Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway (Case E-19/25)
Date: 2025-10-08
Institutions: EFTA Court
Subjects: European Economic Area, Norway, computer crime, data protection, disclosure of information, information system, intergovernmental cooperation (EU), national implementing measure, public safety, transmission network








C_202506334EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/6334


20.11.2025






Action brought on 8 October 2025 by the EFTA Surveillance Authority against Norway
(Case E-19/25)
(C/2025/6334)

An action against the Kingdom of Norway was brought before the EFTA Court on 8 October 2025 by the EFTA Surveillance Authority, represented by Sigurbjörn Bernharð Edvardsson, Hildur Hjörvar, Sigrún Ingibjörg Gísladóttir and Melpo-Menie Joséphidès, acting as Agents of the EFTA Surveillance Authority, Avenue de Arts 19H, 1000 Bruxelles/Brussel, Belgique/België.
The EFTA Surveillance Authority requests the EFTA Court to:






(1)


Declare that Norway has failed to fulfil its obligations under the Act referred to at point 5cpa of Annex XI and point 47 of Protocol 37 to the Agreement on the European Economic Area (Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union), as adapted by Protocol 1 to that Agreement, and under Article 7 of the EEA Agreement, by failing to adopt the measures necessary to implement the Act within the time prescribed, or in any event, by failing to inform the EFTA Surveillance Authority thereof, and










(2)


Order Norway to bear the costs of these proceedings.





Legal and factual background and pleas in law adduced in support:







—


By this application, the EFTA Surveillance Authority (‘ESA’) seeks a declaration from the Court that Norway has failed to fulfil its obligations under the Act referred to at point 5cpa of Annex XI and point 47 of Protocol 37 to the Agreement on the European Economic Area (Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union), as adapted by Protocol 1 to that Agreement, and under Article 7 EEA, by failing to adopt the measures necessary to implement the Act within the time prescribed, or in any event, by failing to inform the EFTA Surveillance Authority thereof.










—


ESA sent a letter of formal notice to Norway on 4 November 2024, requesting Norway to submit its observations within two months of its receipt.










—


Norway responded to the letter of formal notice on 6 January 2025, stating that it had not yet taken the necessary measures to implement the Act. Norway also indicated that the legislative measures necessary to implement the Act were underway, and the relevant legislative amendments were expected to enter into force during the second half of 2025.










—


ESA delivered a reasoned opinion on 26 March 2025 maintaining its conclusions set out in the letter of formal notice and giving Norway two months to take the measures necessary to comply with the reasoned opinion, i.e. no later than 26 May 2025.










—


In its reply on 28 May 2025, Norway referred to its reply to the letter of formal notice, stating that the adoption of the measures necessary to implement the Act were expected to enter into force during the second half of 2025 and that the consultation period for the proposed Bill was finalised.










—


When the deadline expired, ESA had received no notification that Norway had implemented the Act, nor was it in possession of any other information indicating that the Act had been made part of Norway’s internal legal order.










—


Since Norway had not complied with the reasoned opinion by the deadline set therein, on 8 October 2025, ESA decided to bring the matter before the Court, pursuant to Article 31 SCA.










—


ESA notes that at the point of lodging the present application, it has not been notified and does not have any other information suggesting that Norway has implemented the Act into its national legal order.






ELI: http://data.europa.eu/eli/C/2025/6334/oj
ISSN 1977-091X (electronic edition)