Norway Publishes Consultation Notes on Draft Personal Data Act

Norway has published consultation notes on a new draft Personal Data Act (the Act) designed to implement the principles of the EU General Data Protection Regulation (GDPR). In addition to translating the text of the GDPR into Norwegian, the Act also takes advantage of multiple derogations and special conditions in the GDPR, in an effort to retain certain aspects of Norway’s current data protection law.


The GDPR allows member states flexibility in certain areas to further specify the GDPR’s application. As a result, local variations among member states will still exist regardless of the GDPR’s goals for harmonisation. The GDPR is set to go into effect on May 25, 2018.

Notable Variation

Here are some notable areas of variation from the GDPR that would exist according to the consultation notes:

  • A proposed “Data Inspectorate” would be able to authorise the processing of special categories of personal data for uses in the public interest. The GDPR has a general prohibition on the processing of this data, unless a specific exemption applies.
  • The processing of personal ID numbers would only be allowed where proper identification of an individual is reasonably required and the use of personal ID numbers is necessary to achieve the identification.
  • The age at which parental consent will be required for the processing of the personal data of children in relation to information society services would be lowered to 13 years. The GDPR sets the default age at 16 years.
  • Data protection officers (DPOs) would have added confidentiality obligations when working with their controllers.
  • Controllers would be able to use their lead supervisory authority in the EU as a “one-stop shop” for all privacy-related matters in the EU and EEA, including matters concerning the personal data of Norwegians.

Ultimately, companies will need to take note of these local variations, in addition to the GDPR itself, as they ready their compliance efforts. As always, OneTrust will continue to track these developments as they become available.