New Ecom Act - Increased Requirements for Security, Access, and Transparency in the Telecom Sector

Read the article in Norwegian here: Ny ekomlov - økt krav til sikkerhet, tilgang og åpenhet for ekomsektoren

The obligation to register telecom-related activities with Nkom will be expanded to include both data centers and a number of other companies. The Norwegian Business Enterprise Register has estimated that the various registration obligations will affect a total of 32,500 companies. 

The law also strengthens consumer rights, which will likely require many providers to adjust operational routines, especially regarding the new information requirements for end customers. Providers must also update their terms of use and introduce stricter consent requirements for cookies. 

Sustainable competition will continue to be the most important measure to ensure nationwide availability of good electronic communications networks and services. Increased public support is planned where there is no commercial basis for expansion, and there is extended access to impose delivery obligations if other measures are insufficient. 

The new ecom act ensures that Norway once again has the same regulation of this sector as the rest of the EU and EEA countries as it implements EU's Electronic Communication Code. 

Key Changes in the New Electronic Communications Act 

The new ecom act introduces the first regulation of data centers, aiming to ensure robustness, preparedness, and national security for what is now recognized as central and critical infrastructure in our digital society. The government's digitalization strategy towards 2030 aims to facilitate data centers that contribute to value creation, increased security, and safeguarding Norwegian interests, with proper security in peace, crisis, and war. The most critical digital services must be delivered from data centers located in Norway or our close allies. 

The provisions apply to data center operators and include: 

• Companies that offer data center services for payment, whether they own the facility or rent space in a "co-location" data center. 
• Operators  who operate or rent data centers, including for their own business, if the subscribed power requirement exceeds a threshold value set by the ministry in regulations. 

Operators managing several smaller data centers that collectively exceed the threshold value are also covered. The definition also includes dedicated data centers for cryptocurrency mining. 

The new law expands from only covering traditional telephony to also include so-called number-independent person-to-person communication services. This includes chat services, voice over IP, all forms of email, and internet access services, such as Messenger and WhatsApp. This will tighten security requirements for such services and contribute to equal treatment. Providers of these types of services will not be subject to as many obligations as providers of traditional telephony. They are not required to register and are only subject to some of the security requirements. 

An overarching goal of the new ecom act is to ensure users across the country good, affordable, and future-oriented electronic communication services. The most important measures to achieve this goal are to facilitate sustainable competition, public grants for broadband expansion in areas where there is no commercial basis for private expansion, and the possibility of imposing delivery obligations where neither competition nor public grants is sufficient. 

Under the current law, Telenor in particular has been considered to have significant market power (SMP). In specific markets, like termination of fixed and mobile telephone, SMP obligations are imposed on several providers. SMP obligations includes inter alia an obligation to promote competition by facilitating other providers. Nkom's 2023 survey of competition in the broadband market shows that competition is poor in certain areas of the country. This suggests that providers with significant market power in "their" regions may be required to give other providers access to broadband infrastructure to facilitate competition in the end-user market. In the new ecom act, SMP obligations are also extended to include access to and use of construction infrastructure (passive infrastructure), including poles, masts, and ducts. The strengthened regulation of passive infrastructure can also contribute to reinforcing the development we have seen in recent years where telecom operators facilitate external investors in mobile masts and fiber. 

The government's new digitalization strategy towards 2030 calls for increased public support in areas where there is no commercial basis for expansion to achieve the goal that all households and businesses across the country should have access to high-speed broadband and good mobile coverage. The ambitions are also increased by raising the download speed from 100 megabits per second in 2025 to at least 1 gigabit per second by the end of 2030. To create a basis for good competition and choice, the government will maintain the goal of at least three full-fledged mobile networks that can compete in both the business and private markets.  

Competition is promoted by requiring those who receive support to accommodate requests from other service providers for access to the infrastructure. In the new ecom act, the goal of nationwide access is followed up with an expanded authority to enter into agreements with or impose delivery obligations on providers. Delivery obligations have been a central part of the telecom policy for many years but have so far only covered telephony services. The new ecom act extends the delivery obligation to also include "functional internet access," which in practice means fixed or mobile broadband, in areas with permanent year-round settlement or year-round or seasonal business activities. The crucial factor is that users are given access to broadband with sufficient speed to ensure a minimum set of services, such as email, public digital services, and social media. 

The authority to impose delivery obligations is still intended to be a "last resort" and is primarily relevant if there is no commercial offer and other less intrusive measures are insufficient to ensure broadband access, such as the broadband support scheme. Operators must initially cover the costs of fulfilling the delivery obligation themselves and can only have the costs covered if the operator can prove that the delivery obligation constitutes an unreasonable economic burden. 

The new law introduces stricter requirements for the use of cookies, finally eliminating the unique Norwegian "cookie rule" of consent given via browser settings. According to the new  ecom act, consent to cookies must now meet the requirements for consent in the General Data Protection Regulation (GDPR). This means, among other things, that consent: 

• must be actively given by the user, 
• must be specific, so it is clear what purpose the consent is given for, 
• cannot be given through pre-checked boxes or opt-out solutions as many have today, and 
• must also be able to be withdrawn as easily as it is given. 

Another condition for the consent to be valid is that it is "informed," meaning that the visitor is informed about what they are consenting to. The provision in the new ecom act states that it "among other things" should inform about what information is processed, the purpose of the processing, and who processes the information. The law is not exhaustive, and it may be that other aspects of the cookie must be informed about for the consent to be considered "informed." 

As with previous practice, there will be exceptions for cookies that are "strictly necessary" to deliver the service. This means that there will be few or no cookies beyond the purely functional ones that fall outside the consent requirement. Website owners will therefore not be heard that, for example, analytics or statistics cookies can be set without consent, even if these may be perceived as "strictly necessary" from a market perspective. 

The new law introduces new rules and clarifications to strengthen consumer rights. Several provisions protect not only consumers but also micro-enterprises, small enterprises, and non-profit organizations. Unlike consumers, these actors can, however, consent to waive their rights. 

Here are some of the most important changes: 

• Prohibition of discriminatory terms and conditions. 
• End-users have the right to a concise summary of the most important aspects of the agreement. The summary must be "easily understandable." 
• End-users have the right to switch internet access providers effectively and seamlessly, with a maximum of one business day interruption. 
• Providers must notify the consumer before usage limits are reached and when services included in the price plan are used up. 
• End-users have the right to free access to email services or email forwarding for up to three months after the agreement ends.