Logo and page links

Main menu

Obligation to give notification and to obtain a licence

Section 7 -1. Obligation to obtain a licence for the processing of personal data in the telecommunications sector

Personal data processing by providers of telecommunication services for the purpose of customer administration, invoicing and the provision of services in connection with the subscriber's use of the telecommunications network shall be subject to licensing pursuant to the Personal Data Act.

For the purposes of these Regulations, the term "providers of telecommunication services" shall mean enterprises which for commercial purposes provide telecommunications wholly or partly by means of transmissions through the telecommunications network that are not broadcasts.

Is amended when the Ministry decides pursuant to the Regulations of 9 August 2013 No. 970.

Section 7-2. Obligation to obtain a licence for the processing of personal data in the insurance sector

Personal data processing by providers of insurance services (cf. the Act on Insurance Activity) for the purpose of customer administration, invoicing and the implementation of insurance contracts shall be subject to licensing pursuant to the Personal Data Act.

Amended by the Regulations of 9 August 2013 No. 970.

Section 7-3. Obligation to obtain a licence for the processing of personal data by banks and financial institutions

Personal data processing by banks and financial institutions (cf. the Norges Bank Act, the Norwegian State Housing Bank Act, the Savings Banks Act, the Commercial Banks Act, the Financial Institutions Act) for the purpose of customer administration, invoicing and the implementation of banking services shall be subject to licensing pursuant to the Personal Data Act.

Amended by the Regulations of 9 August 2013 No. 970.

Section 7-4. The authority of the Data Protection Authority

If special reasons so indicate, the Data Protection Authority may decide that personal data processing covered by sections 7-14 to 7-17 and sections 7-21 to 7-25 of these Regulations shall nevertheless be regulated by sections 31 or 33 of the Personal Data Act.

Amended by the Regulations of 24 April 2008 No. 396.

Section 7-5. Notification form

Notification to the Protection Authority shall be given on a form prepared by the Data Protection Authority and pursuant to rules for submission that have been drawn up by the Data Protection Authority.

II. Processing that is exempt from the obligation to give notification

Section 7-6. Exemption from the obligation to give notification

Processing covered by this chapter shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act. If sensitive data is processed, cf. section 2, subsection 8, of the Personal Data Act, the processing may be subject to licensing pursuant to section 33, first paragraph, of the Personal Data Act.

Exemption from the notification obligation presupposes that the personal data are processed in keeping with the purpose that follows from the individual provision. The provisions of the Personal Data Act regarding personal data processing in chapters I to V and VII to IX shall be complied with even if the processing is exempt from the obligation to give notification.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004). 24 April 2008 No. 396 (ratification).

Section 7-7. Customer, subscriber and supplier data

Processing of personal data concerning customers, subscribers and suppliers shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act. The same shall apply to data concerning a third person which is necessary for the fulfilment of contractual obligations.

Exemption from the notification obligation shall only apply if the personal data is processed as part of the administration and fulfilment of contractual obligations.

Section 7-8. Information relating to housing matters

The processing of personal data as part of the administration and fulfilment of obligations relating to the ownership or lease of real property shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act. This encompasses all leasing and ownership matters such as data relating to tenants in tenancy relationships, co-owners of jointly owned property and shareholders in housing cooperatives and housing cooperative stock corporations.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), 24 April 2008 No. 396 (ratification).

Section 7-9. Register of shareholders

Personal data processing as required by section 4-5 of the Limited Liability Companies Act and section 4-4 of the Public Limited Liability Companies Act shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act.

Exemption from the notification obligation shall only apply if the purpose of the processing is to fulfil the obligations imposed on the individual company by company legislation.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), 24 April 2008 No. 396 (ratification), 9 August 2013 No. 970, 19 August 2013 No. 1001.

Section 7-10. Keeping of mediation records

Personal data processing in connection with the keeping of mediation records as required by the Children Act and the Marriage Act shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act.

Exemption from the notification obligation shall only apply if the purpose of the processing is to verify that mediation has taken place, to evaluate and plan the mediation arrangement, or to provide a basis for statistical analyses.

Amended by the Regulations of 9 August 2013 No. 970.

Section 7-11. Activity logs in EDP systems or computer networks

Personal data processing as a consequence of the registration of activity (events) in an EDP system, and personal data processing relating to the use of system resources, shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act.

Exemption from the notification obligation shall only apply if the purpose of the processing is

a) to administer the system, or

b) to uncover/clarify breaches of security in the EDP system.

Personal data that are revealed as a result of processing pursuant to the second paragraph may not subsequently be processed in order to monitor or on the natural person.

Section 7-12. Data protection officer

The Data Protection Authority may consent to exemptions being granted from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act, if the data controller designates an independent data protection officer who is responsible for ensuring that the data controller complies with the Personal Data Act and associate Regulations. The data protection officer shall also maintain an overview of such data as are mentioned in section 32 of the Personal Data Act.

III. Processing that is exempt from the obligation to obtain a licence and the obligation to give notification

Section 7-13. Exemption from the obligation to obtain a licence and the obligation to give notification

Processing covered by this chapter shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph, of the said Act.

Exemption from the licensing obligation and the notification obligation presupposes that the personal data shall be processed in keeping with the purpose that follows from the individual provision. The provisions of the Personal Data Act regarding the processing of personal data in chapters I to V, and VII to IX, shall be complied with even if the processing is exempt from the licensing obligation and the notification obligation.

Section 7-14. Sensitive customer data

The processing of sensitive personal data, cf. section 2-8 of the Personal Data Act, relating to customers shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Act and from the obligation to give notification pursuant to section 31, first paragraph, of the Act.

Exemption from the licensing obligation and the notification obligation shall only apply if the data subject has consented to the registration and processing of the sensitive data, and the data are necessary for the fulfilment of a contractual obligation.

Personal data may only be processed as a necessary part of the administration and fulfilment of contractual obligations.

Section 7-15. Associations' membership data

Associations' processing of membership data shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph, of the Act.

As regards the processing of sensitive personal data, the exemption from the licensing obligation and the notification obligation shall only apply if the data subject has consented to the registration and processing of the sensitive data, and the data have a close and natural connection with membership of the association.

The personal data may only be processed as a necessary part of the administration of the association's activity.

Section 7-16. Personnel registers

Employers' processing of non-sensitive personal data relating to current or former employees, personnel, representatives, temporary manpower and applicants for a position shall be exempt from the obligation to give notification pursuant to section 31, first paragraph, of the Personal Data Act.

If sensitive personal data are processed, the processing shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act, but subject to the obligation to give notification pursuant to section 31, first paragraph of the Act. The exemption from the licensing obligation shall apply provided that:

a) the data subject has consented to the processing or the processing is laid down by law,

b) the data are related to the employment relationship,

c) the personal data are processed as part of the administration of personnel.

However, the obligation to give notification pursuant to the second paragraph shall not apply to the processing of

a) data concerning membership in trade unions as mentioned in section 2, subsection 8e of the Personal Data Act,

b) necessary data concerning absence and data that are subject to registration pursuant to section 5-1 of the Working Environment Act.

c) data that are necessary to adapt a work situation for health reasons.

Amended by the Regulations 23 December 2003 No. 1798 (in force 1 January 2004), 16 February 2006 No. 200, 24 April 2008 No. 396 (ratification), 9 August 2013 No. 970.

Section 7-17. Personal data relating to public representatives

The processing of personal data relating to the elected or appointed representatives of bodies established pursuant to the Local Government Act or the Church Act shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph of the Act.

The same shall apply to the processing of personal data relating to representatives of the Storting or to members of the Storting's standing committees.

Amended by the Regulations of 9 August 2013 No. 970.

Section 7-18. Processing of personal data by courts of justice

Personal data processing by courts of justice in connection with the activity of the courts (including registration procedures and notarial functions and the like that are carried out by a judge's office) shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph of the Act.

Section 7-19. Processing of personal data by supervisory authorities

The Data Protection Authority's processing of personal data pursuant to section 42 of the Personal Data Act shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph of the Act.

Records as mentioned in section 42, third paragraph, no. 1, of the Personal Data Act shall also contain information concerning the Data Protection Authority's personal data processing.

The first and second paragraphs shall apply correspondingly to the Privacy Appeals Board.

Section 7-20. Pupil and student data at schools and universities, etc.

The processing of personal data relating to pupils and students that is carried out pursuant to the Education Act or the Universities Act or with the consent of the individual pupil or the person responsible for the pupil shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph of the Act.

Added by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), cf. the Regulations of 24 April 2008 No. 396 (ratification), amended by the Regulations of 9 August 2013 No. 970.

Section 7-21. Information about children in kindergarten and supervised afternoon activities

The processing of personal data relating to children in kindergartens and day-care facilities for school children pursuant to the Kindergarten Act and the Education Act or with the consent of the person responsible for the child shall be exempt from the obligation to obtain a license pursuant to section 33, first paragraph, of the Personal Data Act and from the obligation to give notification pursuant to section 31, first paragraph of the Act.

Added by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), cf. the Regulations of 24 April 2008 No. 396 (ratification), amended by the Regulations of 9 August 2013 No. 970.

IV. Processing that is exempt from the obligation to obtain a licence, but subject to the obligation to give notification

Section 7-22. Exemptions from the obligation to obtain a licence

Processing covered by this chapter shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act. However, notification of the processing shall be given pursuant to section 31, first paragraph, of the Personal Data Act.

Exemption from the licensing obligation shall only apply if the personal data are processed in keeping with the purpose that follows from the individual provision. The provisions of the Personal Data Act regarding personal data processing in chapters I to V and VII to IX shall be complied with even if no licence is required.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-20), cf. the Regulations of 24 April 2008 No. 396.

Section 7-23.Client records

Personal data processing in connection with activities that are regulated by Chapter 11 of the Courts of Justice Act, regarding legal aid and lawyers, the Auditors Act, the Estate Agency Act and the Securities Trading Act shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act.

The exemption from the licensing obligation shall only apply for processing within the bounds of the legislation mentioned in the first paragraph.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-21), cf. the Regulations of 24 April 2008 No. 396 (ratification), 9 August 2013 No. 970.

Section 7-24. Records of money laundering and processing of associated personal data

Processing by entities with a reporting obligation of personal data for use in connection with the mandatory obligation to investigate and report pursuant to the Money Laundering Act, cf. the Regulations of 13 March 2009 No. 302 concerning measures to combat money laundering and the financing of terrorism, etc., shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act. The exemption shall only cover data that are revealed by the institution's investigations pursuant to the Money Laundering Act.

The exemption from the licensing obligation shall only apply if

a) processing is exclusively of data obtained from the institution's investigations under the Money Laundering Act, and

b) the personal data is processed for the purposes that follow from the Money Laundering Act and associated Regulations.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-22), cf. the Regulations of 24 April 2008 No. 396 (ratification), 9 August 2013 No. 970.

Section 7-25. Processing of patient records by healthcare personnel and social workers not subject to public authorisation or holding a licence

The processing of patient/client data by health or social welfare professionals who are not subject to official authorisation shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act.

Exemption from the licensing obligation shall only apply if the personal data are processed in connection with:

a) treatment and follow-up of individual patients, or

b) preparation of statistics.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-23), cf. the Regulations of 24 April 2008 No. 396.

Section 7-26. Processing of patient records by healthcare personnel subject to public authorisation or holding a licence

The processing of patient/client data by officially authorized health professionals and health professionals who have been granted a licence, cf. sections 48 and 49 of the Health Personnel Act shall be exempt from the obligation to obtain a licence pursuant to section 33, first paragraph, of the Personal Data Act.

Exemption from the licensing obligation shall only apply if the personal data are processed in connection with:

a) treatment and follow-up of individual patients,

b) work as an appointed expert, or

c) preparation of statistics.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-24), cf. the Regulations of 24 April 2008 No. 396, 9 August 2013 No. 970.

Section 7-27. Research projects

Personal data processing in connection with a research project is exempt from the obligation to obtain a licence pursuant to Section 33, first paragraph, of the Personal Data Act if the project is recommended by a data protection officer. If the project includes medical and healthcare research, it must also be recommended by a regional research ethics committee.

Research projects of a large scope and long duration, as well as research on large data sets that have not been pseudonymised or de-identified in some other secure manner, are not exempted. The exemption covers only analyses of non-participation (analyses of the distribution of education, income, benefits, etc. among participating and non-participating persons to determine the significance of the non-participation) to the extent these are based on consent.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004, formerly section 7-25), 6 May 2005 No. 408 (in force from 1 July 2005), 24 April 2008 No. 396 (ratification).