NorwayPersonal Data Act, Automated Decisions in Norway
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Art. 22
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Norway, under the incorporated General Data Protection Regulation (GDPR) Article 22.
What this law does
The Personal Data Act (§ 1) makes Regulation (EU) 2016/679, as incorporated into the EEA Agreement, law in Norway, and adds no rule of its own on automated decisions.
General Data Protection Regulation (GDPR) Article 22 gives a person in Norway the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.