Privacy state­ment for the Nor­wegian Public Roads Admin­istration (NPRA)

The NPRA processes personal data that are required in order to fulfil our responsibility for roads and road traffic in Norway. The NPRA processes your personal data in order to carry out tasks such as to plan, build, maintain and operate public roads; collect road tolls and monitor traffic in order to ensure road safety and traffic flow on our roads; approve and register vehicles; issue driving licences, operator’s licences and permits; and carry out inspection and supervision to ensure compliance with our rules and regulations.

The NPRA also processes personal data from closed, relevant cases from the general courts of law. The purpose of this is to establish a precedent archive in order to ensure equal treatment in practice.

The processing of personal data by the Norwegian Public Roads Administration (NPRA) is primarily authorised by Norwegian statutes and their subordinate regulations. These are mainly the Road Act, the Road Traffic Act, the ITS Act, the Act on Testing of Autonomous Vehicles, the Pollution Control Act, and the Personal Data Act.

The NPRA also processes personal data in consequence of obligations laid down in the Working Environment Act, the Public Procurement Act and the General Application Act - all with their subordinate regulations. Furthermore, the NPRA processes personal data in consequence of the rules laid down in the Public Administration Act, the Archives Act, the Freedom of Information Act, the Bookkeeping Act etc.

The NPRA may also process personal data based on legitimate interest, in matters concerning road-related court decisions where the NPRA is a party through the national government’s Ministry of Transport and Communication, or where the matter is of relevance to the NPRA.

What type of personal data the NPRA processes depends on the tasks we are to solve.

The personal data the NPRA processes include:

• identification data such as national ID number, name, vehicle registration number, Vehicle Identification Number (VIN), cadastral unit and property unit number
• contact information  such as address, email address, telephone number
• competence/certification in connection with certification of driving instructors and professional drivers
• health information in connection with driving entitlements, road tolls, accident work, disabled parking
• penalties and administrative sanctions in connection with application for operator’s licences, inspection and supervision, contracts signing and contract management
• photos and videos in connection with the issuing of driving licences, automatic number plate recognition (ANPR), and collection of road tolls
• personal data appearing in court decisions where the NPRA through the national government’s Ministry of Transport and Communication is a party, or other road-related court decisions involving other road authorities as a party, but which are of relevance to the NPRA. In exceptional cases, special categories of personal data may occur.

Camera surveillance of traffic is in principle organised so as not to record personal data. This also applies to the use of dashboard cameras for the surveying of road conditions and for the inspection of traffic signs, traffic lights and road markings.

The NPRA is obliged to comply with the Personal Data Act, the Public Administration Act, the Archives Act and the Freedom of Information Act so that your personal data are processed in a manner that is safe, correct and secure.

The NPRA has a number of electronic registers and systems that contain personal data.  Some examples:

• Our Customer Register contains information about all our users. Official data about a user are retrieved and updated on a daily basis from the National Population Register and the Central Coordinating Register for Legal Entities.
• MIME360 is the NPRA’s case management and filing system.  The system is to ensure that cases are processed correctly, in accordance with rules and regulations.
• The Central Register of Motor Vehicles is a national register of the vehicle fleet in Norway. In addition it is a professional system for the processing of applications about vehicle approval. The system also has a digital solution for the registration of vehicles through vehicle dealers.
• The Driving Licence Register is a national register of driving entitlements and other licences and certificates of competence related to the driving of vehicles.
• Road toll systems are used for the automatic identification of vehicles passing toll collection points; for the determination of toll rates, discounts and exemptions applying to each toll transaction; and for the collection of road tolls.
• Our Traffic Control Centres’ systems consist of a system for logging incidents on the road; cameras along the road and in tunnels for the purpose of monitoring traffic; and a telephone system for receiving messages about incidents on the road.
• Our Accident Analysis systems analyse information about road traffic accidents in order to reduce the number of people killed or seriously injured in traffic.
• Our Land Acquisition system stores information about the acquisition of property for the purpose of building roads.
• E-reg is a system for receiving and processing tips and information about anti-social and criminal activity within the NPRA’s field of responsibility, especially related to road users and vehicles and the management of contracts in which the NPRA is the roads authority and the construction client.  You will find more information about the processing of personal data in E-reg on our Crime tips page.

See also: Crime tips

The NPRA collects personal data about you in connection with applications and other enquiries. The NPRA also collects personal data from a number of other sources. Examples include other government agencies, such as the Norwegian Tax Administration, the Labour Inspection Authority, the police, the Norwegian Labour and Welfare Administration, and Norwegian Customs.

Moreover, the NPRA collects personal data from contractors and consultants with whom the NPRA has entered agreements, from private individuals who have tipped us off regarding illegal affairs, from incidents on the road etc., and from publicly available sources (e.g. websites, social media and observations). Furthermore, the NPRA may also collect personal data from foreign authorities in accordance with international legislation or agreements.

The NPRA may also collect personal data from publicly accessible court decisions.

The NPRA may disclose your personal data when we have a legal basis to do so. 

This includes disclosure to

• data processors and joint data controllers
• other government agencies (such as the police, emergency services, the Norwegian Labour and Welfare Administration, the Norwegian Tax Administration, the Accident Investigation Board Norway, and Statistics Norway)
• other road owners such as county administrations and Nye Veier
• foreign authorities in accordance with international legislation or agreements and where disclosure is authorised under the Freedom of Information Act and the Public Administration Act etc.

The NPRA also publicises personal data, e.g. in the Operator’s Licence Register.

See an overview of our open data: Open data

The NPRA may also share personal data to prevent, detect or sanction criminal offences in our areas of authority as well as work-related crime.

In such cases, the data may be shared with

• other public authorities in cooperation forums
• public contracting clients

Applicable rules: Article 5 GDPR (gdpr-info.eu)

Applicable rules: Article 6 GDPR (gdpr-info.eu)

The NPRA processes your personal data for as long as required. How long this is depends on the type of processing involved. The NPRA also has a record-keeping obligation under the Archives Act. The NPRA thus usually has to store data also after the case processing is completed.

As a data subject registered by the NPRA you have a number of rights. These include the right to access your data, the right to have incorrect data corrected, the right to have data deleted, the right to restrict processing, the right to object, the right to data portability, the right to withdraw consent, and the right to appeal.

You can find more information about your rights, including your right to appeal, on the Norwegian Data Protection Authority’s website.

See also: Norwegian Data Protection Authority

There are a few exceptions to these rights. For example, the right to information and access may be suspended when this is required in order to reveal violations of the rules and regulations we administer and when the data are subject to secrecy under law. There are also exceptions from the right to correction, deletion or restriction of processing. These apply when the NPRA is required by law to store your personal data, e.g. pursuant to the Archives Act.

Some types of NPRA processing are fully automated. For example, this applies to a number of self-service facilities such as submitting a Notification of Sale and transferring the registration of a vehicle when it changes owner, as well as to road toll collection. You can always request to have an automated decision reexamined by a case officer. You can also contact the NPRA to present your views with regard to the decision, or to dispute the decision.