Exercising Access Rights in Norway

The main legal instrument that translates the Data Protection Directive (DPD) in Norway is the Personal Data Act (PDA), which is complemented by the Personal Data Regulations (PDR), both of 2000. In terms of data protection principles and key definitions, the PDA can be considered substantially in line with the EU framework. Norwegian data protection legislation can be even considered more advanced in specific fields, for example when it comes to the “use of personal profiles” and of “automatic decisions” (cf. Sections 21 and 22 PDA). The right to access data (innsynsrett, in Norwegian) is largely mirrored in Section 18 PDA (among many), and it is partially granted not only to data subjects but also to “any person” (cf. the wording of Art. 12(a) DPD). ‘On the books’, Norwegian legislation provides for a rather comprehensive right of data access. The main provision is Section 18 of the Personal Data Act (PDA), which provides for both a sort of ‘general’ right of access to “any person” and an ‘individual’ right of access to information. Beyond Section 18 PDA, data access rights are also reinforced, inter alia, by Section 22 PDA concerning automated decision making, Section 27 PDA concerning data rectification, Section 28 on data minimization, and Sections 16 and 17 PDA imposing time-limits of the data controllers’ responses and establishing that no payment should be asked from the data subject. There is little case law concerning data access at judicial level. The most relevant cases may be found at an administrative level, in the rare cases brought to, and decided by, the Privacy Appeals Board (Personvernnemnda, a Norwegian sui generis institution). This seems to indicate that data access is not a right and a practice that triggers litigation in Norway. No publicly available codes of conduct have been devised so far. There is also no available common template to submit a data access request, with the notable exception of a template to access data from employers, designed and put at disposal by the Data Protection Authority (Datatilsynet, the Norwegian DPA). While the promotion of data access is not among the statutory key functions of the DPA, the Datatilsynet provides some practical information about the rationale and the scope of this right on its website. Regarding the practical reality of exercising one’s right of access in Norway, we conclude with the following observations: The average approach of public agencies is one of denial, or at least lacking facilitation. Staff seemed to be uninformed about data protection regulation, and either hesitant or lacking appropriate information about the data controller. The public agencies categorized under the domain of security imply a rather time consuming and bureaucratic procedure for identifying the specific information about the data controller. This is due to the fact that ‘the police’ are mentioned as the general data controller, in which no detailed information is given about the office or entity particular to each respective case. The average approach of private agencies was, with the notable exceptions of CCTV and internet-based site, much more facilitating. The staff seemed more prepared to answer questions concerning data protection and could provide information about the data controller