New and modified rules regarding transfer and personal data to countries outside EU/EEA

The new provision provides for an exception to the general rule in the Norwegian Personal Data Act, section 30, which establishes a duty to obtain consent from the Norwegian Data Inspectorate before personal data are to be transferred to data processors in third countries.

After the amendment, the system of prior approval from the Data Inspectorate is replaced by a duty to notify. A company may use the EU standard contract for transmission to data processors in third countries as the legal basis for the transfer. The controller must send a copy of the signed transfer agreement to the Data Inspectorate. Once the agreement is signed and submitted, personal data may be transmitted.

In practice, the amendment lowers the threshold of use of data processors in third countries. At the same time the data subject’s contractual protections remain unaffected.

Note that the change only covers transfer of personal data to data processors. Transfer to another controller must still follow the main rule of obtaining consent from the Data Inspectorate.