Yes, but there's no allegation in the article that the data collection actually happened inside Norway. Given the global nature of telecommunications, even domestic, it seems quite possible that the communications were logged outside of Norway, possibly when it passed through American or other international infrastructure.
Why not? The CIA's foreign intelligence gathering is likely legal under US law, and if it uses infrastructure in the US it likely violates no foreign laws. Then there's all sorts of surveillance, picture taking, and cultivation of personal relationship that violates no laws but still constitutes what we typically consider spying.
One of the suspects in the Kenyan mall shootings is a Norwegian.