Law on Electronic Communication (Electronic Communications Act)
Purpose: Norway introduced a new Electronic Communications Act on 1 January 2025. The purpose of the law is to ensure that users throughout the country have access to good, affordable, and forward-looking communication services with adequate security. Additionally the law shall facilitate sustainable competition and efficient use of societal resources, and stimulate business activity and innovation. The Ecom Act implements the European Electronic Communications Code (EECC).
Scope: The Electronic Communications Act applies to all activities related to electronic communication, associated equipment and data centers. Consequently, the law has a wide scope. The new law also extends the scope beyond traditional electronic communication providers to include other actors, such as providers of number-independent communication services. This means that providers of certain social media platforms like Instagram and Facebook, and chat services like Messenger and WhatsApp, are required to meet several of the law’s requirements as well.
Core obligations: Providers of electronic communication services are subject to a variety of obligations under the law. This includes, among other things, a duty to register, a duty to maintain confidentiality about customers’ and others’ use of services, and a duty to report to the Norwegian Communications Authority (NKOM). Electronic communication providers also have numerous obligations towards consumers, which in the new law are consolidated in a separate chapter on end-user rights. For example, providers must notify and give consumers the right to terminate the contract upon changes, provide consumers with a concise and easily readable contract summary, and as a general rule, not bind consumers for more than 12 months, or in special cases, 24 months. An important change in the new law at this point is that consumer protection is extended to also cover housing associations. Providers of electronic communication services can therefore no longer bind housing associations to contracts longer than maximum 24 months. This is a rule unique to the Norwegian law that is not transferred from the EECC.
The new Electronic Communications Act also regulates data centers for the first time. Data center operators are now subject to a registration duty, and requirements are set to ensure adequate security for users. This includes systematic follow-up of security and preparedness in data center services, and operators must assess what is adequate based on the ability to withstand any event that causes or may cause a breach of availability, authentication, integrity, or confidentiality in data center services.