. That way you have documentation.
Ask for communication to go to the correct email address, digital mailbox or postal address. Make sure your contact information is up to date.
If the debt collection agency calls you at work, you can ask them to contact you privately. Write: “I do not want you to contact me at my workplace. Use email or my private phone number.”
If you believe information has been shared wrongly, write a short complaint. Ask to be told what information has been shared, with whom, when and on what basis.