The Data Act 1973

(as amended with effect from January 1, 1989)

Copied from Translation provided by the data Inspection Board of Sweden

Introductory provisions

Section 1 For the purpose of this Act

'personal data means information concerning an individual, 'personal file' means any file, list or other notes kept by automatic data processing and containing personal data referable to the individual concerned,

'person registered' means an individual in respect of whom personal data exists in a personal file,

'responsible keeper of a file' means anyone for whose purposes a personal file is kept, if the file is at his disposal.

Permission, etc.

Section 2 A personal file may be set up and kept only by a person who has applied to the Data Inspection Board and received a license from the Board to do so.

Apart from a license, the permission of the Board is required to set up and keep a personal file which is to contain

1. information as stated in Section 4,

2. information as stated in Section 6, second paragraph, 3. information about persons who have no such association with the responsible keeper of a file as follows from membership, employment, a customer relationship or any comparable relationship,

4. personal data procured from any other personal file unless the data are recorded or disseminated by virtue of a statute, a decision of the Data Inspection Board, or by permission of the person registered.

The first and second paragraph do not apply to a personal file set up by an individual or kept exclusively for personal use.

By setting up of a personal file is meant also the collection of data to be included in the file.

Section 2a The permission of the Data Inspection Board is not required for personal files set up by decision of the Government for personal files set up by decision of the Government or Parliament. Prior- to such decision however, the opinion of the Data Inspection Board shall be procured in regard to a file which is to contain information as stated in Section 2, second paragraph.

Nor is permission required for a personal file received for preservation by a public records authority.

Section 3 The Data Inspection Board shall grant permission to set up and keep a personal file if there is no reason to assume that, with due observance of the regulations issued pursuant to Sections 5 and 6, undue encroachment upon the privacy of registered persons will occur.

In judging whether undue encroachment may occur special attention shall be paid to the nature and quantity of the personal data to be recorded in the file, to how and from whom the data are to be collected, and to the attitude to the file held by, or which may be assumed to be held by, the persons who may be registered. It shall also be specially noted that no other data nor other persons may be registered than in accordance with the purpose of the file.

Section 3a Permission to set up and keep a personal file comprising other than members, employees or customers of the responsible keeper of the file, or persons in similar relationship with the latter, may be granted only if special reasons exist.

Section 4 Permission to set up and keep a personal file containing information that anyone is suspected or has been convicted of a crime or has served a sentence or suffered other penalty for a crime or has been subjected to coercive action under the Act containing Special Regulations concerning Care of the Young (1980:621), the Act on Care of Alcoholic and Drug Abusers in Certain Cases (1988:870), the Act on Provision of Psychiatric Treatment in Detention in Certain Cases (1966:293), the Act on Care of Certain Mentally Retarded Persons (1967:940), or has been the subject of proceedings under the Aliens Act (1980:376), may, only if specially cogent reasons exist, be granted to any other than a public authority which by law or other statute is responsible for keeping a record of such particulars.

Permission to set up and keep a personal file otherwise containing information about anyone's illness, state of health or sexual life, or information that anyone has received financial aid or care within the social services or has been the subject of proceedings under the Aliens Act, may, only if special reasons exist, be granted to any other than a public authority which by law or other statute is responsible for keeping a record of such particulars.

Permission to set up and keep a personal file containing information about a person's race, political views, religious beliefs, or convictions in other respects, may be granted only if special reasons exist. Section 5 In conjunction with the granting of permission to set up and keep a personal file the Data Inspection Board shall issue regulations concerning the purpose of the file. If special reasons exist, the permission may be limited to a certain period. Section 6 If permission is granted to set up and keep a personal file, the Data Inspection Board shall, insofar as required to preclude the risk of undue encroachment upon personal privacy issue regulations governing

1. the collection of data for the file

2. the personal data which may be recorded in the file

3. the automatic data processing procedure

4. the technical equipment

5. the operations on personal data in the file that may be done by automatic data processing

6. notification of persons concerned

8. dissemination and other use of personal data

9. preservation and weeding out of personal data

10. control and security

11. corrections and other actions in the case of incorrect and misleading information.

In judging whether regulations are required, it shall be especially taken into consideration whether the file contains personal data constituting a judgement or other appraisement of the registered person.

Regulations regarding dissemination of personal data may not restrict the duties of public authorities under the Freedom of the Press Act.

Section 6a The provisions of Sections 5 and 6 concerning the duty of the Data Inspection Board to issue regulations apply also in regard to personal files referred to in Section 2a, first paragraph. second sentence, insofar as regulations in the same respect have not been issued by the Government or Parliament.

Duties of the responsible keeper of a file

Section 7 Personal files shall be set up and kept in such a way that no undue encroachment upon the personal privacy of a registered person occurs. In this respect special attention shall be paid to the following points:

Section 7a

The responsible keeper of a file shall have in his possession an up-to-date list ol the personal tiles for which he is responsible. The list shall contain particulars of

The list shall be kept accessible to the data Inspection Board and, at the latter's request, be submitted to the Board.

When a responsible keeper of a file sends a document containing personal data from a personal file to the person registered, he shall at the same time inform the latter of the name of the consignor or of the responsible keeper's licence number issued by the Data Inspection Board.

The provisions of this Section do not apply to a personal file kept by an individual exclusively for personal use or received by a public records authority for preservation.

Section 8 Should there be reason to suspect that personal information forming part of a personal file is incorrect or misleading, the responsible keeper of the file shall institute an enquiry without delay. Incorrect or misleading information shall be corrected, altered or deleted unless there is no reason to assume that this would constitute an undue infringement to the privacy of the registered person.

Should registered information which has been corrected, altered or deleted be handed over to any third party . the responsible keeper of the file shall inform the said third party of the correction, alteration or deletion if the registered person so requests of if a risk exists for undue infringement to privacy.

A registered person who has reported a suspicion that personal information is incorrect or misleading shall be informed of the action taken as a result of the report.

The responsible keeper of the file shall appoint one or more persons to assist the registered person when a suspicion has arisen concerning incorrect or misleading personal information and to report on the action taken as stated above. The name of the person or persons so appointed shall be made available to the general public.

The provisions of this section shall not apply to files which have been handed over to a public records authority preservation. The Data Inspection Board may exempt a responsible keeper from liability under this section

Section 9 If a personal file contains personal data which, in view of the purpose of the file, must be considered incomplete, or if a personal file which constitutes a list of persons omits anyone who, in view of the purpose of the file, must be expected to be recorded in it, the responsible keeper of the file should make the necessary addition. Such an addition must always be made if the omission may be assumed to involve undue encroachment upon personal privacy or a risk of loss of rights. Section 10 At the request of any individual the responsible keeper of the file shall as soon as possible notify him either of the personal data recorded concerning him in the file or that such data do not exist in the file. Such a request shall be submitted in writing and be given under the individual's own hand. If a notification has been given, no new notification need to be given to the same individual until twelve months later.

Notification in accordance with the first paragraph shall be given free of charge to the individual. If special reasons exist, however, the Data Inspection Board may, in respect of a certain kind of personal data or in respect of notification that personal concerning an individual do not exist in the file, allow the charging of a fee.

The first paragraph does not apply to particulars in a personal file which has been received for preservation by a public records authority nor to particulars which by law or other statute, or by decision of a public authority by virtue of a statute, may not be disclosed to the person registered.

Nor does the first paragraph apply if, in respect of a certain kind of personal data, it is manifest that notification may be omitted because there is no risk of undue encroachment upon the personal privacy of the person registered. Notification may be omitted, however, only after permission from the Data Inspection Board.

Section 11 Personal data in a personal file may not be disclosed if there is reason to assume that the data will be used for automatic data processing contrary to this Act. If there is reason to assume that personal data will be used for automatic data processing abroad, the data may be disclosed only after permission from the Data Inspection Board. Such permission may be given only if it may be assumed that the disclosure of the data will not involve undue encroachment upon personal privacy. Permission is not required, however, if personal data are to be used for automatic data processing solely in a State which has acceded to the Council of Europe's convention for the protection of individuals with regard to automatic processing of personal data.

Files kept by public authorities are instead subject to the provisions of the Official Secrets Act (1980:100).

Section 12 Personal data which are referable to the person whom the data concern shall be removed from the personal file when the data are no longer needed having regard to the purpose of the file, unless they are thereafter to be preserved by reason of a provision of law or other statute or by decision of a public authority issued by virtue of a statute. The same applies when the responsible keeper of the file ceases to keep the file-

If a responsible keeper ceases to keep a personal file for which the Data Inspection Board has granted permission, he shall notify the Board thereof. The same applies with regard to such personal file as is referred to in Section 2a, first paragraph, second sentence.

Section 13 The responsible keeper of a file or any other person who has been concerned with a personal tile or with data collected for inclusion in such a file may not without authorization reveal what he has learned from it concerning the personal circumstances of an individual. Files kept by public authorities arc instead subject to the provisions of the Official Secrets Act (1980:100).

If personal data have been disseminated in accordance with regulations as stated in Section 6 or 18 on conditions which restrict an individual recipient's right to pass them on, the recipient or any person who. h1 the recipient's service, has been concerned with the data may not without authorization reveal what he has learned from them concerning the personal circumstances of an individual.

Section 14 A recording for automatic data processing that is used by a public authority for the purpose<, , judicial or administrative proceedings shall be added to the documents in the case, in readable form. unless.'. special reasons dictate otherwise.

Supervision etc.

Section 15 The Data Inspection Board shall supervise that automatic data processing does not cause undue;? encroachment upon personal privacy.

The supervision shall be so exercised that it does not cause greater costs or inconvenience than is necessary.

Section 16 For the purpose of its supervision the Data Inspection Board has the right of admission to any premises where automatic data processing is carried out or where a computer or equipment or recordings for automatic data processing are kept. The Board also has the right of access to documents relating to automatic data processing and may make arrangements for operations of a computer.

Section 17 The responsible keeper of a file shall deliver to the Data Inspection Board the information concerning the automatic data processing that the Board requests for its supervision. This applies likewise to anyone who has charge of a personal file on the responsible keeper s behalf.

Section 18 If the keeping of a personal file has led to undue encroachment upon personal privacy or if there is reason to assume that such encroachment may arise, the Data Inspection Board may, insofar as required, later regulations previously issued or issue new regulations with respect to that which is mentioned in Sections 5 and 6. With regard to a file referred to in Section 2a, first paragraph, the Board may take such a measure only if it is not contrary to a decision of the Government or Parliament.

If protection against undue encroachment upon personal privacy cannot be attained by other means, the Data Inspection Board may prohibit further keeping of the file or cancel a permission granted. This does not, however, apply to files referred to in Section 2a, first paragraph.

Section 19 Abrogated.

Penalties and Damages etc

Section 20 Any person who willfully or by negligence

1. sets up or keeps a personal file without licence or permission under this Act, when such is required,

2. infringes a regulation or prohibition issued pursuant to Sections 5, 6 or 18,

3. disseminates personal data in violation of Section 11,

4. infringes Section 12,

5. delivers incorrect information in performance of his duty to deliver information pursuant to Section 10 or

6. delivers incorrect information in a case referred to in section 17,

shall be sentenced to a fine or to imprisonment not exceeding one year.

A person who willfully or by negligence infringes Section 7a, first or third paragraph, shall be sentenced to a fine.

Section 21 Any person who unlawfully procures access to a recording for automatic data processing or who unlawfully alters or deletes or inserts such a recording in a file shall be sentenced for data trespass to a fine or to imprisonment not exceeding two years, unless the offence is punishable under the Penal Code. Equivalent to a recording in a file is, in this respect, information being transmitted by electronic or similar means to be used in automatic data processing.

Any person who attempts or prepares a data trespass crime shall be sentenced in accordance with the Penal Code, Chapter 23. Should the infraction, if accomplished, be considered as only an offence, the perpetrator must be sentenced in accordance with this paragraph.

Section 22 If a personal file has been set up or kept without licence or permission under this Act, when a licence or permission is required, the file shall be declared forfeited unless this is manifestly inequitable. The same applies if a personal file has been kept contrary to a prohibition pursuant to Section 18, second paragraph.

Section 23 Should a registered person suffer damage by reason of the personal file containing incorrect or misleading information, the responsible keeper shall provide indemnification for the said damage.

Should criminal damage as specified in Section 20, first paragraph, or Section 21 arise, the person committing the said offence shall provide indemnification for the damage.

When evaluating if, and to that extent, damage has arisen pursuant to the first and second paragraph above. consideration shall also be given to damage or to other detrimental effects of a non-pecuniary nature.

Section 24 If the responsible keeper of a personal file or the person who administers it on his behalf fails:ails to grant access to premises or documents pursuant to Section 16 or to give information pursuant to Section 17 . the Data Inspection Board may order him to fulfill his obligations under the penalty of a fine. The same applies if the responsible keeper of a file does not fulfill his obligations under Section 7a, second paragraph,. Ol Sections 8, 9 or 10.

Section 25 Appeal against decisions of the data Inspection Board may be made to the (Government. 1 The Attorney-General may appeal in order to safeguard public interests.

The State and Personal Address File

Section 26 For the purposes stated in this Section there is a State Personal and Address File (SPAR ). ne file is kept by means of automatic data processing

The data in SPAR are used for

1. updating, supplementation and checking of data in other personal files,

2. supplementation and checking of data in general,

3. taking of samples of personal data (sampling).

SPAR may be used by public authorities and individuals.

Section 27 The data in SPAR are collected from the state personal files used for national registration, income tax assessment, and assessment for tax on real property. To these data may be added a note that an individual does not desire direct mail advertising.

The Government may direct that particulars of addresses are collected from the Post Office Administration.

Section 28 A person who requests data from the personal file of a public authority for a purpose referred to in Section 26, second paragraph, 1 and 3, and which can be provided by SPAR, shall be referred to SPAR.

The first paragraph does not prevent a County Tax Authority from allowing public authorities whose responsibilities are confined to the county to use the personal file of the County Tax Authority instead of SPAR.

The Government or, at the Government's decision, the Data Inspection Board may direct that the personal file of a government authority may be used by another authority for the purpose referred to in Section 26, second paragraph, 1.

The regulations in this Section do not restrict the duties of public authorities according to the provisions on the publicity of official documents under the Freedom of the Press Act.