The processing of personal data shown on the electronic tax deduction card is regulated by the Norwegian Personal Data Act; see Sections 8 and 11 of the Act. Conditions for processing personal data are set out in Section 8. Requirements for processing personal data are set out in Section 11.
Obtaining tax deduction cards is therefore contingent on the data being processed in compliance with the Personal Data Act. This means, among other things, that if a tax deduction card has been obtained but it is not relevant to make a taxable payment, the data must be deleted; see Section 11, item e; with reference to Section 28
Taxpayers will also receive information in their tax notice about who has obtained tax deduction card details about them. In case of dispute, it will be a matter between the taxpayer and the employer with the Norwegian Data Protection Authority as the place of tribunal.