Norway Personal Data Act — Personopplysningsloven

Why does it matter?

Norway is not an EU member state, so the GDPR does not apply there of its own force. It applies because Section 1 of the Personal Data Act gives Regulation (EU) 2016/679, as taken into Annex XI no. 5e of the EEA Agreement, the status of Norwegian law with the adaptations that follow from Annex XI, Protocol 1 and the Agreement in general, and Section 2 says that in a conflict the GDPR takes precedence over any other statute on the same matter (section 2 of the EEA Act). The Act is therefore where a practitioner finds both the legal basis for the GDPR in Norway and every national choice Norway has made under it.

Key benefits include:

• One text makes the GDPR Norwegian law

Section 1 incorporates the Regulation through the EEA Agreement, so controllers and processors apply the GDPR articles directly, with the EEA adaptations and the Act's own sections read together.

• The national choices are written down

The age of consent for information society services is 13 (Section 5), special categories may be processed for employment obligations and rights (Section 6), and national identity numbers only where there is a legitimate need for definite identification (Section 12).

• A defined route for research and archiving

Sections 8 to 10 allow processing for archiving, research and statistics under the Article 89(1) safeguards, with a duty to consult the data protection officer before special categories are processed without consent unless a DPIA has been done.

• A clear supervisory structure

Datatilsynet is the Article 51 supervisory authority with Article 58 powers and cannot be instructed in individual cases (Section 20); appeals go to the seven-member Privacy Appeals Board (Section 22).

• Sanctions that go beyond the Regulation

Article 83(4) fines also apply to breaches of Articles 10 and 24, public authorities can be fined (Section 26), coercive daily fines enforce orders (Section 29), the limitation period is five years (Section 28) and non-economic loss is compensable (Section 30).

How does it work?

Chapter 2 fixes the reach of the Act. Section 2 applies it and the GDPR to processing wholly or partly by automated means and to manual processing in a filing system, excludes purely personal or household activity and cases decided under the administration-of-justice acts, and limits Article 56 and Chapter VII of the GDPR to the scope of the EEA Agreement. Section 3 disapplies the Act for journalistic, academic, artistic and literary purposes to the extent necessary for freedom of expression, but Articles 24, 26, 28, 29, 32, 33 no. 2 and 40 to 43 can never be excepted. Section 4 covers establishments in Norway wherever the processing happens, and non-EEA controllers that target or monitor people in Norway.

Chapters 3 and 4 hold the national rules. Besides consent at 13, employment data and identity numbers, Section 7 lets Datatilsynet permit, or the King regulate, special-category processing in the substantial public interest; Section 11 extends the same rules to criminal-conviction data; Section 12 a lets public authorities share data to combat work-related crime; Sections 13 to 15 authorize regulations on third-country transfers, prior consultation and delegated acts. Section 16 withholds information and access where foreign policy, national defense, crime prevention, health, statutory secrecy, internal case preparation or obvious private or public interests require it, with written reasons citing the legal basis, and Section 17 limits access, rectification and restriction in research and archiving.

Chapters 5 to 8 deal with officers, supervision and sanctions. Data protection officers owe a duty of secrecy that survives the end of their service (Section 18). Datatilsynet is headed by a director appointed by the King, reports annually to the King and the Storting (Sections 20 and 21), and acts for the State in court (Section 25); the Privacy Appeals Board hears appeals except on Article 56 and Chapter VII matters (Section 22). A fine must be paid within four weeks of becoming final and the courts may review every aspect of it (Section 27). Section 31 prohibits false surveillance cameras and misleading signage where real surveillance would breach the GDPR.

Key Elements

• Section 1, incorporation

Regulation (EU) 2016/679 applies as Norwegian law through Annex XI no. 5e of the EEA Agreement, with the adaptations in Annex XI, Protocol 1 and the Agreement in general.

• Section 4, geographical scope

Establishments of a controller or processor in Norway regardless of where the processing takes place; non-EEA controllers offering goods or services to, or monitoring the behavior of, data subjects in Norway; Svalbard and Jan Mayen by regulation.

• Section 5, children's consent

The age of consent under Article 6(1)(a) for the information society services in Article 8(1) is 13 years.

• Section 12, national identity numbers

National identity numbers and other unique identifiers may be processed only where there is a legitimate need for definite identification and the method is necessary to achieve it.

• Sections 8 to 11, research, archiving and statistics

Processing under Article 6(1)(e) with Article 89(1) safeguards; special categories without consent where the public interest clearly outweighs the disadvantage, after consulting the data protection officer; the same consultation for consent-based research and for criminal-conviction data.

• Section 16, exceptions from information and access

Six grounds for withholding information under Articles 13 to 15, written reasons with a precise legal basis, and relief from Article 34 breach communication where it would reveal protected information.

• Sections 20 to 22, supervision and appeals

Datatilsynet as the Article 51 authority with Article 58 powers; an annual report to the King and the Storting; the Privacy Appeals Board of seven members appointed for four years.

• Sections 26 to 30, sanctions

Article 83(4) fines extended to Articles 10 and 24 and to public authorities; a four-week payment deadline with full court review; a five-year limitation period; coercive fines per day; damages for non-economic loss under Article 82.

What does it cover?

The Act applies to every controller and processor with an establishment in Norway, public bodies included, and to controllers outside the EEA whose processing targets or monitors people in Norway (Section 4). It covers automated processing and filing systems and excludes purely personal or household activity and the administration-of-justice acts (Section 2). Media covered by the Media Liability Act, and other journalistic, academic, artistic or literary processing, are subject only to the provisions that Section 3 says can never be excepted. Public authorities are expressly within the fining regime (Section 26), and the Act extends to Svalbard and Jan Mayen only where regulations say so.

What are its objectives?

The Act's purposes follow from what its chapters do:

Give the GDPR the force of Norwegian law through the EEA Agreement, with precedence over conflicting statutes (Sections 1 and 2).

Fix the national choices the GDPR leaves to member states, including the age of consent, employment data, research and identity numbers (Chapter 3).

Balance data protection against freedom of expression and the exceptions that national security, crime prevention and health require (Sections 3 and 16).

Establish an independent supervisory authority and an independent appeals board (Chapter 6).

Provide sanctions, coercive fines, limitation periods and damages so the rules can be enforced (Chapter 7).

Framework in Context

The Personal Data Act is Norway's implementing act for the EU General Data Protection Regulation, which reached Norway through the EEA Agreement rather than EU membership; the GDPR articles it cites, including Articles 6, 8, 9, 10, 24, 32 to 35, 37, 51, 56, 58, 82, 83 and 89, are read together with the Act's sections. It replaced the Personal Data Act of April 14, 2000 No. 31 on July 20, 2018, and has been amended since, most recently by LOV-2021-06-18-124 in force January 1, 2022. The Ministry of Justice and Public Security is the responsible ministry; Datatilsynet supervises and the Privacy Appeals Board decides appeals.

Common Framework Mappings

Because the Act applies the GDPR, organizations usually map it alongside the privacy laws and management standards they already follow, so one set of records of processing, assessments and controls serves several regimes.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

ISO 27701

NIST Privacy Framework v1.0

UK DPA 2018

UK GDPR