Who is responsible for the processing of your personal data?
The Norwegian Public Roads Administration, through the Director-General, is responsible for the processing of personal data taking place in the NPRA. The responsibility for following up this responsibility in our everyday operations is delegated in accordance with internal guidelines.
For what purposes do we process your personal data?
The NPRA processes personal data that are required in order to fulfil our responsibility for roads and road traffic in Norway. The NPRA processes your personal data in order to carry out tasks such as to plan, build, maintain and operate public roads; collect road tolls and monitor traffic in order to ensure road safety and traffic flow on our roads; approve and register vehicles; issue driving licences, operator’s licences and permits; and carry out inspection and supervision to ensure compliance with our rules and regulations.
The NPRA also processes personal data for closed, relevant cases from ordinary courts of law, for the purpose of establishing a precedent archive in order to ensure equal treatment in practice.
Legal basis for the processing of personal data
The processing of personal data by the Norwegian Public Roads Administration (NPRA) is primarily authorised by Norwegian statutes and their subordinate regulations.
These are mainly the Road Act, the Road Traffic Act, the ITS Act, the Act on Testing of Autonomous Vehicles, the Pollution Control Act, and the Personal Data Act. The NPRA also processes personal data in consequence of obligations laid down in the Working Environment Act, the Public Procurement Act and the General Application Act - all with their subordinate regulations. Furthermore, the NPRA processes personal data in consequence of the rules laid down in the Public Administration Act, the Archives Act, the Freedom of Information Act, the Bookkeeping Act, etc.
The NPRA may also process personal data based on legitimate interest, in matters concerning road-related court decisions where the NPRA is a party through the national government’s Ministry of Transport and Communication, or the matter is of relevance to the NPRA.
What personal data do we process?
What type of personal data the NPRA processes depends on the tasks we are to solve.
The personal data the NPRA processes include:
- identification data (e.g. national ID number, name, vehicle registration number, Vehicle Identification Number (VIN), cadastral unit and property unit number),
- contact information (e.g. address, email address, telephone number),
- competence/certification (e.g. in connection with certification of driving instructors and professional drivers),
- health information (e.g. in connection with driving entitlements, road tolls, accident work, disabled parking),
- penalties and administrative sanctions (e.g. in connection with application for operator’s licences, inspection and supervision, contracts signing and contract management),
- photos and videos (e.g. in connection with the issuing of driving licences, automatic number plate recognition (ANPR) and collection of road tolls).
- personal data appearing in court decisions where the NPRA is a party, through the national government’s Ministry of Transport and Communication, or other road-related court decisions involving other road authorities as a party, but which are of relevance to the NPRA. In exceptional cases, special categories of personal data may occur.
Camera surveillance of traffic is mostly organised so as not to record personal data. This also applies to the use of dashboard cameras for the surveying of road conditions and for the inspection of traffic signs, traffic lights and road markings.
How do we process your personal data?
The Norwegian Public Roads Administration is obliged to comply with the Personal Data Act, the Public Administration Act, the Archives Act and the Freedom of Information Act so that your personal data are processed in a manner that is safe, correct and secure.
The Norwegian Public Roads Administration has a number of electronic registers and systems that contain personal data. Examples include:
- Our Customer Register contains information about all our users. Official data about a user are retrieved and updated on a daily basis from the National Registry and the Central Coordinating Register for Legal Entities.
- MIME360 is the NPRA’s case management and filing system. The system is to ensure that cases are processed correctly, in accordance with rules and regulations.
- The Central Register of Motor Vehicles is a national register of the vehicle fleet in Norway. In addition, it is a professional system for the processing of applications about vehicle approval. The system also has a digital solution for the registration of vehicles through vehicle dealers.
- The Driving Licence Register is a national register of driving entitlements and other licences and certificates of competence related to the driving of vehicles.
- Road toll systems are used for the automatic identification of vehicles passing toll collection points, and for the determination of toll rates, discounts and exemptions for each passage, and the collection of road tolls.
- Our Traffic Control Centres’ systems consist of a system for logging incidents on the road, cameras along the road and in tunnels for traffic monitoring, and a telephone system for receiving messages about incidents on the road.
- Accident Analysis systems analyse information about road traffic accidents in order to reduce the number of people killed or seriously injured in traffic.
- Our Land Acquisition system is a system that stores information about the acquisition of property for the purpose of building roads.
- KRIMREG is a system for receiving and processing tips and information about anti-social and criminal activity within the NPRA’s field of responsibility, especially related to road users and vehicles and the management of contracts in which the NPRA is the roads authority and the construction client.
From where do we collect personal data?
The NPRA collects personal data about you in connection with applications and other enquiries. The NPRA also collects personal data from a number of other sources. Examples include other government agencies, such as the Norwegian Tax Administration, the police, the Norwegian Labour and Welfare Administration, and Norwegian Customs.
Moreover, the NPRA collects personal data from contractors and consultants with whom the NPRA have entered agreements, from private individuals who have tipped us off regarding illegal affairs or incidents on the road etc., and from publicly available sources (e.g. websites, social media, observations). Furthermore, the NPRA may collect personal data from foreign authorities in accordance with international legislation or agreements.
The NPRA may also collect personal data from publicly accessible court decisions.
Who will receive your personal data?
The NPRA may disclose your personal data when we have a legal basis to do so.
This includes disclosure
- to data processors and joint data controllers
- to other government agencies (such as the police, emergency services, Labour and Welfare Administration, the Accident Investigation Board Norway, Statistics Norway)
- to other road owners such as county administrations and Nye Veier
- to foreign authorities in accordance with international legislation or agreements and where disclosure is authorised under the Freedom of Information Act and the Public Administration Act etc.
The NPRA also publicises personal data, e.g. in the Operator’s Licence Register.
For how long do we store your personal data?
The NPRA processes your personal data for as long as required. How long this is depends on the type of processing involved. The NPRA also has a record-keeping obligation under the Archives Act. The NPRA thus usually has to store data also after the case processing is completed.
What rights do you have?
As a data subject registered by the NPRA, you have a number of rights.
These include the right to access your data, the right to have incorrect data corrected, the right to have data deleted, the right to restrict processing, the right to object, the right to data portability, the right to withdraw consent, and the right to appeal.
You can find more information about your rights, including your right to appeal, on the Norwegian Data Protection Authority’s website.
There are a few exceptions to these rights. For example, the right to information and access may be suspended when this is required in order to reveal violations of the rules and regulations we administer, and when the data are subject to secrecy under law. There are also exceptions from the right to correction, deletion or restriction of processing. These apply when the NPRA is required by law to store the personal data, e.g. pursuant to the Archives Act.
Special note on profiling and automated decisions
Some types of NPRA processing are fully automated. For example, this applies to a number of self-service facilities such as submitting a Notification of Sale and transferring the registration of a vehicle when it changes owner, as well as to road toll collection. You can always request to have an automated decision reexamined by a case officer. You can also contact the NPRA to present your views with regard to the decision, or to dispute the decision.