Norway.
Section 100 expression. EEA inside, EU outside. The hedge that is real.

Section 100 of the Grunnloven (Norwegian Constitution, dated 17 May 1814) was substantially reformed by the 2004 amendments and now reads as one of the more expansive press-freedom clauses in Europe. Paragraph 1 states "There shall be freedom of expression." Paragraph 2 forbids prior restraint and post-publication liability except in narrow, statutorily defined cases that must themselves be justifiable in a free society. Paragraph 4 codifies the right of access to documents of the state and municipalities. Paragraph 6 imposes a positive obligation on state authorities to create conditions that facilitate open and informed public discourse. The 2004 reform was drafted by a parliamentary commission (the Ytringsfrihetskommisjonen) and is generally read as constitutionalising a positive duty on the state to support, not merely tolerate, free expression.

Norway is a member of the European Economic Area (EEA) but not of the European Union. GDPR (Regulation (EU) 2016/679) applies in Norway through Decision 154/2018 of the EEA Joint Committee, which incorporated it into Annex XI to the EEA Agreement; it is implemented domestically by Personopplysningsloven (LOV-2018-06-15-38). The substantive obligations are identical to those facing an EU-based provider: Article 5 minimisation, Article 17 erasure, the full GDPR rights regime. The structural difference is jurisdictional: Norwegian courts interpret GDPR through the EFTA Court (homogeneity principle) rather than direct preliminary references to the Court of Justice of the European Union (CJEU). In practice the EFTA Court tracks CJEU rulings closely, but it is institutionally distinct and the Norwegian Supreme Court (Høyesterett) retains final interpretive authority.

This is the structural advantage worth being precise about. The EU e-Evidence package (Regulation (EU) 2023/1543 and the accompanying directive) creates European Production Orders and European Preservation Orders that one Member State can serve directly on a service provider in another Member State, with comparatively short response windows. Norway is not an EU Member State and is not party to e-Evidence. Cross-border requests aimed at a server in Oslo therefore go through the older, slower, judicially-supervised channels: the 2000 EU MLA Convention (Norway is associated via Schengen), Council of Europe instruments, or bilateral MLATs. None of these are as fast or as direct as e-Evidence. It is not invisibility; it is procedural friction.

Datatilsynet is the Norwegian Data Protection Authority, headquartered in Oslo. It is consistently ranked among the more assertive European DPAs in published surveys (notably the EDRi annual enforcement reports). Recent high-profile actions include the Grindr fine (2021, NOK 65M for unlawful consent handling), the Meta behavioural-advertising decision (2023, leading to the temporary suspension of behavioural advertising on Facebook and Instagram across the EU/EEA via the EDPB urgency procedure), and continuing enforcement on biometric overreach. For a customer this means GDPR rights are not just incorporated by treaty — they are actively enforced by a regulator with a published willingness to act.

Politiets sikkerhetstjeneste (PST) is the Norwegian Police Security Service, the domestic security and counter-intelligence agency. Etterretningstjenesten (E-tjenesten) is the foreign military intelligence service. PST operates under the Police Act and the 2016 Civil Intelligence Service Act with parliamentary oversight by the EOS Committee. The 2020 Intelligence Service Act (etterretningstjenesteloven) gave E-tjenesten new powers for bulk collection of cross-border traffic — these were the subject of a 2021 European Court of Human Rights challenge that found procedural deficiencies; the Norwegian Parliament passed amendments in 2023 to address them. The current regime targets counter-terrorism and counter-intelligence on cross-border flows, not ordinary hosting customers; as elsewhere, no jurisdiction substitutes for application-layer encryption against a state-actor adversary.

This is an active debate worth being honest about. Norway implemented the EU Data Retention Directive (2006/24/EC) in 2011, but suspended it before it took effect after the CJEU's Digital Rights Ireland ruling (2014) struck the directive down. Since 2022 there have been periodic Justice Ministry proposals to reintroduce targeted IP-address retention for serious-crime investigations. As of the date of this article no general retention obligation applies to hosting providers in Norway. NordBastion is not subject to bulk retention; we retain only what is operationally necessary, on the schedules published in the transparency report. If the legal landscape changes materially, the warrant canary will reflect it.

Norway has been a founding NATO member since 1949 and hosts substantial allied infrastructure. NATO membership does not, by itself, create cross-border legal-process obligations against hosting customers; it operates at the military and intelligence layers, not in the ordinary legal-process pipeline that reaches an Oslo data centre. The honest framing is the same as for SÄPO in Sweden or Supo in Finland: signals-intelligence cooperation exists, it is constrained by domestic statute and parliamentary oversight, and it is not the day-to-day risk facing an ordinary hosting workload — but it is a real part of the picture if the workload genuinely attracts state-actor adversaries.

Only through a Norwegian court order, on a named subject, for data we actually hold — and that intersection is narrow by design. The Norwegian Criminal Procedure Act (Straffeprosessloven) requires judicial supervision for production orders. The Norwegian Media Liability Act (Lov om redaksjonell uavhengighet og ansvar i redaktørstyrte journalistiske medier, 2020) and Criminal Procedure Act § 125 create a strong source-protection privilege for journalists and editorial collaborators. For ordinary hosting customers, the binding limit is what does not exist: we do not collect identity at signup, we do not retain payment-card data, and infrastructure logs are kept on the published rotation. What does not exist cannot be compelled.

Under the EEA homogeneity principle (Article 6 EEA, Article 3 ESA-Court Agreement), the EFTA Court is obliged to interpret EEA-incorporated EU law consistently with CJEU rulings — both those handed down before the EEA Agreement and, in practice, those handed down after. The post-Schrems II environment is the live test case: CJEU rulings on data-transfer adequacy (Schrems II, C-311/18, 2020; Meta v. Bundeskartellamt, C-252/21, 2023) flow into Norwegian law via EFTA Court interpretation, but Norwegian courts have one additional procedural step where the executive can, in principle, exercise EEA reservations. In practice this is rarely used for data-protection law; it is mentioned for completeness.