GDPR in Norway – Personal Data Act
However Norway is a member of the European Economic Area (EEA) and gets GDPR in place anyway. Norway published the Personal Data Act for implementing GDPR in Norway recently (see “Implementing GDPR in Norway” by Wikborg Rein). The Ministry of Justice and Public Security has proposed that GDPR should be incorporated into Norwegian law via a reference clause (c.f. EØS-notat, 24 March 2017). This means that a clause in the main text of the law will incorporate the GDPR into Norwegian law, with the GDPR text being then reproduced as an appendix to such law. In this process Norway used the options provided by and and GDPR Article 88 to keep some of the existing regulations whilst applying GDPR.
Changes for GDPR in Norway by the Personal Data Act
Penalties similar to GDPR Article 83 will be implemented.
Sensitive dataThe use of “sensitive data” (see) will be prohibited, unless the data inspectorate may authorize the processing of sensitive personal data for the public benefit.
Personal ID numbersID numbers of physical persons and other national identification numbers may only be used where there are reasonable grounds that require proper identification and the use of personal ID numbers is necessary for such identification (like before GDPR).
Age limit for consentThe minimum age for giving consent to society for using information about you is set at the age of 13 (like Sweden and Denmark).
One-stop-shopA data controller who is active in multiple EU countries may use the supervisory authority in the country where they have their main establishment for all personal data matters in the EU and EEA. Same is true for data controllers processing Norwegian personal data where the controller is established in another EU/EEA state.
Surveillance camerasThere is a separate regulation on the use of surveillance cameras (CCTV) in the workplace and the use of dummy surveillance equipment. However, Norway plans to replace the detailed regulation on the use of surveillance cameras.
Credit informationThe Ministry plans to change the rules on credit information at a later point.
Employer access to email and other electronic filesThe specific Norwegian regulation on restrictions for employers’ access to emails and other electronic files used by employees on supplied hardware and systems will remain in place, with some minor adjustments.