This week, NRK has reported critical error by Helse Sør Øst, which plans to store sensitive patient data in a US cloud solution. And if you think this sounds like a scary development, you’re absolutely right!

Back in 2013, Microsoft was actually forced to turn over data stored in Ireland to US authorities. The case was tried in US courts and ultimately ended up on appeal to the US Supreme Court, where both The European Union, the United Kingdom, Ireland and the United Nations are among the 289 participating as amicus curiae (a person who has the right to send a letter to the court to defend the public interest, without being a party to the case).

Elektronikk Forpost Norge (EFN) is also involved, because we find it absolutely unacceptable that US authorities should be able to coerce the collection of data that has nothing to do with the US. As usual, the Norwegian authorities were conspicuous by their absence.

Schrems II

Unfortunately, the case was dropped. The reason is that the American authorities introduced CLOUD action, which briefly states that the US government can compel US companies to surrender data stored anywhere in the world. We already said that the introduction of the CLOUD measure meant that American companies could not process data for Europeans.

In 2020, we were proven right, when Max Schrems, founder of one of our sister organizations – NOYB, won in a decision called Schrems II. Privacy Shield, which allows the exchange of data between Europe and the US, was declared invalid.

Last year, the US president signed the so-called presidential decree, which is an attempt to say something like that even though we were allowed to extract the data, we promised not to. It’s hard to place too much faith in this. The United States is a deeply divided country, and a presidential decree need not survive an election. We therefore reasonably believe that the new transfer agreement based on this decision will be declared no longer valid.

national security

But let’s just say that such data transfers can be done legally. What about national security? Imagine a finance minister with some form of nervous disease, which he hasn’t told anyone about. This is potentially information of national interest which we cannot share.

We already know that the US has no trouble supervising 122 heads of state, including its allies. We can hardly imagine that an AP-led government would recommend all ministers to go to private clinics because you can’t risk sharing potentially sensitive health information. So, at a minimum, all information about people with socially critical tasks must be kept so that it cannot be checked by foreign authorities.

In short: We think this is a very bad solution that will undermine our national security and will probably be known as illegal in no time. It’s time for our leaders to take privacy and national security seriously and not share our sensitive data carelessly.