Privacy Policy – Norges Bank Pension Fund

Data Controller

The data controller is the entity that determines the purpose of processing your personal data.

Norges Bank Pension Fund, represented by the Managing Director Lars Hammersbøen, is responsible for the pension fund’s processing of personal data. Tasks may be delegated, but responsibility cannot.

We will always ensure that personal data is processed in a secure and lawful manner and will only use such information for explicitly stated and legitimate purposes, in accordance with applicable legislation.

This document provides information on how the pension fund collects and uses personal data.

Data Processors

The pension fund has entered into agreements with subcontractors who may need access to information about you. These are referred to as data processors.

Our subcontractors process your data on behalf of the pension fund and may not use the data for any other purposes. When we share data with our subcontractors, this is not considered a disclosure of personal data. Such sharing is regulated by data processing agreements. Our subcontractors are bound by confidentiality obligations.

Purpose of Processing Personal Data

Through an agreement with your employer, you have both the right and the obligation to be a member of the pension fund.

Personal data is necessary for the pension fund to fulfill its obligations to you as a member of the pension scheme, to inform you about the services you receive and the rights you have with us, and to provide good customer service. We also process personal data to comply with legal obligations imposed on the pension fund by law.

In certain cases, we may also process data relating to your closest family members, for example in connection with survivor’s benefits.

The pension fund does not make automated decisions, meaning decisions based solely on automated processing. Personal data is also not used for marketing or profiling.

Collection of Personal Data

Personal data refers to information and assessments that can be linked to you as an individual, such as name, national identification number, address, telephone number, income information, and similar data.

In many cases, the pension fund collects personal data directly from you, for example when you apply for pension benefits. You are not obliged to provide this information; however, without it, we may be unable to process your case, and you may lose your rights.

The pension fund also collects data from other sources, including:

• Your employer, for information such as name, address, salary, and employment percentage, to register and continuously update your pension accrual
• NAV (the National Insurance Scheme), for coordination of occupational pension and simulation of expected pension payments if requested
• Other pension providers, for information about pension rights earned with them to ensure correct calculation of your total pension
• Your healthcare providers, for health data based on your written consent, to assess applications for disability pension
• The Tax Administration, for tax data to ensure correct tax deductions
• The National Population Register, for address data to ensure important information reaches you (including life certificates)

Disclosure of Personal Data

The pension fund discloses personal data to:

• Your employer, regarding insurance premiums paid on your behalf and information about pension benefits, retirement timing, accrual periods, etc.
• Other pension providers, regarding name, national identification number, accrual periods, paid premiums, etc., to ensure correct pension calculations and to transfer membership if your employer changes pension provider
• The Tax Administration, for reporting pension payments
• NAV, to ensure correct calculation of your pension
• Public authorities, where required by law or legal authority
• Private occupational pension schemes, for correct premium calculations in accordance with Chapter 8 of the Occupational Pensions Act

Duty of Confidentiality

The pension fund is subject to a duty of confidentiality regarding your personal data. This means that data cannot be disclosed to others unless you consent or there is a legal basis for disclosure.

Consent must be explicit, voluntary, and informed, ensuring that you understand what data is involved and to whom it is disclosed. Personal data may also be disclosed to public authorities or other third parties where required by law.

Your Rights – Access, Rectification and Erasure

You have the right to be informed about how we process your personal data. You also have the right to access your personal data and to request correction if the data is inaccurate or incomplete. You may request deletion of data that is no longer necessary.

If you would like more information about how we process your personal data, please contact the pension fund. You can have your questions answered and receive assistance with submitting an access request. Requests for access must be made in writing.

We will respond as soon as possible, and no later than 30 days after receiving your request. If special circumstances make it impossible to respond within 30 days, we will provide a preliminary response explaining the delay and indicating when you can expect a full reply. We do not charge a fee for handling access requests.

The pension fund will delete personal data when it is no longer needed for the purpose for which it was collected. As a rule, we store data as long as your rights under the pension scheme exist. In addition, data is retained to ensure correct premium calculations, technical provisions, and future pension benefits. Data that must be retained by law, for example under accounting legislation, will not be deleted until the statutory retention periods have expired.

Security

The pension fund has implemented measures to protect your data against unauthorized access, use, alteration, and unlawful destruction. Access to personal data is restricted, meaning that only those who need access to perform their duties are granted it.

Complaints to the Data Protection Authority

If you believe that the pension fund processes your personal data in violation of applicable regulations, we encourage you to contact us. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.