Section 1.Purpose of the Act

The purpose of the Act is to promote the effective performance of the functions of the police and the prosecuting authority, the protection of privacy and predictability for individuals in connection with the processing of data.

Section 2.Definitions

For the purposes of this Act, the following definitions apply:

Section 3.The scope of the Act

This Act applies to the processing of data by the police and the prosecuting authority, except for the processing of data which

The public administration activities of the Police Security Service nevertheless fall within the scope of the Act.

The Act applies to the electronic processing of data, and to the manual processing of data when the latter form part of a database or are intended to form part of a database.

For data regarding objects, chapter 4 and the provisions on the duty of confidentiality apply insofar as the data fall within the scope of section 23.

This Act also applies to Svalbard, Jan Mayen and the Norwegian dependencies, with such amendments as are prescribed by the King to take account of local conditions.

Section 4.Specificity of purpose

Data may be processed for the purpose for which they are collected or for other police purposes, unless it is provided by statute or in pursuance of statute that the right to process data is limited, or that the data may be processed for purposes other than police purposes.

Section 5.The requirement of necessity

Data may only be processed when this is necessary for such purposes as are mentioned in section 4. Moreover, the following limitations apply:

Section 6.Requirements regarding the quality of data

Data that are processed shall

Unverified data may be processed if necessary for the purpose of the processing.

When data are processed it shall, as far as possible, and if relevant, be indicated to which category of persons the data subject belongs, for instance whether the subject is convicted, a suspect, an aggrieved party or a witness, has reported a crime or has a connection with such persons. Correspondingly, it shall, as far as possible, be indicated whether data are based on facts or assessments. In addition, data processed under section 5 sub-section 2 shall be marked to indicate the reliability of the source and the validity of the data.

In the context of a police investigation, the keeping of a police log and similar operations, the requirement in the first paragraph, sub-paragraph 2, regarding the accuracy of data, means that the data shall be reported as they were provided by the source. The requirement in the first paragraph, sub-paragraph 2, that the data shall be up-to-date, means, for the investigation, that the data shall as far as possible be updated before being used as evidence.

Section 7.Processing of special categories of personal data

The processing of personal data which reveal racial or ethnic origin, political, religious or philosophical beliefs, or trade union membership, and the processing of genetic and biometric data to uniquely identify a natural person, or data concerning health, sex life or sexual orientation shall only take place if strictly necessary for the purpose of the processing. Such data may also be processed if strictly necessary to protect the vital interests of the data subject or another person.

Section 8.Time-limited exemption from the requirements of specificity of purpose, necessity and relevance

Data may in any case be processed for 4 months if necessary in order to ascertain whether the requirements in section 4, section 5, sub-sections 1 and 2, and section 6, first paragraph, sub-paragraph 1, are satisfied.

The data shall be checked as soon as possible, to ensure that they are either erased or processed on a legal basis other than section 8. As part of such checking, the data may be made known to other employees of the police or the prosecuting authority. The data may also be disclosed to others if this is strictly necessary for the purpose of checking.

The time limit shall not apply to the processing of data in individual criminal cases.

Section 9.Sanctions database

The police shall keep a sanctions database containing data relating to natural or legal persons who have been the subject of a penalty or other criminal sanctions or other measures as a result of a criminal offence. Identity details, sanctions and measures shall be registered. The duty of confidentiality in section 23 does not preclude the use of the data in the database in criminal statistics. The King makes regulations containing more details on the registration of foreign sanctions and measures.

Section 10.Police log

The police shall keep databases that provide a continuous, 24-hour overview of all significant data relating to the organisation and performance of police services at the site in question. The database may be used for police, public administration and police administration purposes.

Section 11.Criminal intelligence databases

The police may keep criminal intelligence databases, provided that the conditions of section 5, sub-section 2, and the other conditions of the Act are satisfied.

Section 12.DNA database

The police shall keep a DNA database consisting of a convicted offenders database, a known suspects database and a crime-scene samples database.

Are eligible for registration in the convicted offenders database persons who

All DNA profiles produced from biological material obtained pursuant to section 158, first paragraph, of the Criminal Procedure Act shall be registered in the known suspects database. As soon as the police have made a decision regarding registration in the convicted offenders database, the DNA profile of the person concerned shall be transferred from the known suspects database to the convicted offenders database.

Data relating to persons of unknown identity may be registered in the crime-scene samples database when the data are assumed to be connected with an unsolved criminal case.

The police may keep an elimination database. Data collected pursuant to section 158, second paragraph, of the Criminal Procedure Act relating to employees of the police, analysis institutions and other persons of known identity who regularly come into contact with crime scenes and evidence may be recorded in the elimination database.

The data in the database shall only be used for criminal justice purposes. The King may nevertheless make regulations providing that the data may also be used for research purposes and may make more detailed rules on such use.

The King will make regulations containing more detailed provisions on DNA registration, such as rules regarding registration in the convicted offenders database, the known suspects database and the crime-scene samples database, regarding the keeping and use of the databases, regarding searches of the databases and regarding retention of DNA profiles.

Section 13.Fingerprint and photo database

The police shall keep a database of fingerprints and photographs that have been collected in accordance with section 160 of the Criminal Procedure Act and the provisions of the Prosecution Regulations.

The police may keep a database of fingerprints of police employees who may come into contact with crime scenes or evidence.

Section 14.Requirement to establish databases by means of regulations

Prior to the establishment of a central database, the King will make regulations specifying

The requirement to make regulations does not apply to the alignment of data from databases that are subject to the Police Databases Regulations if the processing follows the rules that apply to the source database.

Section 15.Data security

The controller and the processor shall by means of planned, systematic measures ensure satisfactory data security with regard to confidentiality, integrity and accessibility in connection with the processing of data.

To achieve satisfactory data security, the controller and the processor shall document the data system and the security measures. Such documentation shall be accessible to the staff of the controller and of the processor. The documentation shall also be accessible to the supervisory authorities.

Any controller who allows others to have access to data shall ensure that they satisfy the requirements of the first and second paragraphs.

Section 16.Internal control

The controller shall establish and maintain such planned and systematic measures as are necessary to meet the requirements laid down in or pursuant to this Act, including measures to ensure the quality of the data.

The controller shall document the measures. Such documentation shall be accessible to the staff of the controller and of the processor. The documentation shall also be accessible to the supervisory authorities.

Section 17.Requirement of trackability

The use of data shall be trackable.

Data regarding use of the system may be utilised to

Data regarding use of the system shall be recorded and stored for at least one year and erased after no more than three years.

Section 18.The processor's handling of personal data

No processor may process personal data otherwise than in the manner prescribed in a written agreement or instructions. Nor may the data be handed over to third parties for storage or manipulation without such agreement.

The agreement with the controller shall state that the processor has a duty to implement such security measures as are prescribed in section 15.

Any person who is employed by or performs a service or work for a processor, and who gains access to data that are subject to a duty of confidentiality under this Act, shall be subject to a duty of confidentiality under section 35. Such a duty shall be set out in the agreement with the controller. Any person who is employed by or performs a service or work for a processor may be required to submit an exhaustive, expanded police certificate of conduct. The processor is subject to a duty to state who has access to the confidential data.

Section 19.General provisions on the disclosure of data

The police and the prosecuting authority may disclose data if they are allowed to do so under the provisions on the duty of confidentiality in chapter 6, and the conditions governing disclosure laid down in section 8, second paragraph, and section 20 have been met for such data as are mentioned there.

Section 20.Special provisions on the disclosure of unverified data

As far as possible, data shall be verified before they are disclosed. The data shall preferably be disclosed in written form, and in such case shall be presented as unverified. If unverified data are disclosed orally, attention should be called to the fact that the data are unverified.

Unverified data may be disclosed if necessary for verification of the data.

In connection with disclosure of data for use in an individual criminal case and in connection with activities to avert and prevent criminal offences, see sections 26 and 27, only the first paragraph, second sentence, applies.

The provision in section 53 applies correspondingly.

Section 21.Access to data within the police and the prosecuting authority

Employees of the police and the prosecuting authority may be granted access (the right to make direct searches) to data, or data may otherwise be made available to them, to the extent that they have an official need for the data, and it is for purposes that fall within the scope of this Act.

Data which by their nature are sensitive, or which have been provided by someone with a special need for protection, or which are unverified, should be subject to special limitations on access.

Section 22.Disclosure of data to another country

Data may be disclosed to foreign authorities for such purposes as are mentioned in section 26. Data may also be disclosed to cooperating foreign police authorities and security and intelligence services in order to avert or prevent criminal offences or if disclosure is necessary in order to verify the data. The provisions of section 27, third and fifth paragraphs, apply correspondingly. Disclosure of data to countries not bound by Directive (EU) 2016/680 and to international organisations is also subject to the conditions laid down in regulations.

Moreover, data may be disclosed or otherwise made available to foreign authorities or international organisations when this is prescribed by statute or convention or an agreement that is binding on Norway, or by an agreement between Norwegian and other Nordic authorities.

Section 23.Scope of the duty of confidentiality

Any person who is employed by or performs a service or work for the police or the prosecuting authority is under a duty to prevent others from gaining access to or obtaining knowledge of anything that comes to his knowledge in connection with such service or work concerning

The duty of confidentiality also applies to data which it is necessary to keep secret in the interests of the investigation of the particular case, the interests of surveillance and intelligence activities or the interests of police operations and the organisation of such operations. The limitations to the duty of confidentiality in section 22 and sections 24 to 34 are only applicable insofar as appropriate.

The duty of confidentiality also applies after the person concerned has terminated his service or work. Moreover, he may not use such data as are mentioned in this section in his own business or in service or work for others.

The duty of confidentiality also applies to disclosure to other persons in the police and the prosecuting authority, unless section 21 is applicable.

With regard to the duty of confidentiality in connection with interception of communications, chapter 16a of the Criminal Procedure Act applies.

Section 24.The duty of confidentiality when there is no need for protection

The duty of confidentiality does not preclude the data

Section 25.The duty of confidentiality in relation to parties or the person whom the data concern, and to use in cases concerning compensation

The duty of confidentiality does not preclude the data in a case being made known to the parties to the case, to aggrieved parties or surviving relatives, or to their representatives, and otherwise to those whom the data directly concern.

Nor does the duty of confidentiality preclude the use of data in cases concerning compensation following criminal prosecution under chapter 31 of the Criminal Procedure Act.

This does not apply to data that may be detrimental to the police's efforts to prevent or detect criminal offences or maintain peace and order if they become known, unless otherwise prescribed by the provisions of the Criminal Procedure Act regarding access to documents.

Section 26.The duty of confidentiality in individual criminal cases

The duty of confidentiality does not preclude the use of data in an individual criminal case, including in connection with criminal investigation, case preparation, the decision on the case, implementation of the decision, follow-up and checks.

Section 27.The duty of confidentiality in connection with activities to avert and prevent criminal offences

The duty of confidentiality shall not preclude the police disclosing data if disclosure is necessary in order to avert the commission of a criminal offence.

Nor does the duty of confidentiality preclude the disclosure of data to

Disclosure must in any event be a proportionate measure in the situation in question, and particular importance shall be attached to whether the data are transmitted to a recipient who is subject to a duty of confidentiality, how the recipient can be expected to use the data and whether uncertainty attaches to the data due to their nature or source. If it is possible and appropriate to notify the data subject, this should be done before the data are disclosed.

Nor does the duty of confidentiality preclude the police disclosing data to other public bodies and institutions that are part of a crime-prevention cooperation mechanism when this is necessary in order to prevent crime. The provision of the third paragraph applies.

Decisions regarding disclosure of data under the second paragraph shall be made by the controller. The data shall preferably be disclosed in written form. The controller shall record which data are disclosed, to whom they are disclosed and the reason for their disclosure. If the data are unverified, this shall be specifically stated. The duty to record the disclosure also applies to the disclosure of data under the first paragraph.

Section 28.The duty of confidentiality in connection with the police's other tasks

The duty of confidentiality does not preclude the disclosure of data to public bodies and private bodies or individuals insofar as this is necessary for the performance of the activities of the uniformed service or the police's service and assistance functions.

The provisions of section 27, third paragraph, apply correspondingly.

Section 29.The duty of confidentiality in connection with disclosure of data for use in the police's public administration activities, etc.

The duty of confidentiality does not preclude the disclosure of data to other employees of the police or the prosecuting authority insofar as this is necessary for the exercise of the police's public administration activities and civil duties.

The King will make regulations containing more detailed provisions on the disclosure of data for use in the police's public administration activities and civil duties.

Section 30.The duty of confidentiality in connection with disclosure of data to public bodies in their interest

The duty of confidentiality does not preclude the disclosure of data to other public bodies in their interest, if this is necessary in order to promote the statutory tasks of the recipient body or to prevent it from conducting its activities in an improper manner.

The provisions of section 27, third paragraph, first sentence, and fifth paragraph, apply correspondingly.

The King will make regulations containing more detailed provisions on the disclosure of data to public bodies in their interest, including to whom the data shall be disclosed, which categories of data may be disclosed, the criteria that determine the necessity of disclosure, the duty of the controller under section 48 to inform the data subject and the data subject's right of access under section 49, first paragraph.

Section 31.The duty of confidentiality in connection with disclosure of data to private recipients in their interest

The duty of confidentiality does not preclude the disclosure of data to private recipients in their interest, if this is necessary in order to promote the recipient's statutory tasks or to prevent the improper conduct of activities.

The provisions of section 27, third paragraph, first sentence, and fifth paragraph, apply correspondingly.

The King will make regulations containing more detailed provisions on the disclosure of data to private recipients in their interest, including to whom data must be disclosed, which categories of data may be disclosed, the criteria that determine the necessity of disclosure, the duty of the controller under section 48 to inform the data subject and the data subject's right of access under section 49, first paragraph.

Section 32.The duty of confidentiality in connection with statistical processing, the preparation of reports and plans, etc.

The duty of confidentiality does not preclude the use of data for statistical processing, for the preparation of reports and plans or in connection with auditing or other forms of inspection.

Section 33.The duty of confidentiality in connection with research

When it is deemed reasonable and does not entail a disproportionate disadvantage to other interests, it may be decided that data in individual cases are to be disclosed for use in research, notwithstanding the duty of confidentiality in section 23.

In criminal cases, any decision under the first paragraph shall be made by the Director of Public Prosecutions and otherwise by the National Police Directorate, or by the Ministry of Justice in relation to data in cases handled by the Police Security Service.

The provisions of section 13d, second and third paragraphs, and section 13e of the Public Administration Act are applicable insofar as appropriate.

Section 34.The duty of confidentiality in connection with disclosure to the public of data in criminal cases

The duty of confidentiality mentioned in section 23, first paragraph, does not preclude the disclosure of data from a criminal case to the public, subject to the following conditions:

The King will make regulations containing more detailed provisions on the disclosure of data to the public in criminal cases.

Section 35.Imposition of a duty of confidentiality

The police or the prosecuting authority may impose a duty of confidentiality when someone receives data that are subject to a duty of confidentiality in connection with making a statement to or in any other way assisting the police or the prosecuting authority. The same applies when aggrieved parties, surviving relatives or their representatives receive data that are subject to a duty of confidentiality, see section 25, first paragraph.

The police or the prosecuting authority may impose on any person who performs a service or works for a state or municipal body a duty of confidentiality in respect of such data as are mentioned in section 23, second paragraph, when the body receives data that are subject to a duty of confidentiality under this Act.

A breach of the duty of confidentiality under the first and second paragraphs is punishable under section 209 of the Penal Code, provided that the person concerned has been warned that a breach may have such consequences. The authority concerned shall ensure that the duty of confidentiality and the threat of punishment are made known to those concerned, and may require a written declaration to the effect that they are aware of and will respect the rules.

Section 36.Criminal records checks

A criminal records check may only be carried out when it is authorised by statute or by regulations laid down pursuant to statute. The data disclosed through the check shall be provided in the following ways:

A requirement of up to 5 years' residence in Norway may be laid down by statute or regulations made pursuant to statute if, in connection with a criminal records check, no such police certificate of conduct as is mentioned in the first paragraph, sub-paragraph 1, can be presented, and significant public interests warrant doing so. The required period of residence may only exceed 5 years if this is warranted by significant security interests.

Section 37.Purposes that warrant use of a police certificate of conduct

A police certificate of conduct, see section 36, first paragraph, sub-paragraph 1, may only be used to exclude a natural or legal person from a position, occupation, activity or other function if

A police certificate of conduct may also be used if international legal obligations require documentation of such matters as are mentioned in section 36, first paragraph, sub-paragraph 1.

Section 38.Police certificate of conduct issued in special cases

A police certificate of conduct may be issued to a person who requires such a certificate for entry to, a visa for, a work permit for or settlement in another country, or for other purposes for which provisions in other countries require documentation regarding such matters as are mentioned in section 36, first paragraph, sub-paragraph 1. This applies correspondingly to a person who applies for employment at a foreign embassy or similar institution in Norway. The certificate may be exhaustive and expanded, see section 41, if this is deemed necessary and relevant based on the requirements set in the national legal provisions of the country in question.

The King may make regulations under this Act providing that a police certificate of conduct may be used in cases other than the cases provided for in this Act. The conditions in section 37 apply correspondingly.

Any person authorised by the King may decide that a police certificate of conduct may also be used in other special cases. Such decisions shall apply for a limited period of time not exceeding 15 months. The decision may not be renewed.

Section 39.Police certificate of conduct for persons who are to care for or perform tasks related to minors (childcare certificate of conduct)

In police certificates of conduct issued for the purposes mentioned in section 37, first paragraph, sub-paragraph 4, it shall be indicated whether the person has been charged or indicted, accepted a fine issued by the prosecuting authority or been convicted of contravention of sections 162, 192, 193, 194, 195, 196, 197, 199, section 200, second paragraph, section 201 first paragraph (c), sections 201 a, 203, 204 a, 219, 224, section 229 second and third penalty alternatives, sections 231, 233 or 268, see section 267, of the General Civil Penal Code of 1902, or sections 231, 232, 257, 258, 274, 275, 282, 283, 291, 293, 294, 295, 296, 299, 301, 302, 303, 304, 305, 306, 309, 310, 311, 312, 314, 327 or 328 of the Penal Code. Contravention of sections 192, 193, 194, 195, 196, 197, 199, section 200, second paragraph, section 201, first paragraph, (c), sections 201 a, 204 a or 233 of the General Civil Penal Code of 1902 or sections 275, 291, 293, 294, 295, 296, 299, 301, 302, 303, 304, 305, 306, 310, 311, 312 or 314 of the Penal Code shall be indicated in accordance with section 41, sub-section 1. Contravention of sections 162, 203, 219, 224, section 229, second and third penalty alternatives, sections 231 or 268, see section 267, of the General Civil Penal Code of 1902, or sections 231, 232, 257, 258, 274, 282, 283, 309, 327 or 328 of the Penal Code shall be indicated in accordance with section 40.

Special grounds must exist in order to introduce requirements in regulations made pursuant to other legislation specifying more or fewer penal provisions than those set out in the first paragraph.

A police certificate of conduct issued for the purposes mentioned in section 37, first paragraph, sub-paragraph 5, may be exhaustive and expanded, see section 41, if so prescribed by other legislation.

Section 40.Ordinary police certificate of conduct

Section 41.Exhaustive and expanded police certificate of conduct

Section 42.Indication of fewer data in police certificates of conduct

Any person so authorised by the King may decide that fewer data shall be indicated in the police certificate of conduct, as long as this is not incompatible with the purpose of the certificate.

Section 43.Disclosure of new or updated data after the police certificate of conduct has been issued

Significant new data may be disclosed to the user of a previously issued police certificate of conduct if the conditions for the issue of the certificate are still fulfilled. No data other than those specified in the legal basis for issuing the original certificate may be disclosed.

Any person who has requested the issue of a police certificate of conduct shall as soon as possible be notified that new data have been disclosed to the user. If there are no new data, the matter shall be concluded by notifying the user accordingly.

Section 44.Rules of procedure for the issue of a police certificate of conduct

A request for the issue of a police certificate of conduct must be submitted by the person whom the certificate concerns. The person must provide adequate proof of identity.

The person requesting such issue must document that he meets the conditions.

The police certificate of conduct shall be issued as soon as possible, and be sent to the person who has requested it.

Section 45.Conduct assessments

A conduct assessment shall indicate such sanctions as are mentioned in section 41, sub-section 1, unless otherwise provided by statute or by regulations made pursuant to statute.

The recipient may demand a conduct assessment without the consent of the person whom the assessment concerns. The provision in section 48, second paragraph, sub-paragraph 1, applies correspondingly.

The King will make regulations containing more detailed provisions on conduct assessments.

Section 46.Criminal record printouts

For use in an individual criminal case, the police, the prosecuting authority, the correctional services or the courts may submit a request for a criminal record printout relating to a person specified by name.

The criminal record printout shall indicate all penalties, other criminal sanctions and other measures resulting from criminal offences. Data relating to an enterprise may only be indicated in a printout concerning the enterprise.

Section 47.The duty of confidentiality of recipients of data in connection with a criminal records check

Any person who receives such data as are mentioned in sections 38 to 45 in connection with a criminal records check shall prevent unauthorised persons from gaining access to or knowledge of the data in the criminal records check.

A breach of the duty of confidentiality under the first paragraph is punishable under section 209 of the Penal Code, if the recipient of the data was informed that contravention could have such consequences.

Section 48.The duty to inform the data subject

The controller has a duty to inform the data subject that personal data has been disclosed to public bodies and private bodies or individuals in their interest, see sections 30 and 31.

However, the duty to inform the data subject shall not apply

Section 49.Access to information

In an individual criminal case, the data subject has a right of access to documents in accordance with the provisions of the Criminal Procedure Act.

Other than in an individual criminal case, the data subject has the right to be informed of which data relating to him have been recorded.

Both in an individual criminal case and generally, the data subject has the right to be informed of whether data relating to him have been disclosed, to whom they have been disclosed and which data have been disclosed.

Access to information under the second and third paragraphs may be refused if necessary in the interests of

Section 50.Erasure, restriction of processing and deposit of data that are no longer required for the purpose of the processing

Data shall not be stored any longer than is necessary for the purpose of the processing. The data shall be erased or restricted, unless they are to be retained in accordance with the Act of 4 December 1992 No. 126 relating to archives or other legislation.

The controller may, notwithstanding the first paragraph, store personal data for historical, statistical or scientific purposes, if the public interest in the data being stored clearly outweighs the disadvantages this may entail for the individual concerned. The data shall not be retained in ways that make it possible to identify the data subject any longer than necessary.

Data obtained through interception of communications which has not been used in the case shall be restricted when the case has been decided by final and enforceable judgment or final decision not to prosecute. Restricted data may be used in the event of a petition for reopening of a court case, the resumption of a criminal investigation, or to protect the legitimate interests of a person charged. Data which is not lawful to retain pursuant to the Criminal Procedure Act 216 g shall be erased as soon as possible. The provision applies correspondingly to data obtained pursuant to the Criminal Procedure Act sections 216 m and 216 o, and to data obtained pursuant to the Criminal Procedure Act sections 202 a and 202 c insofar as appropriate. The King will make regulations containing more detailed provisions on the erasure and use of restricted data from interception of communications.

Section 51.Rectification, restriction of processing and erasure of data that are inaccurate or deficient

The controller shall on his own initiative or upon request by the data subject rectify data that are deficient and, if possible or necessary, supplement or update them. Deficient data that obviously have no documentary value may be erased.

Data containing an error that cannot be rectified shall be restricted or erased. If there are grounds to believe that erasure could affect the legitimate interests of the data subject, the data shall be restricted.

Data that are restricted pursuant to this section may only be used if this is necessary in order to document which data were processed.

Section 52.Use of data that have been restricted

Data that have been restricted pursuant to sections 50 or 51 or on another basis may only be used for the purposes due to which the data were not erased. The King will make regulations containing more detailed provisions on the purposes for which restricted data may be used.

Section 53.The police's duty to act in the event of errors or deficiencies

If such deficient data as are mentioned in section 51 have been processed or other breaches of the Act have occurred, the controller shall as far as possible ensure that the error does not affect the data subject. If the data have been disclosed, the recipient of the data shall be notified of the error without undue delay and requested to rectify, erase or restrict the data in accordance with the legal basis of the recipient.

Section 54.Procedural rules for access, rectification, restriction of processing and erasure

Requests for access to and rectification, restriction of processing or erasure of data shall be submitted in writing to the police or the prosecuting authority. The request must specify the processing operations concerned. The person submitting the request must provide adequate proof of identity. The controller decides whether the request shall be complied with, and ensures that only the data relating to the person concerned are rectified, restricted, erased or accessed.

A response shall be given to the request as soon as possible, and within 30 days at the latest. If the request is complied with, the data shall be disclosed in writing, unless the King decides otherwise in respect of a particular processing operation.

If the request is rejected, grounds shall be given which do not reveal that data have been recorded.

Section 55.Right of appeal

The data subject or any person who believes himself to be a data subject may appeal decisions made pursuant to this Act to a superior body, including decisions on

Decisions made by the Director of Public Prosecutions may not be appealed. The provisions of chapter VI of the Public Administration Act apply in so far as they are appropriate.

The rights of the data subject under sections 59 and 68 are not affected by the provisions of this section.

The provision in section 54, last paragraph, applies accordingly.

Section 56.Compensation

The controller shall pay compensation for damage suffered as a result of data being processed contrary to provisions laid down in or pursuant to this Act, even if no one is to blame for the damage. In the event of breaches of the provisions on disclosure and the duty of confidentiality in sections 19 to 35, the general rules of compensation apply. The compensation shall be equivalent to the financial loss incurred by the injured party as a result of the unlawful processing of the data.

The compensation may be extended to such compensation for damage of a non-financial nature as seems reasonable, unless it is established that the damage is not due to an error or omission on the part of the controller.

When a claim is lodged after a person has been charged in a criminal case, the procedural rules of chapter 31 of the Criminal Procedure Act shall nevertheless apply in so far as they are appropriate and unless otherwise prescribed pursuant to this Act.

Section 57.Judicial remedies

The data subject may, without prejudice to the rights under section 55, first paragraph, and section 59, bring proceedings against the controller or the processor if the rights of the person concerned under the Act have been infringed as a result of the processing of the data relating to the person concerned.

The data subject may, without prejudice to the rights under section 60, third paragraph, bring proceedings against the Data Protection Authority when the Data Protection Authority has made a decision that is legally binding on the data subject. The same applies if the Data Protection Authority neglects to deal with a request for a processing check within 3 months, or neglects to give notice of the progress of the request or its outcome within 3 months.

Section 58.The supervisory powers of the Data Protection Authority

The Data Protection Authority shall supervise that the Act and regulations made pursuant to the Act are complied with, and that errors or deficiencies are rectified. This does not apply to data processed by the Police Security Service, which is subject to supervision by the Parliamentary Oversight Committee on Intelligence and Security Services pursuant to section 68 and the Act of 3 February 1995 No. 7 pertaining to oversight of intelligence and security services.

Section 59.Checks by the Data Protection Authority upon request by the data subject

The Data Protection Authority shall, upon request by the data subject, or any person who believes himself to be a data subject, check that the data relating to the person concerned have been processed in accordance with the Act and that the rules regarding access have been observed.

The provision in section 54, last paragraph, applies accordingly.

Section 60.The Data Protection Authority's corrective powers and administrative fines

The Data Protection Authority may issue an order to the controller to the effect that processing of data that is contrary to sections 15 or 16 must cease, or may set conditions that must be met in order for the processing to comply with these provisions. Moreover, in connection with the processing of data other than in individual criminal cases, the Data Protection Authority may issue an order to the controller to the effect that processing contrary to this Act must cease, or may set conditions that must be met in order for the processing to comply with the Act. The Data Protection Authority may nevertheless not issue orders regarding access to data which are exempt from the right of access under section 49, or issue orders regarding compliance with the provisions on disclosure and the duty of confidentiality in chapters 5 and 6 or criminal records checks in chapter 7.

The Data Protection Authority may issue a reprimand if it deems that the processing of data in connection with criminal cases is contrary to the Act. The same applies to such processing as is mentioned in the first paragraph, last sentence. Such a reprimand shall be communicated to the controller, and a copy shall be sent to the controller's superior body.

The Data Protection Authority's decisions pursuant to the first paragraph can be appealed to the Privacy Appeals Board.

In connection with orders under the first paragraph, the Data Protection Authority may impose an administrative fine to run each day after expiry of the deadline set for compliance with the order until such time as the order is complied with.

Section 61.Access

The Data Protection Authority and the Privacy Appeals Board may demand any data necessary to enable them to carry out their functions.

In connection with their functions under this Act, the Data Protection Authority and the Privacy Appeals Board may demand admittance to places where data are processed and where devices for such processing are located. The Data Protection Authority may carry out such tests and inspections as it deems necessary, and may demand such assistance from the personnel in such places as is necessary to carry out the tests or inspections.

The right to demand data or access to premises and devices pursuant to the first and second paragraphs is not limited by provisions relating to the duty of confidentiality.

Section 62.Duty of confidentiality and police certificate of conduct

Persons who as a result of inspection gain access to data that are subject to a duty of confidentiality under section 23 shall be subject to the same duty of confidentiality.

An exhaustive and expanded police certificate of conduct shall be required for persons who are to carry out supervision.

Section 63.Data protection officer

A data protection officer system shall be put in place.

The King will make regulations specifying the details of the system.

Section 64.The requirement of necessity for the Police Security Service

The Police Security Service may only process data when this is necessary for police purposes and administrative activities within the Service. Furthermore, the conditions in the second and third paragraphs must be met.

In individual criminal cases, data processing powers are governed by the provisions of the Criminal Procedure Act.

Other than in individual criminal cases, data may only be processed by the Police Security Service where

Section 65.Time-limited exemption from the requirements of specificity of purpose, necessity and relevance

Data may in any case be processed for 4 months if necessary in order to ascertain whether the requirements of section 4, section 64, third paragraph, and section 6, first paragraph, sub-paragraph 1, are met.

The provisions of section 8, second and third paragraphs, apply accordingly.

Section 66.Duty to inform the data subject and access to data

The provisions regarding the duty to inform the data subject in section 48 and the right of access in section 49, second and third paragraphs, do not apply to the Police Security Service.

The Freedom of Information Act does not apply to access to data that are processed by the Police Security Service pursuant to this Act.

With regard to access to data that are processed in connection with security clearance, the provisions laid down in or pursuant to the Security Act apply.

Access to case documents in a freezing matter may be given under the rules of the Criminal Procedure Act, which apply in so far as they are appropriate.

Section 67.Security vetting

The Police Security Service may process data relevant to the question of security clearance in the context of a current security vetting matter. If the Police Security Service receives data that raise doubt as to whether a person who has already been given security clearance is suitable in terms of security, the data may be processed and forwarded to the clearance authority.

The Police Security Service shall not collect or process data solely because the data might be relevant to future security vetting.

The provisions of section 20 apply correspondingly to the disclosure of data relating to security vetting.

Section 68.Supervision and the data subject's request for a processing check

The Parliamentary Oversight Committee on Intelligence and Security Services exercises supervision pursuant to the Act of 3 February 1995 No. 7 pertaining to oversight of intelligence and security services.

Upon request by the data subject or any person who believes himself to be a data subject, the Committee shall check that the data relating to the individual concerned have been processed in accordance with this Act. Requests for a check of the processing of data by the Police Security Service shall be submitted pursuant to the Act of 3 February 1995 No. 7 pertaining to oversight of intelligence and security services.

The provision in section 54, last paragraph, applies accordingly.

Section 69.Regulations

The King may make regulations containing more detailed provisions on the implementation of this Act, including provisions on

The King may also make regulations containing more detailed provisions on the processing of data prescribed by such conventions, etc. as are mentioned in section 22, second paragraph.

Section 70.Entry into force

The Act shall enter into force from such date as the King may decide. The King may decide that different provisions of the Act may enter into force at different times.

The King may lay down more detailed transitional rules.