Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway (Case E-20/25)
Date: 2025-10-08
Institutions: EFTA Court
Subjects: European Economic Area, Norway, computer crime, data protection, information system, national implementing measure, provision of services, security of supply, technical standard, transmission network








C_202506339EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/6339


20.11.2025






Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway
(Case E-20/25)
(C/2025/6339)

An action against the Kingdom of Norway was brought before the EFTA Court on 8 October 2025 by the EFTA Surveillance Authority, represented by Sigurbjörn Bernharð Edvardsson, Hildur Hjörvar, Sigrún Ingibjörg Gísladóttir and Melpo-Menie Joséphidès, acting as Agents of the EFTA Surveillance Authority, Avenue de Arts 19H, 1000 Bruxelles/Brussel, Belgique/België.
The EFTA Surveillance Authority requests the EFTA Court to:






(1)


Declare that Norway has failed to fulfil its obligations under Article 7 of the EEA Agreement by failing to make the Act referred to at point 5cpaa of Annex XI to the Agreement on the European Economic Area (Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specifications of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact), as adapted by Protocol 1 to the EEA Agreement, part of its internal legal order, and










(2)


Order Norway to bear the costs of these proceedings.





Legal and factual background and pleas in law adduced in support:







—


By this application, the EFTA Surveillance Authority (‘ESA’) seeks a declaration from the Court that Norway has failed to adopt the measures necessary to make the Act referred to at point 5cpaa of Annex XI to the Agreement on the European Economic Area (Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specifications of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact), as adapted by Protocol 1 to that Agreement, part of its internal legal order, as required by Article 7 EEA.










—


ESA sent a letter of formal notice to Norway on 4 November 2024, requesting Norway to submit its observations within two months of its receipt.










—


Norway responded to the letter of formal notice on 6 January 2025, stating that it had not yet taken the necessary measures to implement the Act. Norway also indicated that the legislative measures were underway, and the relevant legislative amendments were expected to enter into force during the second half of 2025.










—


ESA delivered a reasoned opinion on 26 March 2025 maintaining its conclusions set out in the letter of formal notice and giving Norway two months to take the necessary measures to comply with the reasoned opinion, i.e. no later than 26 May 2025.










—


In its reply on 28 May 2025, Norway referred to its reply to the letter of formal notice, stating that the adoption of the measures necessary to implement the Act were expected to enter into force during the second half of 2025 and that the consultation period for the proposed Bill was finalised.










—


When the deadline set in the reasoned opinion expired, Norway had neither informed ESA of any measures it had adopted to make the Act part of its internal legal order nor was ESA in possession of any other information indicating that the Act had been made part of Norway´s internal legal order.










—


Since Norway had not complied with the reasoned opinion by the deadline set therein, ESA, on 8 October 2025, decided to bring the matter before the Court, pursuant to Article 31 SCA.










—


ESA notes that at the point of lodging the present application, Norway has neither made the Act part of its internal legal order, nor has it informed ESA of having done so.






ELI: http://data.europa.eu/eli/C/2025/6339/oj
ISSN 1977-091X (electronic edition)