Privacy Statement for the Norwegian Labour and Welfare Administration (NAV)
ABOUT NAV AND PRIVACY
|Updated 15. May 2024
This Privacy Statement applies to the state services provided by NAV. If you have questions regarding privacy related to the services you receive from local authorities at your NAV office, please contact your local authorities.
Innhold
This Privacy Statement applies to the state services provided by NAV. If you have questions regarding privacy related to the services you receive from local authorities at your NAV office, please contact your local authorities.
Who is this Privacy Statement for?
Copy linkLink successfully copiedThis Privacy Statement is for those who apply and receive benefits or services from NAV.
About processing of personal data
Copy linkLink successfully copied- Who is responsible for the way we process personal data?
- What kind of personal data do we process?
- Why do we need personal data?
- How do we process personal data?
- Who do we collect personal data from and who do we disclose it to?
Who is responsible for the way we process personal data?
The Norwegian Directorate of Labour and Welfare is responsible for personal data processed by the state part of NAV.
The local authorities are responsible for personal data processed for the services you receive from local authorities at your NAV office.
Read more about the difference between the state's and the local authorities' responsibilities here: The partnership in NAV (in Norwegian).
What kind of personal data do we process?
NAV processes several types of personal data. Examples of data include name, national identity number, address and other contact information, family relations, employment status, financial circumstances such as income, previous benefits from NAV, and health information.
When you apply to NAV for a benefit or service, we use the information you provide in your application. In addition, we collect information about you from public and private bodies to process your application.
NAV may only disclose personal data to third parties when having the statutory right / legal basis to do so. Third parties may be the Tax Administration (Skatteetaten), the Norwegian State Educational Loan Fund (Lånekassen), the Directorate of Immigration (UDI) and pension funds.
Applications to NAV
When filling out a digital application form, you will be informed, as you fill out the application, of which types of information we collect from or share with others. For other types of applications on nav.no, see the themed overview below for information on how we collect, use, and share personal data.
Select theme and click on the list (pdf). Information on collection and sharing is found in the far-right column. The lists are in Norwegian.
- Unemployment. See unemployment overview (pdf in Norwegian). Covers unemployment benefit, employment scheme benefit, supplementary benefit, courses, wage guarantee, etc.
- Employment, health, and illness. See employment, health, and illness overview (pdf in Norwegian). Covers work assessment allowance, sickness benefit, basic benefit and assistance allowance, care benefit, attendance allowance and training allowance, occupational injury, disability benefit, supplementary benefits, etc.
- Family. See family overview (pdf in Norwegian). Covers child maintenance and advance child support, child benefit, single parent, cash-for-care benefit, parental benefit, care benefit, supplementary benefits, etc.
- Pension. See pension overview (pdf in Norwegian). Covers retirement pension and contractual early retirement pension, child who has lost one or both parents, dependant supplement, survivor’s pension, supplementary benefits, etc.
- Assistive aids and adaptations. See assistive aids and adaptation overview (pdf in Norwegian). Covers ordering scheme, mobility, car, hearing, vision, orthopaedic aids, travel expenses, etc.
- Death. See death overview (pdf in Norwegian). Covers surviving spouse/partner, child who has lost one or more parents, funeral grant, funeral transport, etc.
- To or from Norway. See to or from Norway overview (pdf in Norwegian). Covers assessing and determining rights pursuant to the National Insurance Act. Calculating fees.
Why do we need personal data?
NAV processes applications and administers several welfare schemes for the unemployed, the sick, pensioners, and families. We need personal data to perform the statutory tasks that we have been assigned by the Norwegian Parliament (Storting).
We need personal data to:
We need personal data about you to process your application and to provide you with services and benefits that you are entitled to.
We will only use personal data about you that is necessary for making correct decisions in your case. The types of personal data that are necessary will depend on the nature of the case.
We may also use data you have provided to us in previous cases if this is relevant and necessary to process your case.
Read more about personal data in applications to NAV.
We use personal data when distributing tasks between our employees, following up applications, and ensuring correct payments are made. We also need personal data to provide you with good user support and to correct errors in our IT systems.
We use personal data when we carry out checks to prevent and detect benefit fraud.
We use personal data to compile statistics and analyses. We need this to improve our services, and to provide insight to ministries and other parties about how many who use our services and how the services that we are responsible for function.
We also use personal data to develop and improve systems and processes to provide faster case processing services of higher quality.
When NAV processes personal data, we need a legal basis for processing.
NAV’s processing of personal data is primarily based on statute, such as:
- The Labour and Welfare Administration Act (arbeids- og velferdsforvaltningsloven (NAV-loven)
- The National Insurance Act (folketrygdloven)
- The Public Administration Act (forvaltningsloven)
- The Labour Market Act (arbeidsmarkedsloven)
- The Child Benefit Act (barnetrygdloven)
- The Children Act (barneloven)
- The Advance Payments of Child Support Act (forskotteringsloven)
- The Pension for Fishermen Act (lov om pensjonstrygd for fiskere)
- The Wage Guarantee Scheme Act (lønnsgarantiloven)
- The Cash Benefit Act (kontantstøtteloven)
- The Marriage Act (ekteskapsloven)
- Act on supplementary benefit for persons who have only lived a short period in Norway (lov om supplerande stønad til personar med kort butid i Noreg)
- Act on state subsidies to employees who receive contractual pension in the private sector (AFP Subsidies Act) (lov om statstilskott til arbeidstakere som tar ut avtalefestet pensjon i privat sektor)
- Act on contractual pension for the members of the Norwegian Public Service Pension Fund (lov om avtalefestet pensjon for medlemmer av Statens pensjonskasse)
- Act on suspension of payments following child abduction (lov om stans i utbetalinga etter barnebortføringer)
- Act (No. 21 of 1946) on war pension for military people (lov om krigspensjonering for militærpersoner)
- Act (No. 22 of 1946) on war pension for home force personnel and civilians (lov om krigspensjonering for hjemmestyrkepersonell og sivilpersoner)
- The Act relating to the duty to pay wages during a temporary lay-off (the Mandatory Wages Act) (permitteringslønnsloven)
How do we process personal data?
We process personal data about you by, for example:
- collecting data from you, other public bodies, or NAV's own registers
- registering the data
- collating and adapting the data
- processing the data to generate synthetic data
- making decisions and disbursing payments
- storing the data
- disclosing personal data about you to other public bodies
- making automated decisions
As a government agency, NAV has a statutory duty pursuant to the Norwegian Archive Act to store the data, including after case processing has concluded.
Data which we do not have a statutory duty to store will be deleted when no longer required.
Everyone who works at and for NAV has a duty of confidentiality regarding all data pertaining to you. The duty of confidentiality also applies after an employee ceases working for NAV.
NAV only uses personal data about you when this is necessary for performing our tasks. There are strict access controls for which employees who are granted access to the data. When the employees work in computer systems, searches and changes are logged and can be subsequently traced.
There are many areas in which NAV enters into agreements with suppliers to perform tasks on behalf of NAV. This applies, for example, to IT providers and organizers of labour market measures.
We enter into agreements with the suppliers to regulate how they process personal data on behalf of NAV. This means that they cannot use the personal data for purposes other than what has been agreed to with NAV.
When we use external suppliers, we set strict requirements for security, controls, and documentation to protect your personal data. The suppliers have the same duty of confidentiality as NAV employees.
NAV manages large amounts of personal data, and this places high demands on security.
NAV has established a dedicated management system to safeguard information security requirements. This includes physical security, security in IT systems, risk management, and plans for emergency preparedness and crisis management.
Who do we collect personal data from and who do we disclose it to?
We collect and disclose personal data from and to other public or private bodies.
Examples of such bodies are the Norwegian Tax Administration, the Norwegian Health Economics Administration (HELFO), the Norwegian Armed Forces, pension schemes, research institutions and Statistics Norway. Other examples are employers and health care personnel.
The specific personal data we share depends on the particular scheme. For example, we collect your income data from the Norwegian Tax Administration to calculate your benefits. Another example is that we have a statutory duty to provide the Norwegian Armed Forces with information about the health of people of conscript age. The purpose of processing this information is to determine who is ineligible for conscription due to clear disqualifications.
We disclose personal data about you to research projects. We assess the research projects and the amount of information needed before disclosing the data. We do this to ensure that the researchers only receive information they need.
We may also collect and disclose personal data from and to social security authorities in other EU and EEA countries. The same applies to countries outside the EU and EEA with whom we have social security agreements.
Among other things, the purpose of exchanging personal data is to ensure that you are granted the same rights as citizens of the country in which you are residing.
Your rights
Copy linkLink successfully copiedYou have several rights when your personal data is registered with us.
You have the right to receive comprehensible information regarding:
- how the data will be processed
- when we collect personal data from you
- the purpose for which the personal data will be used
- who we disclose the personal data to
- the rights that you have
You have the right to access:
- the personal data we have registered about you
- information about where we collected the personal data from
- what we will use the data for
- who we disclose the data to
- how long we store your data
- which NAV employees have seen your personal data in our professional systems
You can log on to nav.no to access much of the personal data NAV has registered about you. You will need to contact us to access additional personal data.
If you are a party to a case, for example, a child maintenance case, you have the right to access the case documents. In cases where you are not a party, you will have the right to access documents that NAV is obligated to disclose to the public (in Norwegian) pursuant to the Norwegian Freedom of Information Act.
You can request that data about you is corrected if the data is incorrect or misleading. You may also add data about you if it is incomplete. It is important that the data we have about you is correct and up-to-date to ensure, among other things, that your case is correctly processed.
In rare instances, you may be entitled to have the data about you deleted. For us to delete personal data about you, this presupposes that NAV does not have a statutory duty under the Norwegian Archives Act or other legislation to store the data.
In some instances, you have the right to ask us to restrict how we process your personal data. If you have this right, your data will be stored, but not used by NAV.
In some instances, you may have the right to object to our processing of your personal data. We will then be required to cease processing this data, and the data might be deleted.
You can request to transfer a copy of the personal data registered about you to yourself or to another private or public body. This is known as data portability.
You may receive a copy or request a transfer of your personal data if NAV processes the personal data based on a consent from you. This also applies if the processing is automated or if the processing is based on a contract. As an alternative to transferring your data, you may request access (more information in the previous part concerning access) and receive a copy of your data.
To ensure efficient processing, NAV may automate the evaluation of some benefit applications. When you apply for or are granted benefits or financial support from NAV, you have the right to be notified if NAV uses automated processing based on your personal data to evaluate your application or make a decision.
Automated evaluations of applications may imply that no case worker has been involved in the assessment of your case. Your application may be processed based on the information you provided in your application and other relevant information we have registered about you.
The collection of information and the underlying logic behind automated decisions will be based on the conditions of the benefit in question, as defined by laws and regulations.
You cannot object to automated evaluations of applications, but if you disagree with the decision, you have the right to appeal it. Read more about your right to appeal.
Your appeal will be processed by a case worker. You always have the right to demand access to the criteria on which the processing of your case is based.
Read more about automated evaluations of applications in NAV.
Contact NAV
Copy linkLink successfully copiedIf you have questions regarding your rights or have more questions concerning privacy, please contact us.
We will respond to inquiries from you regarding personal data free of charge and no later than within 30 days.
NAV’s data protection officer can provide you with advice and guidance concerning how we process personal data and assist you in safeguarding your privacy interests.
See how to contact NAV's data protection officer here.
You can file a complaint with the Norwegian Data Protection Authority
Copy linkLink successfully copiedYou have the right to file a complaint with the Norwegian Data Protection Authority if you believe that the way we process personal data is in violation of the privacy regulations.
How to complain to the Norwegian Data Protection Authority.
You can claim compensation
If you have suffered damage as a result of your personal data being misused, processed illegally or other infringements, you may be entitled to compensation pursuant to Article 82 of the General Data Protection Regulation (personvernforordningen) and Section 30 of the Personal Data Act (personopplysningsloven). If you believe that you may be entitled to compensation, the claim for compensation must be brought before a court.
You can let a non-profit organisation represent you
You can let a non-profit organisation represent you. The non-profit organisation can represent you for example by complaining on your behalf. More information about the requirements for the non-profits and how they can represent you is written in Article 80 of the General Data Protection Regulation (personvernforordningen).