Privacy statement for the Norwegian Safety Investigation Authority
The Norwegian Safety Investigation Authority (NSIA) is a permanent, independent body of inquiry of transport accidents. The purpose of NSIA investigations is to clarify the sequence of events and the factors assumed to be of importance for preventing aviation, marine, railway and road traffic accidents. The NSIA shall not apportion blame or liability.
The NSIA processes personal data to the extent this is necessary for investigating accidents and serious incidents in the transport sector (marine, aviation, railway and road).
The NSIA will process your personal data in a secure manner and in accordance with the applicable data protection regulations.
In the following, you can read about how the NSIA processes personal data and what your rights are when you are registered in our systems.
1. Why does the NSIA process your personal data?
The NSIA collects and uses information, including personal data, in order to perform its work as an investigation board.
The processing of personal data entails, for example, that we collect, register and store relevant information. This information forms part of the factual basis and becomes the object of analysis in investigations that are documented through our public accident reports, in which the NSIA’s assessments and conclusions are also included.
2. What are the legal grounds for processing your personal data?
The NSIA processes your personal data pursuant to the Road Traffic Act Chapter VII, the Norwegian Maritime Code Chapter 18, the Aviation Act Chapter 12 and the Railway Investigation Act with pertaining regulations. The NSIA also complies with the regulations that apply to public administration, including the Public Administration Act, the Freedom of Information Act and data protection legislation with pertaining regulations.
The selection and the process of accidents and incidents to investigate follows from the provisions and regulations that apply to the various branches. In this context, the NSIA is entitled to take relevant material into its possession and access relevant data and information.
Persons with information concerning a case have, upon request, the duty to impart this to NSIA. Information that emerges thorugh such reporting and statements is protected by NSIA’s extended obligation of confidentiality. It is also statutory that it is prohibited to use information provided to NSIA as evidence in criminal proceedings.
The duty of confidentiality does not prevent the information from being further used insofar as consent is obtained from the party entitled to confidentiality, if the information is of a statistical nature or if it is publicly available elsewhere.
The duty of confidentiality does not apply if weighty public considerations indicate that it should be possible to forward the information or that the information is necessary to explain the causes of an accident or incident.
3. Where do we collect information from?
The NSIA collects necessary information from everyone who has information about circumstances that could be important to the investigation. This could be individuals or organisations, public or private sources (national or international) etc. On request and regardless of the duty of confidentiality, everyone is obliged to disclose such information to the investigation authority.
The NSIA also has a right to access private land and property and is entitled to investigate and take into its possession material and infrastructure, wreckages, documents and other things to the extent necessary to perform its mandate. This includes the NSIA being granted access to the results of investigations of persons involved in the accident or incident, and of post mortem examinations of victims. It can also order medical examinations. If necessary, the investigating authority may demand police help.
4. What personal data do we process?
The NSIA collects and processes personal data that is necessary to solve its tasks as mentioned in section 1. The specific personal data that the NSIA processes depends on the type of accident/incident the case concerns, what branch of the transport sector it concerns and what role the person has played in the accident/incident.
This could be, for example:
- Identity (e.g. name, date of birth, place of birth, gender, nationality, passport number)
- Contact details/place of residence
- Health information
- Information from post mortem examination reports
- Education/work experience
- Information about sleeping patterns to assess, for example, fatigue
- Information about relevant movements
- Information from police documents
- Own and other’s photos
- Audio and video recordings and notes from conversations/interviews
5. How do we process your personal data?
The NSIA collects large amounts of information to ensure that it has sufficient grounds to prepare a public report that maps what has happened, why it has happened and how similar incidents can be avoided in future. Relevant information is registered in our case processing system and the rest of the information is erased.
The NSIA can only use your data for the purposes for which we collected them.
6. Who has access to your personal data?
Employees of the NSIA and others who are hired by the NSIA in individual cases collect and process personal data. The data is safely registered in our case processing system or servers. The employees shall only process your personal data when this is necessary to perform their work. In cases where the accident investigation boards of other countries have interests and are involved in the work, information can be shared as long as the extended duty of confidentiality is maintained.
Persons mentioned in the report are not named. Affected parties are normally given an opportunity to state their opinion about relevant parts of the report before it is published on our website.
7. How do we protect your personal data?
We have established procedures and measures to ensure that unauthorised persons do not gain access to your personal data and otherwise that all processing of personal data takes place in accordance with the applicable legislation. The measures include regular risk assessments, adapted technical systems and physical procedures intended to maintain information security, as well as procedures for verifying requests for exercising right of access and other rights.
8. Who do we disclose your personal data to?
The NSIA has an extended duty of confidentiality and can only disclose your personal data to relevant recipients if this is necessary to explain an accident/incident, and if it is in accordance with the relevant transport sector legislation and other regulations for public administration (see section 2). In addition, privacy protection is always taken into account when considering such information.
Persons mentioned in the report are not named. Affected parties are normally given an opportunity to state their opinion about relevant parts of the report before it is published on our website.
9. How long do we store your personal data?
The NSIA stores your personal data for as long as is necessary to solve the tasks mentioned in section 1. Personal data necessary to explain the accident/incident and used in our accident report will be transferred to the National Archives (cf. the Norwegian Archives Act with pertaining regulations). Information not used or not considered relevant is deleted after the case has been concluded.
Persons mentioned in the report are not named. Affected parties are normally given an opportunity to state their opinion about relevant parts of the report before it is published on our website.
10. Who is the data controller?
The NSIA represented by the Director General is the data controller. This means that the Director General is responsible for how the NSIA processes your personal data in connection with the tasks mentioned in section 1.
11. What are your rights?
If the NSIA has collected personal data about you, you have the following rights pursuant to the Personal Data Act:
Access:
You have the right to information about:
What specific personal data we are processing about you
Where they are collected from
What purpose (tasks) they are used for
Whether they have been passed on to others and, if so, who
Correction of errors:
The case processor will often be in ongoing dialogue with the affected parties throughout the investigation to ensure that the correct facts are obtained. If you nonetheless discover that the NSIA has incorrect, outdated or incomplete information about you, you have the right to have the information corrected or updated.
The public accident report is normally not published before the affected parties have had an opportunity to state their opinion about the relevant parts of the report. You will be contacted by the case processor when this stage of the case has been reached.
Right to complain:
If you feel that the NSIA has not processed your personal data in accordance with the regulations, you can file a complaint with the Norwegian Data Protection Authority. See the Norwegian Data Protection Authority’s website.
12. How can you contact the NSIA’s data protection officer?
You may contact us by sending an email or phoning the NSIA’s data protection officer, Trine Reitan, at personvernombud[at]nsia.no or mobile phone (+47) 901 33 820.