sou · GSB36d2 · 2005-01-01 00:00:00 — b)lagras för särskilt angivna och lagliga ändamål och inte använ- das på ett sätt som är förenligt med dessa ändamål; Bilaga 5 – dataskyddskonvention (nr 108) cadequate, relevant and not exces- sive in relation to the purposes for which they are stored; daccurate and, where necessary, kept up to date; epreserved in a form which per- mits identification of the data subjects for no longer than is re- quired for the purpose for which those data are stored. Article 6 – Special categories of data Personal data revealing racial ori- gin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life, may not be processed auto- matically unless domestic law pro- vides appropriate safeguards. The same shall apply to personal data relating to criminal convictions. Article 7 – Data security Appropriate security measures shall be taken for the protection of per- sonal data stored in automated data files against accidental or unauthor- ised destruction or accidental loss as well as against unauthorised ac- cess, alteration or dissemination. Article 8 – Additional safeguards for the data subject person shall be enabled: ato establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual or principal place of business of the controller of the file; bto obtain at reasonable intervals and without excessive delay or c)vara ändamålsenliga, relevanta och inte onödiga för de ändamål för vilka de lagras; d)vara riktiga och, om nödvändigt, hållas aktuella; e)bevaras på ett sådant sätt att de registrerade personerna inte kan identifieras än vad som är nödvändigt med hän- syn till det ändamål för vilket dessa uppgifter lagras. Artikel 6 – Särskilda slags uppgif- ter Personuppgifter som avslöjar rasur- sprung, politiska åsikter liksom personuppgifter som rör hälsa eller sexualliv får inte undergå automa- tisk databehandling såvida inte na- lag ger ett ändamålsenligt skydd. Detsamma gäller person- uppgifter som hänför sig till att någon dömts för brott. Artikel 7 – Datasäkerhet Lämpliga säkerhetsåtgärder skall vidtas för att skydda personuppgif- ter som lagras i automatiserade re- gister gentemot oavsiktlig eller otil- låten förstörelse eller oavsiktlig förlust liksom gentemot otillåten tillgång, ändring eller spridning. Artikel 8 – Ytterligare skyddsåt- gärder för registrerade personer Var och en skall ha möjlighet att: a)få veta huruvida ett automatise- rat personregister finns, dess hu- vudsakliga ändamål, liksom upp- gift om vem som är registeran- svarig samt dennes hemvist eller säte; b)med rimliga mellanrum och utan alltför lång tidsutdräkt eller Bilaga 5 – dataskyddskonvention (nr 108) expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form; cto obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Arti- cles 5 and 6 of this convention; dto have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in para- graphs b and c of this article is not complied with. Article 9 – Exceptions and restric- tions 1No exception to the provisions of Articles 5, 6 and 8 of this convention shall be allowed ex- cept within the limits defined in this article. 2Derogation from the provisions of Articles 5, 6 and 8 of this con- vention shall be allowed when such derogation is provided for by the law of the Party and con- stitutes a necessary measure in a democratic society in the inter- ests of: a protecting State security, pub- lic safety, the monetary inter- ests of the State or the sup- pression of criminal offences; b protecting the data subject or the rights and freedoms of 3Restrictions on the exercise of kostnad få bekräftat huruvida personuppgifter rörande honom finns lagrade i registret liksom att få sig tillsända sådana uppgif- ter i begriplig form; c)i förekommande fall få sådana uppgifter rättade eller utraderade som har behandlats i strid mot de bestämmelser i nationell lag genom vilka de grundläggande principerna i artiklarna 5 och 6 i denna konvention genomförs; d)överklaga ett beslut som innebär att någon inte efterkommer en begäran om en sådan bekräftelse eller, i förekommande fall, med- delande, rättelse eller utradering som avses i punkterna (b) och (c)i denna artikel. Artikel 9 – Undantag och in- skränkningar 1.Undantag från bestämmelserna i artiklarna 5, 6 och 8 i denna konvention får göras endast i den utsträckning som anges i denna artikel. 2.Avvikelse från bestämmelserna i artiklarna 5, 6 och 8 i denna konvention får göras endast om sådan avvikelse medges i partens nationella lagstiftning och den är nödvändig i ett demokratiskt samhälle för att: a)skydda statens säkerhet, den allmänna säkerheten, statens penningintressen eller brotts- bekämpning; b)skydda den registrerade per- sonen eller andra personers fri- och rättigheter. 3.Inskränkningar i utövandet av de Bilaga 5 – dataskyddskonvention (nr 108) the rights specified in Article 8, paragraphs b, c and d, may be provided by law with respect to automated personal data files used for statistics or for scientif- ic research purposes when there is obviously no risk of an in- fringement of the privacy of the data subjects. Article 10 – Sanctions and reme- dies Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of do- mestic law giving effect to the basic principles for data protection set out in this chapter. Article 11 – Extended protection None of the provisions of this chapter shall be interpreted as limiting or otherwise affecting the possibility for a Party to grant data subjects a wider measure of protec- tion than that stipulated in this convention. Chapter III – Transborder data flows Article 12 – Transborder flows of personal data and domestic law 1 The following provisions shall apply to the transfer across na- tional borders, by whatever me- dium, of personal data undergo- ing automatic processing or col- lected with a view to their being automatically processed. 2 A Party shall not, for the sole rättigheter som anges i artikel 8 (b), (c) och (d) får göras i lag när det gäller automatiserade per- sonregister som används för sta- tistikändamål eller för veten- skapliga forskningsändamål, om det uppenbarligen inte föreligger någon risk för intrång i de regi- strerades personliga integritet. Artikel 10 – Sanktioner och rätts- medel Varje part åtar sig att införa lämpli- ga sanktioner och rättsmedel för överträdelser av sådana bestämmel- ser i den nationella lagen genom vilka de grundläggande principer för dataskydd som har angetts i detta kapitel genomförs. Artikel 11 – Utsträckt skydd Ingen bestämmelse i detta kapitel skall ges den tolkningen att den begränsar eller på annat sätt påver- kar möjligheten för en part att till- erkänna registrerade personer ett mer omfattande skydd än som fö- reskrivs i denna konvention. Kapitel III – Dataflöde över grän- serna Artikel 12 – Flödet av personupp- gifter över gränserna och natio- nell lag 1.Följande bestämmelser skall, oavsett vilket medium som an- vänds, gälla vid överföring över nationsgränser av personuppgif- ter som undergår automatisk da- tabehandling eller som samlas in i avsikt att de skall undergå så- dan behandling. 2.En part får inte, uteslutande i Bilaga 5 – dataskyddskonvention (nr 108) purpose of the protection of pri- vacy, prohibit or subject to spe- cial authorisation transborder flows of personal data going to the territory of another Party. 3Nevertheless, each Party shall be entitled to derogate from the provisions of paragraph 2: a insofar as its legislation in- cludes specific regulations for certain categories of personal data or of automated personal data files, because of the na- ture of those data or those files, except where the regula- tions of the other Party pro- vide an equivalent protection; b when the transfer is made from its territory to the terri- tory of a non through the intermedi- ary of the territory of another Party, in order to avoid such transfers resulting in circum- vention of the legislation of the Party referred to at the beginning of this paragraph. syfte att skydda den personliga integriteten, förbjuda eller kräva särskilt bemyndigande för över- föring av personuppgifter över gränsen till en annan parts terri- torium. 3.Varje part har emellertid rätt att göra avvikelser från bestämmel- serna i punkt 2: a)om dess lagstiftning innehål- ler särskilda bestämmelser för vissa kategorier av person- uppgifter eller automatiserade personregister på grund av uppgifternas eller registrens natur, utom när den andra partens föreskrifter ger ett likvärdigt skydd; b)när överföringen sker från dess territorium till en icke fördragsslutande stats territo- rium via en annan parts terri- torium, för att undvika att så- dana överföringar medför att den i bestämmelsens inled- ning nämnda partens lagstift- ning kringgås. Bilaga 6 – Summary in English Handling of personal data not included in personal data registers made easier Act Inquiry has had the task of reviewing the Act. The purpose of the review has been to examine whether it is possible, despite the existing EC directive on personal data, to replace current regulations on the handling of personal data with regulations against the misuse of personal data. The Inquiry takes the view that this is possible concerning the processing of personal data in unstructured material such as run- ning text and sound and images. The Inquiry has taken this posi- tion after making a careful analysis of the possibilities for making exemptions under the EC directive viewed in the light of develop- ments since the Act entered into force in 1998. These developments include the reasoning of the Court of of the EC in the Swedish Communion instructor case (C- 101/01). The Inquiry proposes an exemption from the great majority of handling regulations in the Act for the processing of personal data that does not form part of and is not intended to form part of a set of personal data that has been structured in order to significantly facilitate searches for or compilations of personal data specifically, i.e. in practice personal data registers and personal data-related databases. Briefly, the Inquirys proposal means that the handling regula- tions in the Act would not be applicable, inter alia, to everyday processing like the production of running text in word processing software, the publication of running text on the Inter- net, the use of sound and image recordings and email correspon- dence on condition that the material is not intended for inclusion Bilaga 6 – Summary in English in a database with a personal data-related structure such as an elec- tronic system for handling business. As a result, a person who wants to carry out computer process- ing of personal data in running text, such as simple messages or shorter or longer texts, or in sound or images or in emails need not normally bother about the handling regulations in the Act. Further consideration will only be needed if he or she wants to insert the material into some form of database. If the da- tabase has a personal data-related structure, in which personal data are specifically identified as such, then the handling regulations must be applied. In practice the proposed, new regulation will only be of impor- tance for automatic processing with the aid of computers. According to the Inquirys proposals, the processing that is ex- empted from the handling regulations will be regulated by a simple rule designed to provide protection from the misuse of personal data. Under this rule the processing of personal data is not permit- ted if it involves an improper intrusion on personal integrity. To make it easier to apply the rule, in its explanatory comments to the proposed legislation the Inquiry has summarised some simple and obvious guidelines that should be followed: Do not process personal data for improper purposes, such as persecuting or disgracing an individual. Do not collect a large amount of information about one individ- ual without acceptable reasons. Rectify personal data that turn out to be incorrect or misleading. Do not slander or insult anyone else. Do not violate an obligation to keep information secret. In addition, as is now the case, a registered person will have the right to subject access, i.e. to obtain on request a data extract in- cluding the personal data processed. A general exception is, how- ever, proposed in the event that it proves impossible to provide a data extract or it would require disproportionate effort to do so because, for instance, it is difficult to find information about a par- ticular person in running text and in sound and image recordings. According to the proposal, anyone who breaks the rules for pro- tection from misuse of personal data may have to pay damages to the registered person. Moreover, under the proposal the Data In- spection Board will have the task of ensuring that the rules are fol- lowed. Bilaga 6 – Summary in English Duty to provide data extracts made less onerous If a controller of personal data has a very large number of registers, a large quantity of unstructured material or material in many dif- ferent places – in hundreds of computers, for instance – it can be impossible or extremely onerous to search out all the information about a person who requests a data extract. The Inquiry there- fore proposes that it should be explicitly stated that information under Section 26 of the Act, in the form of a data extract, need not be provided to the extent that this proves to be impossible or would require disproportionate effort. Generally, however, the applicant must first be asked about any information that may facilitate the search for his or her personal data. The purpose of the proposed amendment is not to introduce re- strictions in relation to current practice but to adapt the text of the Act to the prevailing situation. Government and authorities given right to issue regulations on exemptions from the Act that are permitted under the EC directive Under the EC directive Member States may derogate from certain provisions in the EC directive when this is necessary to safeguard the fulfilment of certain specified important public and govern- ment functions or to safeguard the protection of rights and free- doms of individuals. At present, the Act does not contain a corresponding provision. The Inquiry proposes that use is made of the possibility to provide exemptions and that the Gov- ernment and authorities designated by the Government be explic- itly authorised to issue regulations and take decisions in individual cases on exemptions that are permitted under the EC directive. Only gross negligence to be an offence At present, an individual can be sentenced to a fine or to prison for contravening the Act purposely or through negli- gence in four listed instances. The Inquiry proposes decriminalisa- tion in this area so that only acts committed through gross negli- gence will be criminal offences in addition to intentional acts. The Inquiry has found no reason to propose any other decriminalisa- tion. Bilaga 6 – Summary in English Procedure for appealing decisions of public authorities clarified Some decisions by public authorities under the Act can already be appealed according to the general provisions on ap- peals. The Inquiry proposes that the Act be amended to include provisions setting out in what cases and how appeals can be lodged against the decision of a public authority un- der the Act. The Inquiry proposes, however, that special regula- tions on how to appeal decisions of the courts should be inserted in the special data protection acts that regulate the processing of per- sonal data by the courts. Relationship of the Act to the principle of public access and the Secrecy Act clarified For the purpose of clarification the Inquiry proposes an explicit regulation stating that the general provisions of the Act do not restrict the duty that public authorities have under the principle of public access to official documents in Chapter 2 of the Freedom of Press Act to search for, compile and release personal data. The Inquiry also proposes that other bodies than public au- thorities that have duties under the principle of public access, such as local government enterprises, should be covered by the exemp- tions with regard to the principle of public access that are con- tained in the Act. Under Chapter 7 Section 16 of the Secrecy Act secrecy applies to personal data if it can be assumed that release would result in the processing of the data in contravention of the Act. The Inquiry has had the task of clarifying this provision but not of proposing that it should be amended or abolished. The Inquiry proposes that the provision be clarified in the following way. Secrecy should apply to personal data if there is reason to as- sume that, after release, the data will be processed in contravention of the Act. This provides clarification that the public authority must have some reason – for instance the fact that data are being requested for a very large number of people – to ask questions about the intended use of the data. Secrecy should also apply for personal data if release of the data by a public authority is in contravention of the provision on the transfer of personal data to a third country in Section 33 of the Act. This is not, however, intended to lead to se- Bilaga 6 – Summary in English crecy for data in public resisters intended to provide the public with information, such as the register of real property. In practice these provisions will only be relevant in exceptional cases when the principle of public access requires a public authority to send per- sonal data abroad. The Inquiry has also had the task of considering the possibility of granting exemptions for processing of personal data in the private sphere that falls outside the scope of community law and is not therefore covered by the EC directive. The Inquiry notes that full use has already been made of the exemption for purely personal processing of personal data permitted under the EC directive and that there is no reason to make further exemptions from the Per- sonal Data Act. At present the Personal Data Act contains a ban for other par- ties than public authorities, i.e. private physical or legal persons, to process personal data on violations of laws, etc. but exemptions can be prescribed in other statutes or in decisions taken in individual cases. The Inquiry has had the task of considering whether the Per- sonal Data Act should be amended to include concrete exemptions. The Inquiry has reached the view that the possibilities of providing exemptions through general provisions in other statutes and through decisions in individual cases that are already available are sufficient and has therefore concluded that no provisions on ex- emptions from the ban on the processing of personal data by pri- vate physical or legal persons are needed in the Act. No amendments are proposed to the Act in re- sponse to the judgment of the Court of providing a pre- liminary ruling in the Swedish communion instructor case on the publication of personal data on the Internet (C-101/01). In practice the earliest date on which the proposed amendments can enter into force is 1 2005.