Norway's constitutional anchor for free expression is Section 100 of the Grunnloven, comprehensively rewritten in 2004 to become one of the most explicit speech clauses in Europe. It entrenches freedom of expression as a fundamental right, forbids prior censorship by name, and protects the right to receive and impart information. The Norwegian Supreme Court reads it alongside ECHR Article 10 jurisprudence, which gives journalists and publishers a robust right to refuse to disclose the identity of an anonymous source — read across to an infrastructure operator, that doctrine reinforces the same model NordBastion ships under by choice.
The structural advantage of Norway, however, is not the Constitution — it is the EEA-without-EU posture. GDPR applies in Norway through EEA incorporation, so customers get the same Article 5 minimisation and Article 17 erasure rights as in any EU country, enforced by the Datatilsynet, one of the most active DPAs on the continent. But Norway is outside the direct jurisdiction of the European Court of Justice. Schrems-style cross-border data-sharing rulings, the EU e-Evidence regulation, EU-level production-order frameworks — none of those automatically apply. EU-grade standards, regulatory distance from EU-level enforcement instruments. That combination is rare.
Add to that the climate. Norway has spent two decades near the top of every press-freedom and rule-of-law index published. The courts are independent, the executive is bound by statute, and the digital-rights ecosystem (EFN, the Norwegian Bar Association's Surveillance Committee) is active and well-respected. For an infrastructure operator that climate matters: the legal protections only matter if they are reliably enforced, and in Norway they are.