Personal Data Act (Norway)

Personal Data Act (Norway)
Title	Personal Data Act
Legislature	Storting
Enacted by	Storting
Date enacted	2018
Status	Current

Personal Data Act (Norway) The Personal Data Act is Norwegian legislation implementing Regulation (EU) 2016/679 standards into national law to regulate processing of personal data within Kingdom of Norway. It aligns Data Protection Board of Norway practice with international frameworks such as European Union law and interfaces with instruments like the Council of Europe conventions and the European Economic Area agreement. The Act coordinates with Norwegian institutions including the Ministry of Justice and Public Security, the Office of the Prime Minister (Norway), and supervisory bodies such as the Norwegian Data Protection Authority.

Background and Purpose

The Act was adopted in the aftermath of the adoption of General Data Protection Regulation by European Union organs and the need for harmonisation across the European Economic Area after negotiations involving the European Free Trade Association and European Commission. Motivations cited by the Ministry of Justice and Public Security and debates in the Storting included protecting fundamental rights recognized by the European Convention on Human Rights, securing legal certainty for entities like Telenor ASA, Equinor, DNB ASA, and fostering transnational data flows with partners such as United States corporations under frameworks like Privacy Shield discussions. The Act’s purpose echoes principles advanced by jurists at institutions like the University of Oslo and policy reports from the Organisation for Economic Co-operation and Development.

Scope and Definitions

The Act defines "personal data" using terminology consistent with Regulation (EU) 2016/679 and clarifies applicability to processing carried out by public bodies including Norwegian Tax Administration and private entities including Schibsted, Storebrand, and startups incubated at Oslo Metropolitan University collaborations. It distinguishes processing in contexts regulated by sectoral laws such as the Health and Care Services Act (Norway) and data processed by intelligence services like the Norwegian Police Security Service. Definitions reference categories of data controllers and processors, aligning with practices in jurisdictions represented by institutions like the European Court of Justice and the European Data Protection Supervisor.

Key Provisions and Principles

The Act codifies principles such as lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, paralleling provisions in General Data Protection Regulation. It mandates lawful bases for processing that mirror standards discussed in rulings by the European Court of Human Rights, and intersects with other statutes including the Working Environment Act (Norway) for employee data and the Archives Act (Norway). The Act includes special categories of personal data protections relevant to sectors like healthcare at Oslo University Hospital and financial services regulated by the Financial Supervisory Authority of Norway.

Rights of Data Subjects

The Act grants data subjects rights including access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection, similar to rights adjudicated in cases before the European Court of Justice and illustrated in disputes involving companies like Facebook, Google, Microsoft, and Apple. It prescribes procedures for exercising rights vis‑à‑vis controllers such as Posten Norge and public agencies like the Norwegian Labour and Welfare Administration. The Act also sets protections for children and for special categories of data handled by institutions including Norwegian Directorate of Health.

Obligations of Controllers and Processors

Controllers and processors must implement appropriate technical and organisational measures, maintain records of processing activities, conduct Data Protection Impact Assessments where required, and appoint Data Protection Officers in specified circumstances, reflecting practices in entities including Statkraft, Kongsberg Gruppen, and university research units at Norwegian University of Science and Technology. Contracts between controllers and processors must mirror standards used in transnational agreements with firms such as Amazon (company), IBM, Accenture, and Capgemini. The Act interfaces with law enforcement access regimes overseen by bodies like the Norwegian Police Service and intelligence oversight mechanisms such as the Parliamentary Intelligence Oversight Committee (Norway).

Enforcement and Sanctions

Enforcement is primarily the responsibility of the Norwegian Data Protection Authority, which can issue warnings, reprimands, orders to comply, and administrative fines calibrated in line with General Data Protection Regulation maxima applied across the European Economic Area. The Authority’s actions have precedents in decisions concerning multinational firms like Twitter, YouTube, and LinkedIn, and it cooperates with counterparts such as the Information Commissioner's Office and national authorities in Sweden, Denmark, Finland, Germany, France, and Netherlands through mechanisms like the European Data Protection Board. Judicial review may involve courts including the Supreme Court of Norway.

Implementation and Amendments

Implementation required coordinated efforts from ministries including the Ministry of Local Government and Modernisation and agencies such as the Digitalisation Directorate (Norway), with guidance published for sectors including healthcare, finance, and education involving actors like University of Bergen and BI Norwegian Business School. Amendments and guidance have addressed topics such as cross‑border transfers, adequacy decisions by the European Commission, interoperability with frameworks like eIDAS Regulation, and responses to technological developments involving companies like Nokia, Ericsson, and research from institutions such as the Norwegian Computing Center. Ongoing legislative updates continue to reflect case law from the European Court of Human Rights and rulings of the European Court of Justice.

Category:Norwegian law Category:Data protection law