New Personal Data Act Proposal
On 23 March, the Norwegian Ministry of Justice presented draft legislation for the processing of personal data (Personal Data Act) and for consent to join an EEA Joint Committee decision regarding the incorporation of Regulation (EU) No. 2016/679 (General Data Protection Regulation) into the EEA Agreement. The draft legislation may be read here (in Norwegian): https://www.regjeringen.no/no/dokumenter/prop.-56-ls-20172018/id2594627/
The Ministry proposes that the regulation turns into Norwegian law by incorporation, see Section 1 of the proposal. The incorporation means that the regulation, with adjustments agreed upon during incorporation into the EEA Agreement, enters into force as Norwegian law without revisions. After the hearing, a few minor adjustments were made to the translation. For example, we noted that the previously proposed term "personvernrådgiver" was replaced by "personvernombud" (Data Protection Officer).
Furthermore, the proposal suggests changes to certain related laws, such as the Working Environment Act, to provide authority for regulations about camera surveillance in the workplace and the employer's access to employees' e-mail, etc. In addition, there are proposed adaptations within health legislation and new provisions in the Roads Act on the handling of personal data. A continuation of the police's authority pursuant to the current Data Privacy Act and the Police Act to combat crime through CCTV surveillance, is part of the proposal.
The proposal has been presented to the Storting (parliament), which sends it to the relevant technical committee before final processing by the entire Storting.
Questions were raised previously regarding whether the new law may be adopted before the regulation enters into force in the EU states on 25 May 2018. The proposal indicates that the goal is to put the law into force on 25 May 2018 or shortly thereafter. The proposed new law was submitted before the deadline, enabling processing during the spring sitting. The deadline is 10 April 2018. Everything suggests, therefore, that the Storting will adopt a new Personal Data Act before summer and perhaps before 25 May 2018.