NorwayPersonal Data Act, Data Subject Rights in Norway
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Norway within one month of receipt.
These lines are LexLint's reading of the law's text. Also read by: Personvernnemnda (Privacy Appeals Board), which decides appeals against Datatilsynet’s decisions under section 22 of the Personal Data Act (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.personvernnemnda.no/avgjorelser/pvn-2024-25
- Guidance body
- Personvernnemnda (Privacy Appeals Board), which decides appeals against Datatilsynet’s decisions under section 22 of the Personal Data Act
- Open questions
- When is it 'nødvendig å nekte innsyn for å sikre forsvarlige interne avgjørelsesprosesser' (necessary to refuse access in order to ensure sound internal decision processes) under § 16 first paragraph, letter e of the Personal Data Act, which removes such information from the right of access under Article 15 of the GDPR?
What it makes you log
Logging duty
Articles 12 to 21 of the Regulation, which section 1 makes law in Norway, and sections 16 and 17 of the Act set out what a person may ask the controller for and when the controller may refuse. They ask for no log or record. Section 16(3) requires a controller that refuses access under section 16(1) to give the person written reasons and a precise reference to the exception; that is a notice to the person, not a record the controller keeps. Article 12(5) puts on the controller the burden of demonstrating that a request it refuses or charges for is manifestly unfounded or excessive; that allocates proof when a refusal is challenged and asks for no record to be kept. The Act's territorial clause, section 4, sits outside the provisions this instrument cites, so no jurisdiction hook is stated.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Articles 12 to 21, incorporated as Norwegian law through the Personal Data Act: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller.
Section 16(1) of the Act excludes from the Article 13 to 15 rights to information and access the information described in letters a to f. Letter a covers information that matters to Norway's foreign-policy, defence or security interests and that the controller may withhold under sections 20 or 21 of the Freedom of Information Act. Letter b covers information that must be kept secret to prevent, investigate, detect or prosecute offences.
Letter c covers information it would be inadvisable for the person to learn, because of their health or their relationship with people close to them. Letter d covers information subject to a duty of confidentiality set by or under a law. Letter e covers information that exists only in text prepared for internal case preparation and not given to others, so far as refusing access is necessary to ensure sound internal decision processes.
Letter f covers information whose disclosure would conflict with obvious and fundamental private or public interests.
Section 17(1) of the Act disapplies the Article 15 right of access for processing for archiving in the public interest, scientific or historical research or statistical purposes carried out in accordance with Article 89(1) of the Regulation, so far as giving access would take a disproportionate effort or would probably make the aims of the processing impossible or seriously impair them.
Section 17(2) disapplies the Article 16 and 18 rights to rectification and restriction for the same processing, so far as they would probably make the aims impossible or seriously impair them. Section 17(3) provides that neither exclusion applies where the processing has legal effects or direct factual effects for the person.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .