(May 27, 2021) On May 5, 2021, the Norwegian government (Statsministerens kontor, Helse- og omsorgsdepartementet, Kulturdepartementet) sent out a proposal for public review (høring) regarding the issuance of an official “Corona Certificate.” The deadline for submitting responses was May 12, 2021. The week-long response time was considerably shorter than the usual amount of time afforded stakeholders for review, but longer than for some COVID-19-related measures where the response time was as short as three days.
Under the proposed amendment to the Contagious Disease Act (Smittevernloven), the Norwegian Institute for Public Health and the National Online Health Services in Norway (HelseNorge.no) would be responsible for issuing the official Corona Certificate that would indicate the vaccination status of the holder. The certificate, which would be available in electronic and printable form, would also include COVID-19 test results and any previous diagnosis of COVID-19 verifying the immunity of the certificate holder. The certificate is intended to be compatible with similar certificates issued by member states of the European Union. It would also grant access to activities previously subject to COVID-19 restrictions, which would be further specified in the Covid-19 Ordinance (Covid-19-forskriften).
The government noted in the høring document that, in practice, the Corona Certificate may at least indirectly become a tool to promote the exercise of constitutionally protected freedoms, ensuring that limits to those freedoms and limits on the right to privacy are not in force longer than necessary. However, the government also recognized that the use of a Corona Certificate may also infringe on a person’s right to privacy.
Under the Norwegian Constitution, Norwegians are afforded a right to privacy in article 102, and article 113 provides that “any government intervention against the individual must be based in law.” (Translation by author.) Moreover, article 106 of the Constitution provides that Norwegians have a right to move freely within Norway. In addition, because Norway is a member of the European Economic Area (EEA) and is thus bound by the General Data Protection Regulation (GDPR) (1 § Personopplysningsloven), the government may collect and automatically process personal data only if one of the six legal grounds for automatic use found in the GDPR apply:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (Art. 6. 1. (a)–(f) GDPR.)
According to the proposal, the basis for the automatic use of personal data would be consent.
Responses to the Høring
The høring received an unusually large number of responses, in particular from private citizens.
In its response to the høring, the Norwegian Data Protection Authority (Datatilsynet)—the agency that oversees compliance with the Data Protection Regulation and the GDPR—particularly noted a risk that “even though the use of the Corona Certificate is voluntary, the voluntariness will, as previously mentioned, in many instances not be perceived as real.” (Translation by author.) The authority therefore found the government’s reliance on prior consent from the user to be problematic and requested that a second public review be conducted once the government has determined what specific agencies and companies may request to see a Corona Certificate.
National Rules for Fully Vaccinated Persons
Norway has previously issued new national guidelines for fully vaccinated persons, allowing persons to gather with other fully vaccinated persons and with unvaccinated persons who are not part of a group at risk for contracting COVID-19. The government or local regions in Norway may still adopt local COVID-19 measures, even for fully vaccinated persons. For example, Oslo still limits the number of private gatherings to 10, but as of May 21, 2021, vaccinated persons are no longer counted toward that limit. On May 27, 2021, additional easing of restrictions on a national level will enter into force.