Logo and page links

Main menu

Transfer of personal data to other countries

Section 6-1. The EU Commission's decisions concerning the level of protection in third countries

The Commission's decisions pursuant to Directive 95/46/EF, Articles 25 and 26, cf. 31, shall also apply to Norway in accordance with the EEA Joint Committee's Decision No. 83/1999 (of 25 June 1999 regarding the amendment of Protocol 37 and Annex XI of the EEA Agreement), unless the right of reservation is exercised.

The Data Protection Authority shall ensure compliance with the decisions.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), 24 April 2008 No. 396 (ratification).

Section 6-2. The Data Protection Authority's assessment of the level of protection in third countries

If the Data Protection Authority concludes that a third country does not have an adequate level of protection for the processing of personal data, the Data Protection Authority shall notify the EU Commission and the other member states of its decision.

If the Data Protection Authority, after assessing a specific case pursuant to Directive 95/46/EF, Article 26, no. 2, nevertheless permits the transfer of personal data to a third country that does not ensure an adequate level of protection pursuant to Directive 95/46/EF, Article 25, no. 2, the Data Protection Authority shall notify the EU Commission and other member states of its decision.

If the Commission or other member states object to the Data Protection Authority's decisions pursuant to the second paragraph, and the Commission takes steps, the Data Protection Authority shall ensure compliance with the decision.

Amended by the Regulations of 23 December 2003 No. 1798 (in force from 1 January 2004), 24 April 2008 No. 396 (ratification).

Section 6-3.Obligation to give notification of transfer of personal data to data processors in third countries

Transfer of personal data to third countries that do not have an adequate level of protection may take place without prior approval from the Data Protection Authority pursuant to Section 30, second paragraph, of the Personal Data Act, provided that the recipient of the information is a data processor and the basis for the transfer is the EU's standard contract as incorporated into the Committee's Decision 2010/87/EU dated 5 February 2010. The data controller shall notify the Data Protection Authority of the transfer by submitting a completed and signed standard contract. The transfer may take place once the notification has been submitted.

Third countries shall mean all countries that have not implemented Directive 95/46/EF nor been approved through a decision made by the EU Commission, cf. Section 6-1.

Repealed 1 January 2004 by the Regulations of 23 December 2003 No. 1798, cf. the Regulations of 24 April 2008 No. 396. Added by the Regulations of 24 April 2014 No. 569 (in force from 1 July 2014).