Law note · Norway
Personal Data Act (personopplysningsloven)
Norway is not an EU member; General Data Protection Regulation (GDPR) reaches Norway through the EEA Agreement, incorporated by Norway's own Personal Data Act (personopplysningsloven), not as directly applicable EU law. Read directly from lovdata.no, the Act's introductory text states the Regulation is thus part of the Personal Data Act and applies as Norwegian law, and the GDPR text is incorporated in full as part of the Act's own published text.
Chapter 3, read directly, sets the digital age of consent for information society services at 13 (Section 5), governs national identity number (fodselsnummer) processing (Section 12), and permits limited public-authority data sharing to combat workplace crime while preserving GDPR Article 9 protection for sensitive data (Section 12a). Datatilsynet is the supervisory authority, institutionally distinct from Denmark's identically named authority.
What it asks of an app
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Norway, including data collected by crawling.
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Personal Data Act Section 5.
- Ground the processing of a Norwegian national identity number (fodselsnummer) or other unique identifier on a legitimate need for secure identification, under Personal Data Act Section 12.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Lovdata.no official consolidated-law database, fetched and read directly