sou · GRB340d1 · 2004-01-01 00:00:00 — Slutligen föreslås att personupp- giftslämnandet till utländska myndigheter enligt Schengenkonven- tionens rådfrågningssystem författningsregleras i utlänningsför- ordningen (1989:547). The assignment given to the Commission by its terms of reference has been to survey the processing of personal data in activities under the legislation on aliens and citizenship. Taking a compre- hensive view, the Commission is instructed to examine the system of regulations and propose legislative amendments and other measures needed to bring the legal regulations fully into line with the Act (1998:204). Act came into being in transposition of Directive 95/46/EC of Parliament and of 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (generally known as the Data Protection Directive). The survey undertaken by the Commission has led to the conclusion that for a number of reasons presented in this report, special provisions need to be introduced in the legislation to regulate the processing of personal data in this area of activities. A new act on the processing of personal data in activities under the legislation on aliens and citizenship Some points of departure The proposals made by the Commission are to the effect that the processing of personal data in activities under the legislation on aliens and citizenship should be legally regulated by an act adapted to the provisions of the Act and the Data Protection Directive. The name proposed for the act is the Act. This act will replace the current Ordinance on the Processing of in Activities under the Legislation on Aliens and Citizenship (2001:720). One of the fundamental points of departure for the Commission has been that the overall purpose of the act must be to protect individuals against undue intrusions into their personal integrity. At the same time, the provisions of the act reflect a reasonable balance between the claims of individuals to protection of their integrity and the interest of society in the ability of public autho- rities in this area to make rational and effective use of modern information technology in the pursuit of their duties. Another point of departure is that the act must not be tied to any particular technology, one consideration here being to leave the authorities free to make changes in their computer organisation and benefit from any new technology that may become available. One effect of the Commissions proposal will be that the pro- visions of the act will not stand in the way of a future switch to a electronic processing of business by the public authorities. Finally, with one exception, the Commission has not found cause to propose special provisions for registers or other com- pilations of data. These compilations will therefore be covered by the general provisions of the Act concer- ning processing of personal data. The exception concerns the register of fingerprints and photographs kept by , for which certain special provisions are proposed. The proposed act is to apply to the processing of personal data in activities under the legislation on aliens and citizenship that are carried out by the Government Offices, , , , and authorities, and Swedish missions abroad. The area of activity will be defined more precisely in the act. In order to come under the scope of the Act, the pro- cessing of personal data must occur in activities relating to 1.the entry of aliens into or some other state that be- longs to Union or Economic Area, or work in , or exit from , 2.the reception of asylum seekers and other aliens, 3.aid and allowances paid to aliens, 5.compensation from central government for costs relating to aliens, or 6.the taking up of by aliens. This specification of activities is exhaustive. This implies, among other things, that the processing of personal data in the course of internal administrative activities at public authorities does not come under the scope of the act. Furthermore, an explicit pro- vision is proposed stating that processing of personal data under the Protection Act (1998:622), the Act on the (2000:344) or the Council Regu- lation (EC) No 2725/2000 of concerning the of Eurodac for the comparison of fingerprints for the effective application of the Convention, shall fall out- side the scope of the act. Thus, the proposed act shall be subsidiary to the statutes mentioned. Like the Act, it is proposed that the new act should apply to all or partially computerised processing of personal data. The act will therefore apply regardless of whether processing occurs, for example, in large computerised compilations of data existing in shared networks or registers, in e-mail or in a word processing program in an individual officials separate per- sonal computer. Manual processing will also come under the provisions of the Act, if the personal data is included or is intended for inclusion in an organised collection of personal data which is accessible for searching or compilation according to specific crite- ria, i.e. Relationship to the Act The proposed act will contain only such special provisions, exemp- tions and clarifications in relation to the Act as the Commission has deemed necessary, either to enable working duties in the area of activities to be carried out in a satisfactory or to guarantee the individuals registered more effective protection of their personal integrity than they would otherwise receive under the Act. Act shall thus apply to the processing of per- sonal data in activities under the legislation on aliens and citizen- ship, unless otherwise indicated in the Act. One of the implications of these observations is that the pro- visions of the Act on definitions and fundamental requirements as regards the processing of personal data shall also apply when personal data are processed in activities under the legislation on aliens and citizenship. Further, it may be observed that the regulations given in the Act on the infor- mation that must be provided to registered individuals, on security aspects of data processing and on the powers of the supervisory authority will be applicable. will be the supervisory authority when personal data is processed under the Act, as in other cases. Controller of personal data It is proposed that the authority undertaking processing or respon- sible for doing so should be controller of personal data in the case. However, it is proposed that should be controller of personal data in cases where personal data is processed by in connection with applications for compensation from central government for costs involved in receiving refugees, etc., and in cases where Swedish missions abroad process personal data under the Act. What is meant by controller of personal data is made clear in the Act. When processing is permitted The Commission proposes that personal data should be subject to collection and further processing only if this is necessary for cer- tain purposes. The purposes will be specified in the act. piece of personal data collected is presumed to be available for all these purposes. The proposed purposes are as follows: 1.handling of cases or an authoritys assistance in such cases (case handling), 2.control of aliens in connection with entry and exit and control during in (external and internal control of aliens), 3.performance of working duties relating to the reception and settling of asylum seekers and other aliens (actual reception and settling activities), 4.release of information pursuant to acts or ordinances, or in accordance with membership of Union or obligation to supply information under an interna- tional convention to which has acceded or an agree- ment with a foreign state or international organisation that has been approved by the Riksdag (release of information), 5.enquiries about decisions, court reports, other legal information and information concerning circumstances in other countries that is likely to be of guidance in case handling (information enquiries), 6.supervision, monitoring, follow-up and planning, or 7.production of statistics. The Commission proposes that all personal data that is necessary for the purpose for which the processing is being undertaken shall be subject to processing. However, it is proposed that sensitive personal data should only be subject to processing if absolutely necessary. The regulations given in the Personal Data Act con- cerning processing of data on violations of the law, etc., and processing of personal identity numbers shall also apply to process- sing under the Act. Where the Swedish Migration Boards computerised register of fingerprints and photographs taken under the authority of the Aliens Act (1989:529) is concerned, it is proposed that the purpose be defined more restrictively. Further, it is proposed that the Government direct in an ordinance issued in conjunction with the new act that the register shall only be permitted to contain certain types of information. Out of respect for individual integrity, certain restrictions are pro- posed on the freedom of public authorities to search for and com- pile personal data. Under the proposal, there will be a ban on sensitive personal data, such as are specified in Section 13 of the Act, being used as search terms in data processing for purposes of case handling, external and internal control of aliens, actual reception and settling activities and release of information. In data processing for the purpose of supervision, monitoring, follow-up and planning and for the purpose of production of statistics, it is proposed that the only types of sensitive personal data specified in Section 13 of the Act that may be used as a search term shall be data that reveal ethnic origin or have to do with health. No equivalent restrictions are proposed as regards the purpose of information enquiries, since the authorities have an evident and legitimate need to be able to search for and use precisely these types of compilations of data as reference material when assessing individual cases. Further, it is proposed that personal data relating to violations of the law, etc., should not be eligible for use as a search term unless such data refers to decisions ordering detention under the Aliens Act. Release of personal data As mentioned above, one form the processing of personal data may take is release. In order to protect individual personal integrity cer- tain provisions are proposed in the act that target the in which data processed under the Act is released. There are no equivalent provisions in the Act. In order to neutralise the special integrity risks that can be associated with the release of personal data on media for compu- terised data processing, such as a , the act will incorporate certain restrictions on when data may be released in any such to an EU institution or a foreign authority in an EU or EEA country. Further, data may only be released in such a to an individual when the Government has issued directions to this effect. Such directions should be issued in an ordinance promul- gated with reference to the act. There are no grounds for regula- tions restricting the release of personal data on media for com- puterised data processing to a Swedish public authority or agency. Provisions are proposed in the act that will exhaustively regulate the release of personal data by direct access. Direct access repre- sents a special form of data release on media for computerised data processing. The special characteristic of direct access is that reci- pients themselves can search for and study data in the providers data system via a technical connection with that system. Under the Commissions proposal, for the purpose of case handling, the Government Offices, , , and authorities, and Swedish missions abroad will be allowed direct access to personal data processed in computerised systems by purpose. and authorities will also be permitted to use their direct access facilities for the purpose of external and internal control of aliens. Furthermore, it is proposed that missions abroad should have direct access to personal data kept by which is processed for the purpose of information enquiries. No direct access other than stated here shall therefore be per- mitted. One consequence of this for is that under the Commissions proposal it will no longer have direct access to the Swedish Migration Boards STAMM data system. Where direct access is concerned, the Government has the right to issue more restrictive regulations than those specified in the act. The provisions of the act regarding the release of data on media for computerised data processing and direct access entail no obliga- tion for the authorities to release personal data by these means. In its role as controller of personal data, for example, may completely refrain from permitting direct access, e.g. if the Board finds that the personal data will not be protected by acceptable security measures at the receiving autho- rity. Transfer of personal data to a third country Because of the highly international nature of the area of activity, the Commission considers it necessary to provide greater freedom in certain respects to transfer personal data to a country that is not a member of the EU or the EEA, i.e. to a third country, than is allowed under the Act. Provisions concerning such transfers are therefore proposed that diverge from the provisions of the Act. Retention of personal data, etc. Under the proposal, records of personal data occurring in activities under the legislation on aliens and citizenship shall be kept or eliminated in accordance with the provisions of the Archives Act (1990:782). No pertinent provisions are required in the Act. However, a special regulation is proposed for the register of fingerprints kept by , from which records shall be eliminated in accordance with current regulations. It is proposed that this record elimination provision be incorporated in an ordinance to be issued in conjunction with the Act. In order to protect individual personal integrity, however, it is important that no more data than necessary is accessible by a large number of persons in intra- or inter-authority computer systems. The Commission therefore proposes that personal data in com- puterised data compilations that are used in the authorities day-to- day core activities shall be separated from these data compilations when they are no longer needed for these activities. Thus, personal data that is not of current interest but is nevertheless sensitive from the point of view of personal integrity shall be protected against unnecessary access. Authority to access the separated data shall therefore only be granted to those who have an unavoidable need of the data to be able to perform their working duties, e.g. authority archivists. Rectification, damages and appeals The provisions of the Act regarding rectification of personal data and damages shall apply to the processing of personal data under the Act. Reference is made to the regulations concerning rectification and damages in the Act. It shall be possible to appeal to an administrative court against decisions made by an authority relating to rectification or to pro- vision of information under Section 26 of the Act. Appeals to the Administrative Court of Appeal shall only be allowed if review dispensation has been granted. No other deci- sions are subject to appeal. It shall be prescribed in the act that – over and above the matter of authorisation concerning the register of fingerprints and release of data to private individuals on media for computerised processing – the Government may issue additional regulations that are more restrictive than the provisions of the act itself as regards purposes, categories of personal data, search terms, direct access and the transfer of data to a third country. It is further proposed that the Government may issue regulations on the separation of personal data and on security measures to protect personal data. Finally, it is proposed that in certain cases the Government should delegate the right to issue regulations to some other authority. A proposal is made for an ordinance to be issued in conjunction with the act. The proposed Act aims to allow the release of personal data to an extent corresponding to the present situa- tion. However, the personal data processed in activities under the legislation on aliens and citizenship is largely subject to secrecy. In particular, secrecy pertaining to aliens under Chapter 7 Section 14 of the Secrecy Act (1980:100) is applicable to personal data. The examination undertaken by the Commission has revealed, among other things, that large-scale, routine exchanges of secret data take place between authorities in this area. In a substan- tial proportion of cases, the general in Chapter 14 Section 3 of the Secrecy Act is adduced in support of the release of data. In the opinion of the Commission, this state of affairs is not satisfactory. The Commission has therefore found reason to pro- pose certain provisions on limitations of secrecy, as follows. A secrecy-limiting obligation to provide information shall be in- troduced in the Aliens Act, applying between the Swedish Migration Board, , and authorities, and Swedish missions abroad, with reference to data relating to the personal circumstances of an alien or other individual, if these data are necessary for the activities conducted by the receiving authority under the Aliens Act. A corresponding duty to provide information, applying between , missions abroad, shall be introduced in the Swedish Citizenship Act (2001:82). A further proposal is a statutory obligation for to provide certain specific information about aliens to county and municipal councils. and above these proposals, the examination of the pro- cessing of personal data has demonstrated a need for additional legislative proposals aimed at solving certain problems of secrecy. Thus, it is proposed that the provision in Chapter 7, Section 14, fourth paragraph of the Secrecy Act should be amended by adap- ting it to the new EC regulation that has replaced the agreement to which the present wording of the provision refers, the Convention. It is further proposed that a provision be introduced in the same section to the effect that secrecy shall not prevent specially stipulated information about an alien being released to the Swedish Red Cross in certain cases. Finally, it is proposed that statutory provision should be made in the Aliens Ordinance (1989:547) for the release of personal data to foreign authorities under the Schengen Conventions consultation system. Härigenom föreskrivs följande. 1 § Denna lag tillämpas vid behandling av personuppgifter i Rege- ringskansliets, , , Integra- tionsverkets, och polismyndigheternas samt utlandsmyndigheternas verksamhet som gäller 1.utlänningars inresa i eller i en stat som ingår i Euro- peiska unionen eller i en stat som är ansluten till Europeiska ekonomiska samarbetsområdet, vistelse eller arbete i samt utresa från , 2.mottagande av asylsökande och andra utlänningar, 3.bistånd och bidrag till utlänningar, 5.statlig ersättning för kostnader för utlänningar, eller 6.bosättning av utlänningar. Lagen gäller endast om behandlingen är helt eller delvis auto- matiserad eller om personuppgifterna ingår i eller är avsedda att ingå i en strukturerad samling av personuppgifter som är tillgäng- liga för sökning eller sammanställning enligt särskilda kriterier. 2 § Lagen tillämpas inte då personuppgifter behandlas med stöd av polisdatalagen (1998:622), lagen (2000:344) om Schengens informa- tionssystem eller rådets förordning (EG) nr 2725/2000 av om inrättande av Eurodac för jämförelse av fingeravtryck för en effektiv tillämpning av Dublinkonventionen1. 1 EGT L 316, 15.12.2000 (Celex 32000R2725) Lagens förhållande till personuppgiftslagen 3 § Personuppgiftslagen (1998:204) gäller vid behandling av person- uppgifter i verksamhet enligt 1 § första stycket, om inte annat följer av denna lag eller föreskrifter som har meddelats med stöd av denna lag eller annars av 2 § personuppgiftslagen. 4 § är personuppgiftsansvarigt för Integrations- verkets och utlandsmyndigheternas behandling av personuppgifter för ändamål som anges i 5 § första stycket 1. I övrigt är den myn- dighet som anges i 1 § personuppgiftsansvarig för den behandling av personuppgifter som myndigheten utför eller som det åligger myn- digheten att utföra. När behandling av personuppgifter är tillåten 5 § Personuppgifter får behandlas om det är nödvändigt för 1.handläggning av ärenden eller en myndighets biträde i sådana ärenden, 2.kontroll av utlänning i samband med inresa och utresa samt kontroll under vistelsen i , 3.utförande av arbetsuppgifter som gäller mottagande och bosätt- ning av asylsökande och andra utlänningar, 4.uppgiftsutlämnande som sker med stöd av lag eller förordning, följer av medlemskap i unionen eller av uppgiftsskyldighet enligt internationell konvention som tillträtt eller av godkänt avtal med främmande stat eller mellanfolklig organisation, 5.återsökning av avgöranden, rättsutredningar, annan rättslig infor- mation samt information rörande förhållanden i andra länder som är ägnad att ge vägledning åt handläggning av ärenden, 6.tillsyn, kontroll, uppföljning och planering, eller 7.framställning av statistik. Personuppgifter som behandlas enligt lagen skall anses insamlade för samtliga ändamål som anges i första stycket, om inte annat angetts vid insamlingen. 6 § Känsliga personuppgifter som anges i 13 § personuppgiftslagen (1998:204) får behandlas om uppgifterna är oundgängligen nödvän- diga för syftet med behandlingen. 7 § Behandling av personuppgifter som är tillåten enligt denna lag får utföras även om den registrerade motsätter sig behandlingen. 8 § får föra ett automatiserat register över finger- avtryck och fotografier (fingeravtrycksregister) som tas med stöd av 5 kap. 5 § utlänningslagen (1989:529). Registret får endast använ- das vid prövning av ansökningar om uppehållstillstånd där skäl som avses i 3 kap. 2 eller 3 § utlänningslagen åberopas samt i ärenden om avvisning och utvisning. Närmare föreskrifter om registret med- delas av regeringen. 9 § Känsliga personuppgifter som anges i 13 § personuppgiftslagen (1998:204) får inte användas som sökbegrepp vid behandling av per- sonuppgifter för ändamål som anges i 5 § första stycket 1–4. Vid behandling för ändamål som anges i 5 § första stycket 6 eller 7 får inga andra känsliga personuppgifter än sådana som avslöjar etniskt ursprung eller rör hälsa användas som sökbegrepp. Personuppgifter om lagöverträdelser m.m. som anges i 21 § person- uppgiftslagen får inte användas som sökbegrepp. Beslut om förvar enligt utlänningslagen (1989:529) får dock användas som sök- begrepp. Begränsningar i fråga om utlämnande av personuppgifter på medium för automatiserad behandling 10 § Personuppgifter får lämnas ut på medium för automatiserad behandling till en institution inrättad av Europeiska unionen eller en utländsk myndighet i en stat som ingår i Europeiska unionen eller som är ansluten till Europeiska ekonomiska samarbetsområdet endast om det är nödvändigt för ändamål som anges i 5 § första stycket 1, 2, 4 eller 5. Personuppgifter får lämnas ut till enskild på medium för automa- tiserad behandling endast om regeringen har meddelat föreskrifter om det. 11 § För ändamål som anges i 5 § första stycket 1 får , , , Rikspolissty- relsen och polismyndigheterna samt utlandsmyndigheterna ha direktåtkomst till personuppgifter som behandlas automatiserat av för samma ändamål. och polismyndigheternas direktåtkomst gäller även för ändamål som anges i 5 § första stycket 2. Direktåtkomsten får inte avse andra uppgifter än sådana som är oundgängligen nödvändiga för att arbetsuppgifter som ankommer på myndigheten skall kunna utföras.