Lawsuit and criminal investigations over Telenor's Myanmar user data

Telenor's Myanmar subsidiary handed user data to the military after the February 2021 coup, and its Norwegian parent, Telenor ASA, now faces a class action over it. On 8 April, the Swedish non-profit Justice and Accountability Initiative (JAI) filed the suit at Asker and Bærum District Court in Norway on behalf of Myanmar customers whose data was handed over, seeking EUR 9,000 for each of them. On 17 September the court rejected Telenor's procedural objection and allowed the case to proceed as a class action, a ruling that does not yet decide whether Telenor is liable. Norwegian police have separately opened two criminal investigations into Telenor ASA, about 54% of which is owned by the Norwegian state.

According to a press release from the Open Society Justice Initiative (OSJI), another organisation backing the suit, the military frequently demanded data on specific users from Telenor's Myanmar subsidiary after the coup, and the plaintiffs know of at least 1,253 numbers whose data was handed over. The plaintiffs claim that Telenor ASA is liable because it either failed to prevent the disclosures or authorised its subsidiary to make them despite knowing the risks. According to SOMO, a Dutch research centre on multinational corporations that also supports the suit, the class action is opt-out, so every customer whose data was handed over is covered by the claim unless they actively withdraw.

Norwegian police announced the two investigations on 15 September, naming Telenor ASA as a suspect in both. The National Criminal Investigation Service (Kripos) is investigating suspected complicity in crimes against humanity for the period from the coup to the completion of the sale on 25 March 2022, during which the subsidiary repeatedly handed customers' historical traffic data to the military. The Norwegian Police Security Service (PST) is investigating whether sanctioned surveillance equipment was transferred with the sale without a permit from the Ministry of Foreign Affairs. According to Telenor's press release, no individuals have been named as suspects.

As of 23 October, we had found no report that either investigation had led to an indictment.

Telenor announced in July 2021 that it would sell its Myanmar business to M1 Group for USD 105 million, and the sale was completed on 25 March 2022. Telenor's announcement of September 2021 said that staying would have required activating intercept equipment for use by the Myanmar authorities, meaning systems that let the authorities monitor communications. That equipment is subject to Norwegian and international sanctions, and the announcement said activating it was unacceptable for Telenor. A Telenor article from February 2022 said the law required traffic data to be retained and staff could not be told to delete it, which left no good alternative to a sale.

Perspective

According to Telenor's 2021 explanation, the call records an operator keeps by law cover both parties, the time, the duration and the base station the call went through, but not the content of the call. Our inference is that the fields Telenor listed are enough on their own to show who a person is in contact with and roughly where they are, without anyone hearing a call.

Telenor's press release says employees who refused the military's orders risked imprisonment, torture or the death penalty, and that the company had no real choice. Telenor's page on the lawsuit also says the company sees no basis for liability, because the data had to be provided under local law. In OSJI's press release, the plaintiffs' lawyer says they hold evidence of cases where the team at headquarters expressly recommended handing over data, and that the filings include several requests that were escalated to the risk assessment team at Telenor's head office in Norway.

The National Contact Point (NCP) that the Norwegian government set up under the guidelines of the Organisation for Economic Co-operation and Development (OECD) handles complaints about corporate conduct, but it is not a judicial body and cannot order compensation. In 2021, 474 civil society organisations in Myanmar filed a complaint through SOMO over the way Telenor left Myanmar.

The conclusion of the NCP's final statement of December 2025 is that Telenor identified and mitigated some serious risks when it left, and that protecting employees' lives and safety is central to a company's responsibility to respect human rights. The same statement also says that systematically giving priority to one group of rights-holders, the employees, did not meet the expectations of the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct. Telenor's response said it disagreed with this conclusion.

The same response accepts that companies should plan a responsible exit before entering volatile markets, but notes that this became a formal part of international human rights frameworks only in 2022 and 2023. The NCP concluded that if Telenor's due diligence on entering Myanmar had already covered the most severe risks, such as a forced exit, Telenor would most likely have had more ability to reduce risk than it actually had. The NCP did not decide whether the guidelines strictly require an exit strategy at entry.

On what was transferred, Telenor's position is that local law required the data to be retained and not deleted. Telenor's page on the case also says its Myanmar subsidiary did not activate the intercept equipment, and that after the coup it was forced to stop disclosing the scope of government requests. Telenor's statements concern activation, while the police press release does not say whether the surveillance equipment in the PST investigation is this same equipment. The NCP concluded that Telenor should have carried out a new risk assessment once the Myanmar authorities required the buyer to find a local partner as majority owner.

An analysis by Ranking Digital Rights, which rates the human rights performance of technology companies, says interception systems should not be transferred in a sale as ordinary equipment, and that the Myanmar buyer stopped all transparency reporting after renaming itself ATOM Myanmar. A 2023 document from the Office of the UN High Commissioner for Human Rights (OHCHR) says companies selling operations should consider the human rights commitments of potential buyers and guide the sale to more responsible ones.

We are a community based in Taiwan, where the Telecommunications Management Act requires carriers to keep communication records for a set period and keep them confidential, and to assist with interception and with requests for communication records and user information under the Communication Security and Surveillance Act. Subscribers in Taiwan can ask their carrier for their own communication and billing records, which the carrier must provide, but the records stay with the carrier and authorities can still obtain them under the law. Chunghwa Telecom, Far EasTone and Taiwan Mobile publish counts of government requests in their sustainability reports or ESG pages: 247,032 at Chunghwa Telecom and 253,731 at Far EasTone in 2025, and 270,578 at Taiwan Mobile in 2024. The three differ in year, unit and method, and Chunghwa Telecom changed its method from 2025, so the figures cannot be compared directly.

In Taiwan, a carrier that holds spectrum or a quarter of a market needs approval from the National Communications Commission (NCC) to transfer all or most of its business, and the factors the NCC weighs include users' rights and national security, though the Telecommunications Management Act does not say how subscriber data is transferred. Taiwan's Personal Data Protection Act has no provision on transfers in a merger or sale, as far as we found in the statute text. In South Korea and Japan, the transfer rules we found are in general data protection law, which applies to all businesses, and we did not check telecom-specific rules or whether these rules, written for business transfers, mergers and succession, cover a sale of 100% of the shares in a subsidiary like Telenor's.

South Korea's Personal Information Protection Act requires advance notice, including how to object, when personal data moves because a business is transferred or merged, and the recipient may use the data only for the original purposes. Under Japan's Act on the Protection of Personal Information, a successor in a merger or other business succession is not treated as a third party, so the consent rule for passing data to third parties does not apply. The successor may not use the data beyond the original purposes without consent. The two Japanese provisions we checked contain no notice requirement, and we did not review the rest of Japan's act or the guidelines of its Personal Information Protection Commission (PPC).

Myanmar customers whose data was handed over are included in the class action by default and must actively opt out if they want to leave it. Other readers do not need to do anything.

The case can be weighed against each side's standards through three questions. First, whether the parent company is responsible for its subsidiary handing over data, where Telenor's position is that the data had to be provided under local law and the plaintiffs claim the parent authorised it knowing the risks. Second, how an operator facing government demands should weigh its responsibility to protect employees against its responsibility to protect users. Third, what leaving and staying each cost, and whether user data and surveillance equipment should go with a sale, where Telenor's position is that local law required the data to be retained and not deleted.

According to SOMO and OSJI, Telenor had one month to appeal the 17 September ruling, until about 17 October. As of 23 October, we had found no report of an appeal. Readers can watch for the court's hearing date and for whether either investigation leads to an indictment.