Personal data is information that can be linked to an individual person. This could be, for example, your name, address, telephone number, national ID number, etc.
- User support
- Your rights
- Rectification or supplementation
- Right to object
- Restriction of processing
- Complain to the Norwegian Data Protection Authority
The Norwegian Labour Inspection Authority has overall responsibility for issuing HSE cards under the The Regulations concerning HSE cards at construction sites (forskrift om HMS-kort på bygge- og anleggsplasser) and The Regulations on official authorisation of cleaning service enterprises and on procurement of cleaning services (forskrift om offentlig godkjenning av renholdsvirksomheter og om kjøp av renholdstjenester). This is therefore a task that we are required to perform by the regulations and in order to exercise this official authority it is necessary that we process personal data, cf. Article 6 (1) (e) of the GDPR.
The Norwegian Labour Inspection Authority, represented by the Director, is the data controller. Evry Card Services AS is our data processor and handles HSE card orders and issues HSE cards on our behalf. We collect various kinds of personal data to enable us to process HSE card orders and issue HSE cards. A more detailed description of this is provided below. Unless otherwise indicated below, all data is stored at Evry Card Services AS.
The person ordering HSE cards on behalf of their enterprise must log in using their national ID number/D number to the ID portal via the website hmskort.no. On login, the name and contact details are retrieved from the Norwegian National Registry. Data is also recorded at enterprise level, such as whether the enterprise is registered in the Register of Employers and Employees (the Aa Register), the VAT Register and other registers, as well as payment information. Payments made by bank or credit card are processed by DIBS. No credit card information is stored at the Norwegian Labour Inspection Authority or Evry Card Services AS. Other data is stored in our systems.
When an enterprise has logged in to the ordering system, information about the name and national ID number/D number is retrieved from the Register of Employers and Employees (the Aa Register) for all employees at the enterprise in question. In addition, data concerning nationality and gender is obtained from the Norwegian National Registry.
The enterprise must submit a photograph of the person for whom an HSE card is being ordered and a copy of his or hers identification paper. This is collected from the employee themselves via a link they are sent or in the My identity app, or by the orderer uploading a photograph and a copy of the identification paper in the ordering system.
When HSE cards are ordered for employees in the cleaning industry, data will also be obtained from the Norwegian Directorate of Immigration concerning the residence permits of foreign nationals from countries outside the European Economic Area (EEA).
The data of employees will be stored for as long as a valid employment relationship exists. The data of employees with an HSE card registered in their name is stored in our HSE card register. The photograph, copy of identification paper and information about residence status are deleted 26 months after the employee was last issued with an HSE card.
People and bodies outside the Norwegian Labour Inspection Authority and Evry Card Services AS can perform various kinds of searches in the registers, such as checking whether there is a valid HSE card registered for an employee. This applies to construction clients and purchasers, for example, but others may also be permitted to perform various searches. Information is also provided in those cases where we are obligated to do so by law or regulation, for example in the event of a right of access request.
The website www.hmskort.no is owned by the Norwegian Labour Inspection Authority. Evry Card Services AS is our data processor and develops and maintains the web pages.
When you make use of user support via hmskort.no, you will be put into contact with Evry Card Services AS, either by telephone or via a chat function. If you use the chat function, you will have the option of having your chat emailed to you afterwards. The content of telephone calls or chat conversations will not be stored in our systems.
A cookie is a small text file that stores your data from the page you are viewing. The text file contains an ID that is used to identify a user who is logged in to the website.
There are two types of cookie. One stores the file on your PC for an extended period. This is used, for example, for features which indicate new content since the last time the user visited a page. The second type of cookie, called a session cookie, is stored only temporarily for as long as you visit the website.
The cookies we use are listed below:
- ASP.NET_SessionId – stores user information about the session, such as authentication.
- ga, _gat and _gid – linked to Google Analytics, which is used to generate usage statistics.
If we have recorded personal data about you, you may have various rights under personal data legislation. You will find information below about your rights, when they apply and how to exercise them.
Under personal data legislation, you have the right of access to your own personal data. Personal data is information that can be linked to you as an individual. This may be, for example, your name, address, date of birth or workplace. If there is any other data you wish to see, such as information about someone other than yourself, you may be entitled to access under public access legislation.
In some cases, you can require your personal data to be erased. Not all data is subject to your right to have data erased. You can request erasure if:
- You object to the use of your personal data. More information about this right is provided below
- You have previously consented to our recording of your personal data and you now wish to withdraw your consent
- The data has been obtained unlawfully
- We have a legal obligation to erase the data
Rectification or supplementation
If you believe that the data we have stored about you is inaccurate, you can require it to be corrected or supplemented with additional information. If you request rectification or supplementation, you must indicate how the data is inaccurate.
Please note that the data collected from various public registers cannot be rectified by the Norwegian Labour Inspection Authority or Evry Card Services AS. If data in the Register of Legal Entities, the National Registry, the NAV Aa Register, at the Central Office for Foreign Tax Affairs (SFU) or at the UDI is inaccurate, the necessary changes must be made to the respective registers where the data is recorded.
Right to object
In some cases, you can object to the processing of your personal data. This right is limited, however, and must be based on grounds relating to your “particular situation”. This means that there must be circumstances relating to you and your life that enable you to oppose the processing. This right applies only in those cases where the basis for the processing is
- balancing of interests,
- performance of a task carried out for reasons of public interest, or
- the exercising of official authority.
The processing of personal data in connection with HSE card orders is carried out on the basis of the exercising of official authority.
Restriction of processing
Restriction of processing means that we cannot use your data without your consent. You may wish to request restriction of processing if you have required rectification of your data. The processing can then be restricted until it is determined whether or not the data is to be rectified.
Complain to the Norwegian Data Protection Authority
If you believe that we have acted in contravention of personal data legislation, you can complain to the Norwegian Data Protection Authority. However, we recommend that you contact us or our data protection officer before submitting any complaints to the Data Protection Authority.
If you have any questions in relation to our processing of personal data or if you wish to request access, rectification or erasure or to exercise any of the other rights described above, please contact:
The Norwegian Labour Inspection Authority