All processing of personal data at Bane NOR will take place in accordance with Norwegian legislation, including the Norwegian Data Protection Act and other legislation that governs our activities.
General information about the processing of personal data at Bane NOR
Bane NOR is responsible for the planning, construction, administration, operation and maintenance of the national rail network, traffic management and administration and development of railway property.
This involves processing personal data relating to our own employees, employees of suppliers and other business associates, tenants and passengers.
All personal data that is processed is necessary for us to deliver the statutory or appropriate services required to fulfil our social mission in an efficient and reliable manner.
Bane NOR, represented by the CEO, is the data controller for all personal data processed by Bane NOR.
Legal basis for the processing of personal data
All processing of personal data at Bane NOR is performed pursuant to Norwegian legislation. This could be governed directly through the Norwegian Data Protection Act or other legislation.
As a state-owned company and manager of the national railway infrastructure, our processing of personal data is mostly based on laws and regulations governing railway operations and safety in and adjacent to the railway.
Personal data security
When Bane NOR processes your personal data, the data is processed securely so that the data is protected against unauthorised access. Your personal data can only be accessed by employees acting in an official capacity.
Data processors and the sharing of personal data
Bane NOR uses third parties, for example to operate several of our central IT systems. When such third parties process personal data on behalf of Bane NOR, we enter into a data processing agreement with the third parties to ensure that the data is not used for anything other than the intended purpose.
All personal data is processed and stored within the EU/EEA.
In some cases, Bane NOR will disclose personal data to third parties. Examples of such third parties include companies that provide assistance to passengers with special needs, the Norwegian Tax Administration or the public authorities.
Personal data shall be stored for as long as necessary to fulfil the purposes for which the data was collected or to comply with statutory requirements or legal obligations, including the Norwegian Archives Act and accounting legislation. We also store personal data for as long as necessary to fulfil any agreement we have entered into with you or for reasons of security.
Important processing of personal data at Bane NOR
Here are some of the most important types of processing of personal data that occur at Bane NOR. This overview is not exhaustive.
Bane NOR uses CCTV surveillance with video recordings at many of its stations, platforms and facilities in order to ensure safety and prevent damage and crime. Bane NOR has a legal responsibility to maintain safety in and adjacent to the Norwegian railways.
The content, name and contact details associated with all enquiries to our customer service centre via phone or e-mail will be registered so that we can respond to the enquiry.
Passengers requiring assistance may contact the customer service centre to book such assistance. When booking assistance at platforms, you will need to provide information about the type of assistance required, as well as the time, place and contact details. In order to provide this service, the necessary personal data must be disclosed by Bane NOR to those that will provide the assistance: this could be a train company, security guards or taxis.
Number plate registration
Bane NOR is required by the Norwegian Ministry of Transport to facilitate a satisfactory parking service and has the mandate to regulate demand through capacity and price mechanisms. The Property division will occasionally carry out number plate registrations and will also count the number of child seats in cars parked at selected stations. The number plates on the parked cars will be linked to the registered address in order to indicate the distance between home and the station. Together with information about the number of child seats, which indicates how early in the morning the parking facilities are likely to be filled, as well as the general occupancy at the parking facility, Bane NOR will obtain a good basis for assessing, improving and adapting the parking service.
When number plate registration takes place, signs will be erected to provide information at the parking facility in question before registration takes place so that passengers can choose to park elsewhere during periods of number plate registration if they do not wish to be included.
Bane NOR offers an open wireless network at many of its stations. When you use this network, your IP address will be registered and stored as part of the network security efforts. Please refer to the security policy that is displayed at the time of connecting.
Bane NOR has an online portal for reporting unacceptable circumstances. Whistleblowing can be done anonymously or using your name and contact details. Whistleblowing reports may include all types of personal data. All whistleblowing reports are treated confidentially and in accordance with strict rules.
Personal data is recorded in connection with key administration and entry/exit for anyone authorised to access Bane NOR’s buildings and facilities. Personal data is also registered for any visitors in connection with visitor registrations.
Bane NOR receives personal data relating to individuals from suppliers, contractors and train operators. Such personal data relates to their contact details, CVs, expertise and other information necessary for us to fulfil our obligations as a contracting authority and property manager.
We also register individual access to facilities or buildings, entry/exit and user access to data systems.
Bane NOR uses WebCruiter in connection with recruitment. Here, applications and CVs are registered and processed before being transferred to the archive. All job applications are recorded in Bane NOR’s mail record.
Bane NOR will sometimes also use recruitment companies, as well as online tools to assess suitability for a position. Credit checks and impartiality checks are also carried out for certain positions using authorised service providers.
Bane NOR uses SuccessFactors for the recruitment of employees. Here, basic personal data is registered from applications and CVs and the data is later transferred to the archive system for record-keeping.
In some cases, Bane NOR will also use external recruitment firms, as well as testing tools to assess suitability for a position. Background checks, credit checks and impartiality checks are also conducted for most positions using authorised service providers.
Bane NOR uses the Public360 archive and case management system, with electronic record-keeping and storage of documents.
Special security measures and procedures have been implemented for information contained in the archive, such as personal data that must be protected.
Bane NOR is subject to the Norwegian Freedom of Information Act and has a public mail record. Personal data that must be protected pursuant to law will be censored.
Bane NOR processes personal data relating to its own employees for the purpose of payroll and to fulfil its obligations as an employer. Information will primarily be obtained from data subjects, but also from e.g. public registers.
Employees in certain types of positions and roles may be subject to credit checks and must therefore register information about their financial circumstances and any familial or other links to businesses included on the impartiality register. The impartiality register will be used to prevent conflicts of interest in connection with procurements and to identify other circumstances in which conflicts of interest may occur.
Anyone whose personal data is registered by Bane NOR has the right to:
- access to their own personal data
- correct errors in their own personal data
- restrict Bane NOR’s processing of personal data if such data is incorrect, the data subject wishes to inspect the data or the data subject believes that we can fulfil our obligations by processing less data
- erase their own personal data if the required purposes are no longer valid and there is no legal requirement/legal basis for continued retention.
- oject to processing in cases where Bane NOR processes personal data for the purpose of pursuing a legitimate interest or in cases where the processing of personal data is necessary to fulfil a task that is in the public interest.
Please do not hesitate to contact us concerning the aforementioned rights
Contact and complaints
Please contact us via e-mail if you would like to exercise your rights as a data subject.
Bane NOR’s Data Protection Officer
Complaining to the Norwegian Data Protection Authority
You have the right to complain about our processing of personal data to the Norwegian Data Protection Authority. Please visit the Norwegian Data Protection Authority’s website for further details.
The Norwegian Data Protection Authority (opens in a new tab)