Talk on the processo of implementing the GDPR in Norway spring 2018 for 420 IT security specialists at Italy's larges confernace for IT security

2. State of the GDPR
in Norway
Security Summit,
Milano, 15 March 2018
Kristian Foss

3. EEA
= EFTA+EU

4. EFTA: Liechtenstein, Iceland, Norway, = 5,5 mil persons
+
EU: 28 countries, 511 mil persons
= EEA

5. EFTA EU

6. EFTA institutions – mirror of EU’s

7. What’s up in Norway?
Public
hearing
6.7.2017
GDPR
enacted
April
2016
16.10.17
Incorp by
law
Incorp into
EEA agreement2018
103 days,
134 statements
Not taken
25 May
No proposal…
Required steps
Dead line

8. EFTA institutions – mirror of EU’s
These guys
need to
agree

9. Local adaption
Needed:
• 1 act of incoperation
(GDPR)
• Change 99 act
Done:
• No acts of incoperation
(GDPR)
• No proposals, no acts
changed

10. Will Norway make 25 May?
Department of Justice says:
• Notified Parliament of proposal in April
• «a certain uncertainty» if will make 25 May
– need incorporation EEA Agreement
– depends mostly on EU
3 March 2018

11. What if we don’t make it?
Department of Justice says:
• Will not affect flow of data
• 1995 directive will apply
GDPR art. 94 state:
“1. Directive 95/46/EC is
repealed with effect from 25
May 2018.
2. References to the
repealed Directive shall be
construed as references to
this Regulation. […]”

12. Types of changes in Norway
1. «Easy of use» changes
2. Supplements
3. Harmonisation

13. Examples
• Age limit for Facebook etc. (13 years)
• Sensitive data for research and statistics
• Prior consultation
• Licensing system ends
• Video surveillance

14. Business readiness Norway
• An early majority is aware
• A minority has started
• Few will be near compliant 25 May

15. Thanks!
kristian.foss@bull.no