The Standing Committee on Health and Care Services recommends the Storting approve amendments to health legislation. The proposal would allow restrictions on sharing large health datasets when disclosure could threaten society's fundamental values and functions or endanger lives and health, and introduces stricter information security requirements for processing personal data. The committee notes concerns from consultation participants that these restrictions could hinder medical research and innovation.
AI-generated summary · Model: Claude Haiku 4.5 · Generated: 14 May 2026
These are the proposals in the document, not decisions. See the votes for the outcome.
Amend section 29, fourth paragraph of the Health Personnel Act (2 July 1999 no. 64) to add: Health information shall not be disclosed if disclosure could threaten society's ability to protect fundamental values and functions and could endanger lives and health.
Amend section 22 of the Health Data Act (20 June 2014 no. 42) to require controllers and processors to implement necessary technical and organisational measures to protect personal data security. Measures must be appropriate to the processing risk under the GDPR article 32. Controllers and processors must also conduct risk assessments of networks and information systems used to deliver services under this law. Security measures must be proportionate and tailored to risk. When determining appropriate security levels, regard must be paid to individual privacy, critical societal functions, health services' ability to perform their tasks, and technological developments. Controllers and processors must implement measures to prevent, detect and mitigate harmful incidents, including access controls, logging and follow-up audits. Controllers and processors may require comprehensive and extended police certificates from personnel with privileged system access. The Ministry may set further requirements by regulation.
Amend section 19, fifth paragraph of the Health Registers Act (20 June 2014 no. 43) to state: The duty to produce statistics under earlier paragraphs does not apply if disclosure could threaten society's ability to protect fundamental values and functions and could endanger lives and health.
Amend section 19 a, eighth paragraph to state: Health information shall not be disclosed if disclosure could threaten society's ability to protect fundamental values and functions and could endanger lives and health.
Amend section 19 b, second paragraph to state: Health information shall not be disclosed if disclosure could threaten society's ability to protect fundamental values and functions and could endanger lives and health.
Amend section 19 e, fourth paragraph to state: Exemptions may only be granted if disclosure is justifiable on ethical, medical and health grounds and will not threaten society's ability to protect fundamental values and functions and will not endanger lives and health.
Amend section 21 to require controllers and processors to implement necessary technical and organisational measures to protect personal data security, proportionate to processing risk. In registers under sections 10 or 11, names, personal identification numbers and other identifying features shall be stored encrypted. Controllers and processors must conduct risk assessments of networks and information systems. When determining appropriate security levels, regard must be paid to individual privacy, critical societal functions, health services' ability to perform their tasks, and technological developments. Controllers and processors must implement measures to prevent, detect and mitigate harmful incidents, including access controls, logging and follow-up audits. Controllers and processors may require comprehensive and extended police certificates from personnel with privileged system access. The Ministry may set further requirements by regulation.
The law enters into force at a time the King determines. The King may bring provisions into force at different times.
The Storting requests the government, within two years, to account to the Storting in an appropriate manner for how the Health Legislation Amendments Act functions, with particular emphasis on the extent to which limited access to large health datasets hinders research, medical innovation and development of new treatments. (Proposal from the Progress Party and Conservative Party)
The Storting requests the government to establish forums and procedures for dialogue with medical and health research communities to ensure security measures do not obstruct research and development in health. (Proposal from the Socialist Left Party and Red Party)