Personal data may pursuant to the Norwegian Personal Data Act (“PDA”) section 29 only be transferred to countries which ensure an adequate level of protection of the data. There are, however, several exceptions from this point of departure, cf. the PDA section 30.
One of the most practical exceptions is use of the EU Model Clauses. There are two types of Model Clauses which respectively regulates transfers to a new controller (“C2C Model Clauses”) and transfers to processors (“C2P Model Clauses”). According to the PDA section 30 second paragraph and the Norwegian Data Protection Authority’s (“DPA”) practice, transfers of personal data based on C2C Model Clauses and C2P Model Clauses must be approved by the DPA prior to the transfer. After the DPA has been provided with a copy of the signed Model Clauses, it will usually take one to three months before it comes to a decision.
The Norvegian Ministry of Local Government and Modernisation (“MLGM”) has in a recent consultation paper proposed that the requirement regarding prior approval no longer shall apply to the C2P Model Clauses. For transfers regulated by the C2P Model Clauses it will be sufficient to send a copy of the signed agreement to the DPA. It will no longer be necessary to await the DPA’s approval and the transfer of personal data may therefore take place immediately after the C2P Model Clauses have been sent to the DPA. The prior approval requirement will, however, still apply to the C2C Model Clauses.
The suggested amendment to the PDR will not only simplify transfer of personal data to processors established outside the EEA, but it will also release the DPA from an administrative burden. The MLGM has indicated that the amendment of the PDR probably will enter into force on 1 July 2014.