The Norwegian Energy and Water Resources Directorate (NVE) has presented a proposal to change the rules on staff screening in relation to employment. This means, among other things, that staff who must have access to classified structures and systems must submit police certificates and must be accredited.
The proposal for a police certificate was previously heard and led NVE to be authorised to regulate the need for a normal police certificate. Now they have used this power.
In the previous hearing we gave answers to the consultation and felt that the privacy consequences had not been assessed and that it was necessary to assess whether it was sufficient to obtain a limited police certificate rather than the ordinary one. A limited police certificate means that the certificate would not contain more penalties than is strictly necessary based on the purpose of the certificate.
An assessment of this was made after our contribution, but the result was that you could get normal police certificates.
It is unclear why the requirements are tightened.
In addition to the police certificate, NVE proposes that personal employment checks include mandatory credit checks.
NVE also proposed mandatory credit controls in 2017. Several consultation bodies were therefore sceptical that the proposal was fit among the purpose and whether there was proportionality between objectives and means. Based on input and, in order to prevent unnecessary processing of personal data, the provision has been changed from mandatory credit checks to the requirement that only credit checks should be used in the absence of other appropriate security measures. Companies have been left to assess the need for credit checks.
It is unclear what has changed since then and why NVE again considers it necessary to tighten credit control requirements.
In our response to the consultation we write that we lack a more in-depth assessment of the privacy implications of the proposal.
horingsuttalelse---forslag-til-endringer-i-kraftberedskapsforskriften