© The author(s), 2012 | Licensed to the Surveillance Studies Network under a Creative Commons Attribution Non-Commercial No Derivatives license.

The growing impact of information and communication technologies has resulted in the establishment of data protection authorities across Europe. Despite the role of these bodies as enforcers of privacy and data protection legislation, Surveillance Studies has so far offered little attention to their role in resistance. Based on a critical socio-legal examination of the Norwegian Data Inspectorate, the focus of this article is on the role of data protection authorities in resisting surveillance and threats to privacy and data protection. More specifically, the article asks what power the Norwegian Data Inspectorate has to achieve genuine resistance, and how its institutional structure affects this capability. Through a three-pronged analysis consisting of (i) institutional mapping, (ii) a typology of resistance strategies, and (iii) a review of its role in the Norwegian public debate on the EU Data Retention Directive, the article addresses the fundamental tension inherent in the Norwegian Data Inspectorate as a privacy-advocating ombudsman and an administrative body. As such, the research shows how, and to what extent, its institutional structure both strengthens and limits its possibilities for resistance. The growing impact of information and communication technologies has resulted in the establishment of data protection authorities across Europe. According to Article 28 in the EU Directive 95/46/EC, each member state within the European Economic Area (EEA) shall provide one or more public supervisory authorities endowed with investigative powers, effective powers of intervention, and the power to engag