Regulating emerging technology in times of crisis: Digital contact tracing in Norway during the COVID-19 pandemic

In times of crisis, emerging technology can pose major challenges for regulators. They must deal with great uncertainty and urgency related to both the crisis and the technology. To understand such situations, this article studies the revelatory case of privacy regulation of a contact-tracing application called Smittestopp, created in Norway during the COVID-19 crisis. Based on public and organizational documents and 48 interviews, the analysis shows that the Norwegian Data Protection Authority faced several options for regulatory intervention throughout the crisis, and adapted its approach based on intra-crisis experience, regulatees' responses, and different levels of uncertainty and urgency. Building on these findings, the study formulates propositions regarding the regulation of emerging technology during a crisis and regulatory agencies' use of rule-based, idea-based, and norm-based interventions. This study provides insight into how these three types of intervention relate to different aspects of a crisis situation. Furthermore, it stresses the importance of idea-based intervention as a key site of analysis in studying technology that emerges during a crisis.