Norway

General Data Protection Regulation (GDPR) Articles 33-34, incorporated as Norwegian law through the Personal Data Act: a controller must notify Datatilsynet within 72 hours of becoming aware of a breach unless the breach is unlikely to result in a risk to natural persons, and must notify affected individuals without undue delay for a breach likely to result in a high risk. Chapter 3 adds no Norway-specific narrowing.

Norway is not an EU member; General Data Protection Regulation (GDPR) reaches Norway through the EEA Agreement, incorporated by Norway's own Personal Data Act (personopplysningsloven), not as directly applicable EU law. Drawn from lovdata.no, the Act's introductory text states the Regulation is thus part of the Personal Data Act and applies as Norwegian law, and the GDPR text is incorporated in full as part of the Act's own published text.

Chapter 3 sets the digital age of consent for information society services at 13 (Section 5), governs national identity number (fodselsnummer) processing (Section 12), and permits limited public-authority data sharing to combat workplace crime while preserving GDPR Article 9 protection for sensitive data (Section 12a). Datatilsynet is the supervisory authority, institutionally distinct from Denmark's identically named authority.

Transfers within the EEA, including to EU member states, are unrestricted; the restriction applies to transfers to third countries outside the EEA. General Data Protection Regulation (GDPR) Chapter V, incorporated as Norwegian law through the Act, permits such a transfer only on an adequacy decision, appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Chapter 3 contains no Norway-specific provision narrowing or broadening this beyond the incorporated GDPR text.

General Data Protection Regulation (GDPR) Articles 15 to 21, incorporated as Norwegian law through the Personal Data Act: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller. Article 22 gives a qualified right against a decision based solely on automated processing with legal or similarly significant effect. Chapter 3 adds no Norway-specific narrowing of these rights.

Unlike Denmark, Norway's Datatilsynet imposes administrative fines directly rather than routing them through the criminal courts.

Chapter 7 of the Act: Section 26 lets Datatilsynet impose administrative fines under General Data Protection Regulation (GDPR) Article 83; Section 27 gives a four-week compliance deadline from a final fine decision, with court review available; Section 28 sets a five-year limitation period from when the violation ceased; Section 29 lets Datatilsynet impose a daily coercive fine for continued non-compliance; and Section 30 cross-references GDPR Article 82, letting a liable party also be ordered to pay compensation for non-economic harm.

Section 26's fining power is stated in terms of public authorities; whether the same or a separate mechanism reaches private controllers is not confirmed against Section 26's exact Norwegian text.

General Data Protection Regulation (GDPR) Article 9(1), incorporated as Norwegian law through the Personal Data Act, classifies biometric data processed for unique identification as a special category. Chapter 3 of the Act contains no biometric-specific provision and no enumeration of biometric examples, so the special category here is the incorporated GDPR one without Norwegian elaboration.

Section 204 punishes, with a fine or imprisonment of up to two years, a person who gains access to a computer system or part of it by breaching a protection measure or by another unauthorised method. The provision sits in Chapter 21 (Protection of Information and the Exchange of Information), added to the Penal Code by the Act of 19 June 2009 No. 74.

Because the offence's trigger is breaching a protection measure, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Section 24 gives the producer of a database, such as a form, catalogue, table, program or similar work resulting from a substantial investment in collecting, checking or presenting its contents, an exclusive right to control extraction from or reuse of all or a substantial part of the database's contents, and this right applies correspondingly to repeated or systematic extraction or reuse of immaterial parts of the database that is harmful to its normal use or that unreasonably sets aside the producer's legitimate interests.

The right subsists for 15 years after expiry of the year the database was produced, or, if the database is published within that period, for 15 years after expiry of the year of first publication. The Act's own list of the EU/EEA directives it implements includes Directive 96/9/EC on the legal protection of databases, as amended, but does not include a text-and-data-mining exception.

Section 29 permits quotation from a published work in accordance with proper usage and to the extent required for the purpose, with no headline-length or short-extract cap distinct from that fair-practice test. Section 36 permits a work that forms part of a current event to be reproduced in media coverage of that event on the same fair-practice, purpose-justified terms.

It also permits a published work of art, photograph or film connected to but not part of the event to be reproduced on the same terms against remuneration, except where the work was created in the course of trade for the purpose of reproduction in the media.