Here you will find information about what personal data we collect, why we do this, and your rights related to the processing of personal data.

Data controller

The Director General of the Norwegian Environment Agency is the data controller for the processing of personal data related to you.

Privacy regulations in the Norwegian Environment Agency

Privacy is an important concern for you as a user of our services and for us in the Norwegian Environment Agency. We are committed to protecting and respecting your privacy.

When processing personal data, the Norwegian Environment Agency must comply with the Personal Data Act and the General Data Protection Regulation (GDPR 2016/679).

We will mainly collect personal data that are directly registered by you as a user. When we collect information from third parties, for example from the National Population Register, you will be notified.

Note, however, that you will not be notified if such data collection is required by law, notification is impossible or disproportionately difficult, or it is evident that you are already familiar with the information to be contained in such a notification.

If we seek to obtain from you any information that is not required for the performance of the contractual relationship that arises when you register as a user of our services, we will first inform you that providing such information is voluntary and declare the purposes for which the data will be used.

Why we process your personal information

The Norwegian Environment Agency’s primary objective for processing personal information is to attend to our administrative responsibilities in the areas of climate, natural diversity, outdoor life and pollution.

We process personal information to the extent this is required or permitted by prevailing legislation.

We collect the following types of personal data and process them for these purposes:

• To distribute newsletters and information about our activity
  For this purpose we collect your email address and process it in line with the agreement that you enter into with us when you subscribe to the newsletter and confirm that you wish to receive it. We are prohibited from passing your email address on to others or using it for purposes other than distributing the newsletter. You can unsubscribe by clicking on a link in the newsletter you have received.
• To respond to enquiries
  We process your name, telephone number, email address and any other personal information that may pertain to the enquiry. After a balanced consideration of interests, we decide whether some of this information needs to be temporarily stored. In our assessment, this is often necessary to help our users with their enquiries.
• To obtain information about the use of our website
  After a balanced consideration of interests, we have decided to use cookies to process personal data. In our assessment, this is necessary for us to be able to adapt the website to the users. However, we safeguard your privacy by using this information exclusively for statistical purposes. The resulting statistics do not permit identification of you as an individual.

Information on staff members and job applicants

Staff members

The Norwegian Environment Agency processes employee data to manage wage payments and working conditions. We register the information necessary to pay wages, for example background data, wage level, time sheets, tax rate, tax residence and trade union membership. Other information on employees includes job description and facilitation of the employee’s job situation.

The legal basis for such processing is Article 6 n. 1 b) of the General Data Protection Regulation (GDPR): processing is necessary for the performance of a contract to which the data subject is party.

Furthermore, we register information about persons who enter and leave the Norwegian Environment Agency’s premises and in the context of access management to our IT systems. This information is collected from the employees themselves.

Information is disclosed to others only in connection with wage payments and other mandatory forms of data processing. Our deletion procedures for personal data comply with the Accounting Act and the Archives Act. Information on names, positions and areas of responsibility is considered to be in the public domain and can be published on our website.

All former and current employees have a personnel file in our archive system. Here, documents including their job application are archived/stored. Personnel files must be retained (meaning that the job application is not deleted or destroyed). Personnel files are extracted when the employment relationship ceases and deposited with the National Archives of Norway. Access is restricted to official purposes only.

Job applicants

When you apply for a job with the Norwegian Environment Agency, we need to process information about you in order to assess your application.

The legal basis for such processing is found in Article 6 no. 1 b) of the GDPR: processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract.

If your application contains special categories of personal data, our legal basis is Article 9 no. 2, paragraphs b) and h) of the GDPR.

All job applications are registered in the Norwegian Environment Agency’s mail records. They are stored in our electronic archives for approximately one year before they are deleted. All other documents, such as lists of applicants and recommendations, as well as all job applications at the level of head of department, are retained.

Disclosure of personal information

Your personal data will be disclosed to public authorities and other third parties when mandated by a statutory duty or right to disclose.

Disclosure may also be made to other parties insofar as this is necessary to safely comply with administrative responsibilities that involve you. Transfer of personal information to our data processors is not considered disclosure.

The Norwegian Environment Agency is subject to the Freedom of Information Act, which means that our case documents, records and similar documentation as a rule will be open to access. Furthermore, requests for access may include alignments of data that are electronically stored, whenever this can be done by simple methods.

The Norwegian Environment Agency will disclose documents and alignments of data in accordance with the Freedom of Information Act when access is requested, except when documents, records or alignments contain information that is confidential by law or should be exempt from public access pursuant to the Freedom of Information Act.

In such cases, the Norwegian Environment Agency will consider whether partial access to the information can be granted, pursuant to the obligation to consider extended public access. Confidential information will not be disclosed.

Transfer of personal data to other countries

We do not transfer personal information to countries outside of the EU/EEA area.

How we protect your data

We give high priority to protection of your personal data. We continuously endeavour to protect personal data and other confidential information.

Our safeguards encompass physical, technical and administrative measures, including protection of personnel, information, IT infrastructure, internal and public networks, as well as office premises and technical facilities.

Security work also includes reviews of various factors such as risk exposure, available technology, business needs and statutory provisions at regular intervals. This ensures that our security precautions remain consistently adequate, for example enabling us to prevent unauthorised access to personal data.

Use of data processors

In some cases, the Norwegian Environment Agency uses external data processors to collect, store or in other ways process personal data on its behalf.

In such cases, we enter into an agreement with the data processor to ensure that the processing of information complies with the data protection regulations and our own requirements for processing of personal data.

The use of data processors is not considered disclosure of personal information.

Retention

We delete or anonymise your personal information when the objective of each processing procedure has been achieved, unless the information shall or can be lawfully stored beyond this time.

This means, for example, that personal information that we process based on your consent is deleted if you withdraw your consent.

Your rights when we process your personal data

You have the right to request access to, correction or deletion of your personal data held by us. Furthermore, you have the right to demand restricted processing, appeal against processing and make use of the right to data portability.

You can read more about these rights on the web pages of the Norwegian Data Protection Authority.

In addition to requesting access into registered personal data, you can request a description of the types of personal data that we process and more information about the way in which these data are processed.

To exercise your rights, send a request by email to the Data Protection Officer, Norwegian Environment Agency. We will respond to your enquiry as soon as possible and no later than within 30 days.

Before responding to your enquiry we will ask you to confirm your identity or provide more information. We do this to make sure that access to your personal data is given only to you, and not to others who attempt to pass themselves off as you.

Complaints

Appeals against the Norwegian Environment Agency’s processing of your personal data can be sent to the Norwegian Data Protection Authority.

Amendments

If we make changes to our services or if amendments are made to the regulations that pertain to the processing of personal data, this may cause the information provided on this web page to be updated.

Updated information will be easily accessible on this web page at all times.

The Data Protection Officer of the Norwegian Environment Agency

• Email: personvernombud@miljodir.no

We will respond to your enquiry as soon as possible and no later than within 30 days.