Recording meetings in Norway.
Norway is the jurisdiction people most often get structurally wrong: not in the EU, but the Regulation applies anyway, through a different route.
Norway is not an EU member state. It is in the European Economic Area, and the GDPR applies through the EEA Agreement rather than as EU law directly. For a meeting recording the practical obligations are the Regulation's, implemented domestically by Personopplysningsloven. Alongside it, Section 205 of the Straffeloven addresses infringement of the right to private communication, including secretly listening to or recording a conversation the person is not taking part in.
The EEA route matters mainly for timing and for anyone reasoning from first principles about which law applies: EU instruments are incorporated into the EEA framework on their own schedule, so there can be a lag that does not exist for member states. In substance, an organisation recording meetings in Norway faces the obligations it would face in Sweden or Denmark: a stated purpose, a lawful basis, telling people at the time, and bounded retention. The criminal provision, as in the rest of the Nordics, is aimed at the non-participant.
- The data protection instrument
- Personopplysningsloven (Personal Data Act), LOV-2018-06-15-38
- Who supervises this
- Datatilsynet (Norwegian Data Protection Authority)
Criminal provisions
These sit alongside data protection law rather than replacing it. They generally address conduct that is covert or that involves conversations the recorder was not part of, which is a narrower category than everyday meeting recording, and a considerably more serious one.
Straffeloven, Section 205
Penal Code
Infringement of the right to private communication. The provision addresses, among other conduct, using a listening or recording device to secretly listen to or record a conversation the person is not taking part in.
What is specific to this country
- Norway is not an EU member state but is in the EEA, and the GDPR applies through the EEA Agreement rather than as EU law directly. In practice the obligations are the Regulation's, which is the part that matters for a meeting recording.
- Because the route is the EEA Agreement rather than EU membership, timing occasionally differs: EU instruments are incorporated into the EEA framework on their own schedule.
- Transparency is a separate obligation from lawful basis. People are told what is being collected and why at the time it is collected, which for a meeting means at the start rather than afterwards.
What to do in practice
The practice below is not the legal minimum in every jurisdiction. It is the practice that is defensible in all of them, which is a more useful target when your calls cross borders.
- Say it out loud at the start, before anything substantive is discussed, and say what the recording is for. Not a line in the invite nobody read.
- Give people a real way to decline. An announcement that leaves no room to object is closer to a notification than to consent.
- Write it down. A line in the notes recording that the meeting was recorded, and that nobody objected, is worth more later than anyone's memory of the moment.
- Keep external meetings to a higher standard than internal ones. Colleagues share an employment context; a customer, a candidate, or a supplier does not.
- Decide how long you keep recordings, and actually delete them. Indefinite retention converts a small, well-handled recording into a growing liability.
- Treat sharing as a fresh decision. The question is not whether you were allowed to record, it is whether this particular person was meant to hear it.
Questions
Does the GDPR apply in Norway if Norway is not in the EU?
Yes, through the EEA Agreement rather than as EU law directly. The practical obligations are the Regulation's. The route matters for timing and for formal analysis rather than for what an organisation has to do about a meeting recording.
Does data move freely between Norway and the EU?
Norway is inside the EEA, so transfers within the EEA are not third-country transfers in the way a transfer to a non-EEA country would be.
What does Section 205 cover?
Infringement of the right to private communication, including secretly listening to or recording a conversation the person is not taking part in. It is aimed at the non-participant rather than at a participant recording a meeting they are in.
Sources
Primary sources, so you can check this rather than take our word for it.
Recording that announces itself.
Canto's notetaker joins as a named participant the organiser admits, and the recording, the transcript and who can see it stay under your control. 300 minutes a month, free forever.