sou · GLB339d4 · 1998-01-01 00:00:00 — Bilaga 6: Litteraturförteckning 863 , ; rekommendationer – Allmänna råd och andra uttalanden på skatteområdet, 1995 ; Principer för prissättning av informationstjänster, RRV 1995:64 Seipel, ; ADB-upptagningars offentlighet – Rapport till Data- och offentlighetskommittén, 1988:1 (intagen som bilaga 2 till SOU 1988:64) Seipel, ; Juristen och datorn – Introduktion till rättsinformatiken, 5 uppl., 1994 Seipel, ; Offentlighetens begrepp – TF, ADB och allmänna hand- lingar, 1983:8 ; Data och integritet – Allmänhetens kunskaper och attityder allmänt och till SCB, 1985 ; Datorvanor 1995 – Undersökning gjord på upp- drag av , 1995 ; SCB och allmänheten – Resultat från en intervju- undersökning , 1977 ; SCBs image 1986 – En enkätundersökning, 1987 , ; Normgivningsmakten enligt regeringsform, Andra upplagan, 1989 , ; Tryckfrihetsrätt och annan yttrandefrihetsrätt, 11 uppl., 1995 Strömholm, ; Integritetsskyddet – Ett försök till internationell läges- bestämning i SvJT 1971 s. 695 ff. Suviranta, ; Workers Privacy in i , volym 17, nr 1, 1995, s. 45 ff. Toppledarforum; Elektronisk post och katalog i offentlig förvaltning – En förstudie, 1995 Toppledarforum; Offentlighet & IT – Vägledning för den offentliga förvalt- ningen, Statskontoret 1995:14 Toppledarforum; LEXIT – Förstudie, 1995 SOU 1997: 39 BILAGA 7: SUMMARY IN ENGLISH SOU 1997: 39 Bilaga 7: Summary in English 867 INTEGRITY RIGHT-OF-ACCESS INFORMATION TECHNOLOGY A new Protection Act Our task has been to conduct a review of the current Data Protection Act which has been in force since 1973. The aim has been to produce modern, technically independent legislation to protect personal integrity in the processing of personal information. The draft we now submit for an entirely new Protection Act is largely based upon a recent EU directive in this field. A prerequisite for being able to submit a draft law of this kind was that the directive should be in line with what is protected under the Swedish constitution or what is otherwise of particular importance from a Swedish point of view. The new legislation must not impinge upon the constitutional right for every citizen to have access to documents and data held by authorities (the right-of-access principle), nor upon freedom of expression or freedom of the press. This prerequisite has been fulfilled. participation in the final negotiations enabled viewpoints to be taken into con- sideration in the directive. We propose unambiguous provisions in the new Protection Act which make clear that the Act should not be applied to an extent which would curtail rights protected by the constitu- tion. Accordingly the proposed Act neither affects nor changes these rights. In common with the EU directive the proposed legislation is based upon regulation of the actual handling of data containing personal infor- 868 Bilaga 7: Summary in English SOU 1997: 39 An alternative would be to allow the handling of personal infor- mation to remain largely free, only seeking to prevent any handling which might be deemed as misuse of that information. With due regard to the un- ease which many people increasingly feel towards collections of electronic data relating to themselves, we have decided that the time is not right to allow largely unrestricted handling of computer based personal informa- tion. Neither would fulfil its international commitments if we were to choose a model entirely different from that of the EU directive. How- ever, we consider that, in the long term, a policy of constraint and legal steps against misuse would be preferable to regulation of a kind of data handling which virtually anyone can engage in. The proposed Protection Act may be seen as a frame- work which provides guidelines for all processing of personal data. The aim is that the Government and should be able to make the regulations more precise within this legal framework. The special register statutes which include rules for many important public records, are not part of our brief. We would like to point out that these provisions must be reviewed in the coming years and be adapted to the new Protection Act. Purely private use of personal data is outside the bounds of the pro- posed Act. One such example of this worthy of mention is E-Mail between private persons. The expression processing of personal data comprises everything which can be done with such data, e.g. the retrieval, collection, storage and dissemination of data. Processing of personal data which is partly or automatic, i.e. largely computerised, comes under the proposed Act. Manual processing of such data (on paper) is only included if the data is to form part of a proper register. The proposed Act defines certain basic requirements for all processing of personal data. The person responsible for the processing of personal data (the controller) must ensure that the data is only collected for certain expressly stated and justifiable purposes. The data may not later be used for any purpose incompatible with the ones for which the data was origi- nally collected. Superfluous data may not be processed, and that data which is processed must be adequate and relevant. Inaccurate, misleading or incomplete data must be corrected. The data may be stored only as long as is necessary with respect to the purposes of the processing. There are special rules for data which is processed for historical, statistical or scien- tific purposes. SOU 1997: 39 Bilaga 7: Summary in English 869 The proposed Act contains a comprehensive list of cases in which personal data may be processed. Personal data may always be processed if the in- dividuals in question (the data subjects) have given their consent. In other cases the processing must be necessary for the attaining of certain stated purposes. Those situations in which processing may be undertaken without consent may be summarised as follows: N In connection with a contract N In order to fulfil a legal obligation N In order to protect vital interests of the data subject N In order to carry out a task of public interest or in connection with the exercising of official authority N After a balance of interests where the interests of the data subject are weighed against the interests on the part of the controller The proposed Act contains special rules applying to the processing of sensitive personal data. Sensitive data includes information relating to a persons health or sex life and data which reveals race, ethnic origin, po- litical opinions, religious or philosophical beliefs, or membership of a trade union. Such data may only be processed in those cases listed in the Act. However, the Government or may permit the processing of sensitive personal data in other cases provided that it is necessary on grounds of substantial public interest. Sensitive data may be processed when the data subject has given his/her consent or when he or she has manifestly made the data public. Those cases in which data relevant to the purpose of the processing may other- wise be processed can be summarised as follows. N In order to fulfil obligations or to exercise rights within the field of la- bour law N In order to protect vital interests when the data subject is unable to give his/her consent N In order to establish, exercise or defend legal claims N Inside non-profit organisations sensitive data, e.g. relating to members and sympathisers may be processed, but may not be disclosed to a third party N Within the health service N For scientific research and statistics purposes where a research ethics committee has approved the project or where the public interests clearly override the risks to integrity 870 Bilaga 7: Summary in English SOU 1997: 39 As a principal rule, data pertaining to criminal offences, etc., may only be processed by public authorities. As is the case today, the national personal identification number may only be used when it is clearly motivated by the purpose of the data processing, the importance of a definite identification or any other significant reason. The data subjects shall be informed about the processing of their data. The proposed Act stipulates that the controller shall at his own initiative provide information about the processing to the data subject. However, in cases where data is collected from any other source than the data subject himself, it is not necessary to notify the person concerned if the registra- tion or disclosure of the data is regulated by statute or if the effecting of the notification would involve a disproportionate effort. The proposal states that the data subject shall have the right to request, free of charge, once per year information relating to the data being processed, i.e. a transcript from the registers. The controller shall, on re- quest, correct any personal data which is inaccurate, misleading or incom- plete, or which has otherwise not been processed in accordance with current regulations. Certain restrictions are proposed for transfers of personal data outside the EU and the EEA. The proposed Act contains regulations pertaining to security in the processing of personal data. The current obligation to report processing to should be kept to a minimum. Instead, the Board should concentrate on supervision, information and advice. shall also issue instructions which clarify the provisions of the Act in various areas. If anyone contravenes the proposed Act, shall seek to achieve rectification. The proposal allows the Board to im- pose penalties and to bring cases aimed at erasing the personal data in question. Broadly speaking, the penalties for violation of the proposed Act pri- marily comprise damages to injured data subjects. As has been the case up to now, they shall, in addition to other compensation, have a right to general (punitive) damages for the violation of their rights. In principle, there should be a strict liability for damages, i.e. damages should be paid out as soon as the rules have been broken. However, we propose that, within reason, damages shall be reduced in cases where the controller can SOU 1997: 39 Bilaga 7: Summary in English 871 prove that the incorrect processing was not dependent on his or her action or failure to take action. The proposed Act should come into force on January 1, 1999 and be fully applied to all processing commenced thereafter. For processing al- ready underway when the Act comes into force, the former Data Protection Act should apply up until October 2001. The principle of right-of-access in the IT society The second part of our task has been to review the provisions of Chapter 2 of the Freedom of the Press Act concerning citizens rights to gain access to public documents (documents received or created by an authority in- cluding manual or electronic registers) – the right-of-access principle. The aim has not been to alter this principle, but rather to investigate how it can be applied in a modern environment. We have set out two premises for this work: N Right-of-access shall be as broad as possible N The rules must be clear and simple to apply reaching right-of-access provides checks on power, thus helping to strengthen democracy. Our proposal also aims at extending in the long term the possibilities for the general public to gain benefit from the enor- mous amounts of data held by the public authorities. We propose that the central concept of the right-of-access principle should be public data rather than public document. The concept of data is technically neutral, and the Official Secrets Act is already based upon it. In this respect the proposed amendments do not involve any major objective changes: if one today can obtain access to a document one should according to our proposal have access to the data contained in that document. One improvement is that one no longer needs to resort to hypo- thetical notions, such as the expression potential documents, for electronic records to be included in the right-of-access principle. We propose that the concept of a document shall remain in the Act as a storage space for data. A document has a defined content, namely the content which the person who once wrote the document ascribed to it. It is of no significance whether the document takes the form of a piece of paper or if it exists in digital form. We refer to those storage spaces which do not constitute documents as databases. What typifies a database is that individual elements of data are 872 Bilaga 7: Summary in English SOU 1997: 39 arranged in such a way that they can be searched, and that they can be combined in various ways. Registers are typical examples of databases. Manual databases and those maintained via digital technology have the same status. Thus data may either be found in documents or in databases. One prerequisite for data to be public within a public authority is that it is in the of that authority. In the 1970s a rule was introduced which provides that all data technically accessible to an authority is deemed as in the of that authority. In the mainframe computer environment of that time, such a rule was reasonable. However, we ob- serve that such a rule cannot be applied in a modern environment in which virtually everything is technically available, e.g. via Internet. One prerequisite for the right-of-access principle to be able to function in prac- tice is that the boundaries between authorities are maintained. Authorities otherwise will have impaired capacity for their data in order, im- pairing the preconditions for the general public to be able to locate it. We propose that the concept of storage should reassume its original meaning, but that it should also include electronic storage. The obligations of an authority to release public data should thus comprise such data as it stores, either purely physically (on paper, , floppy- or hard disk) or logically (in an electronic file belonging to the authority). Data contained in an authoritys library is not affected by the right-of- access principle. The new way of regarding storage means that this provi- sion can be simplified. A book in a library should be treated in the same way regardless of whether it is printed on paper or if it is stored on a CD- . In cases where the general public want certain information, authorities are currently assumed to have a certain obligation to make extra searches and compilations over and above their normal course of work. Usually, anything which can be produced by routine measures is deemed to be a public document. This should also apply in future, but should be related to costs. An authority should have a duty to carry out any extra work which can be carried out without incurring significant costs. Since technology will provide even broader and cheaper opportunities to search for and compile data, the future ability of the general public to gain insight into the workings of authorities and to share in their knowledge will increase. Regarding the actual issue of public data to the general public, we pro- pose that the right-of-access principle be extended. According to our pro- posal, it should also include a right to obtain public data in electronic form. SOU 1997: 39 Bilaga 7: Summary in English 873 We are aware that such a right could not be introduced generally and immediately. According to the proposed stipulation the general publics right to obtain public data on disk or via E-Mail must be adapted to the particular authoritys technical capabilities. Since these are continually being improved, insight will also become more effective. There may be certain special regulations which forbid an authority to issue data in digital form, and in certain cases such an issue might be subject to secrecy legis- lation, but the principle should be that one has the same right to obtain data in electronic form as on paper. This should, in the long run at least, be a positive development also for the authorities who will cut down on their dependence on costly paper handling. The right to obtain data in electronic form should not include computer programs since this might infringe upon copyright. On the other hand, we consider that there is a public interest in finding out how various authori- ties computer programs work. This is especially true in cases where the authority makes automated decisions using computer programs. In order to strengthen public insight, we therefore propose that the authorities, where such programs are used, should be obliged to provide descriptions (system documentation) on how those programs work. Our proposal for new concepts in the Freedom of the Press Act, which form part of our constitution, will necessitate consequential changes in statutes and regulations of inferior rank. We submit proposals for such changes in the Official Secrets Act and the Archives Act. The Freedom of the Press Act does not currently stipulate what will happen to public documents when they are no longer current. Since it is of major practical importance for public insight that public data be stored and preserved, we propose the introduction of a provision in the Freedom of the Press Act which refers to the Archives Act. The following committee members expressed dissenting opinions: (), (Liberal Party) and (Moderate ) jointly, and (). Statements of opinion were submitted by (), by with , and by , , and .