sou · GZB34en · 2012-01-01 00:00:00 — Additional rules concerning personal data processing in the area of labour market policy Swedish Government Official Report of The Inquiry into personal data processing in the area of labour market policy and the supervision thereof The remit of the Inquiry was to examine the processing of certain personal data in the area of labour market policy. The remit included determining the regulations that should apply in this area and examining whether there is a need for special regulations for personal data processed by complementary actors. These external service providers conduct labour market policy activities or other activities concerning newly arrived immigrants on behalf of the . The aim of the Inquiry is to create the conditions that enable public authorities1 and the complementary actors to perform their tasks in a legally secure and efficient while protecting the personal privacy of individuals. In addition, the Inquiry was instructed to consider whether there is a need for a special provision overriding secrecy regarding the release of data on individuals by the to complementary actors. The Inquiry was also required to assess whether professional secrecy imposed by law should be introduced concerning data about jobseekers processed in activities run by the complementary actors. The remit included proposing legislative amendments that are deemed necessary. The Inquiry was also tasked with examining whether the , when publishing available positions in the Platsbanken database, should be allowed to process data about trade union representatives in the labour market policy database, and whether the Board should be allowed to process data about violations of the law in its statistics and supervisory database. Introduction of new Act on complementary actors to protect personal privacy of individuals At present, the Act, along with procured agreements, regulate the way complementary actors process data about individuals and companies. The Inquiry proposes introducing an Act on complementary actors. The Act is to apply when complementary actors perform labour market policy activities and introduction activities for certain newly arrived immigrants on behalf of the . The purpose of the Act is to protect the personal privacy of individuals in connection with the performance of a task by the complementary actors assigned to them by the following a public procurement. To achieve this purpose, regulations are proposed to the effect that complementary actors may offer their services on similar terms as the , while protecting the privacy of individuals in the activities carried out. Achieving efficient personal data processing in the contracted activities of complementary actors, together with good privacy protection for individual jobseekers and individual employers, requires coherent and easily accessible legislation. Special regulations should only be introduced in areas where privacy considerations are expressly applicable in connection with the performance of a task by the complementary actors. Otherwise, the regulations contained in the Act should apply. This matter concerns a special regulation that complements and, in some parts, replaces the Act. The term complementary actor refers to a party contracted by the to carry out labour market policy activities or activities under the Act on introduction activities for certain newly arrived immigrants. The Inquiry considers that it is only complementary actors providing employment services of the type also offered by the itself, requiring such an extensive exchange of information and personal data processing, that are in need of professional secrecy that is subject to penalty if violated and a special register statute. Just like the , some complementary actors will, to a certain extent, provide health and care services, for example in connection with conducting occupational psychology examinations. Existing health and care regulations in the Act (2008:355) and the Patient (2010:659) will continue to apply to this area of services provided by complementary actors. It is proposed that complementary actors providing services as introduction guides be exempted from the regulations on professional secrecy and the obligation to provide information in the Act on complementary actors. The Act on introduction activities for certain newly arrived immigrants (2010:197) contains regulations on professional secrecy which will be slightly changed. However, the regulations on personal data processing contained in the proposed Act will also apply to introduction guides. Release of data from the to complementary actors In order for complementary actors to perform their tasks in an efficient , the must be able to release certain data about jobseekers and employers to the complementary actors. At present, the must largely depend upon the individual jobseeker or employer agreeing to releasing the data. If an individual does not consent to the data being released, it could lead to the complementary actors having inadequate material, which in turn would impact on the quality and effectiveness of the service as well as the opportunity for the complementary actor to claim its right to compensation. It may be considered that societys interest in the services offered by the complementary actors being as effective as possible, and in there being a large number of complementary actors, outweighs the individuals interest in being able to determine what data is to be released to the complementary actor. The Inquiry therefore proposes that a special provision overriding secrecy be introduced in Chapter 28 of the Public Access to Information and Secrecy Act to the effect that the Swedish Public Employment Service may release data to complementary actors notwithstanding secrecy provisions if this data is necessary for the complementary actor to perform its tasks. A detailed account of the data covered by the provision overriding secrecy will be given in the proposed Act on complementary actors and in the associated ordinance. Within the given legislative framework, it is the , and not the complementary actor, that makes an assessment of what data is necessary to perform the task in an individual case. From the perspective of equal treatment, it is important that the assess the needs of complementary actors to ensure that different complementary actors providing the same service have access to the same type of information. If the complementary actors consider that they need more data than the has released in accordance with the proposed provision, or if the jobseeker wishes more data to be released, there is still an opportunity contained in Chapter 10, Section 1 of the Public Access to Information and Secrecy Act to release the data with the consent of the individual. Professional secrecy and the obligation to provide information for complementary actors The protection in place concerning the privacy of individuals in public services should also be maintained when complementary actors are engaged. Professional secrecy which is prescribed by law and subject to penalty if violated should therefore be introduced for complementary actors. However, this must not restrict their opportunities to perform their tasks in an efficient . The Inquiry proposes the introduction of professional secrecy prescribed by law for those who are, or who have been, in services provided by complementary actors, entailing that they may not disclose information to which they have access within the framework of their task without authorisation. Professional secrecy covers both data about a private partys personal circumstances and a private partys business and operational circumstances, and the data may not be used in other activities run by complementary actor. Without authorisation does not refer to releasing data if it is necessary to perform the assigned task, to someone meeting an obligation to provide information that follows from an act or an ordinance, or to a situation where an individual consents to the data being released. Professional secrecy is not applicable with regard to the individual concerned. is obliged to report data that may affect the jobseekers right to benefits to the unemployment insurance system and . Carrying out this obligation depends on the complementary actors releasing the relevant data to the . Introduction guides are already obliged to report data that may affect a newly arrived immigrants right to introduction benefits to the public authority specified by regulation2. The Inquiry proposes the introduction of a general obligation for complementary actors to provide data that may affect a jobseekers right to unemployment benefit or the right to take part in a labour market policy programme to the . This kind of obligation to provide information would make clear to complementary actors that they not only provide a service for jobseekers, they also play an important role in ensuring that jobseekers receiving benefits contribute to solving their situation as unemployed in the required of them by society. Regulations concerning processing of personal data by complementary actors The Act only applies if the data processing is or partly automated, or if the data is included in, or is intended to form part of, a structured compilation of searchable personal data or a compilation according to particular criteria. The Inquiry considers that it should be stated directly in the Act that the complementary actors have the right to process data about employers, jobseekers and those close to them that is necessary to carry out the task from the . This would clarify the right of complementary actors to process personal data and, in combination with an electronic procedure, speed up the process of getting the individual into work. The data that may be processed will be determined by the Government in an ordinance. 2 Section 16, Act on introduction activities for certain newly arrived immigrants (2010:197). In order to bring about personal data processing that is efficient and legally secure, the Inquiry proposes that the Act state the conditions under which a complementary actor may release data on media for automated processing. One prerequisite is of course that the security requirements under Section 31 of the Act are fulfilled when transferring data and that the complementary actor has a legal basis for breaking professional secrecy. The complementary actors should be given the opportunity to provide the with data on media for automated processing if there is an obligation to provide information under an act or an ordinance, or if it is necessary to perform the assigned task. Complementary actors should also be allowed to release data electronically to employers if it is necessary to perform the task and where sensitive or delicate personal data is not involved. It is proposed that the Government may issue more detailed regulations on what data a complementary actor may release. The Inquiry considers that the provisions in the Personal Data Act concerning rectification, damages and penalties are to apply when processing personal data under the Act on complementary actors or under regulations issued in connection with this Act. In order to ensure good privacy protection for individuals regarding both jobseekers and individual companies, the Inquiry considers it important that the provide a support system for the activities. This is also an important condition for smaller companies to be able to compete with larger companies, which usually have much greater resources to invest in their security efforts. The Inquiry proposes that the provide a database (a support system) where the complementary actors can process the personal data necessary to perform their task and to facilitate secure electronic data communications between the and the complementary actors. The idea is for the to design a system with built-in privacy protection that makes it possible for all complementary actors, large and small, to meet the strict security requirements in place when processing personal data due to its sensitivity. is thus responsible for ensuring that appropriate technical measures such as those referred to in Section 31 of the Act are taken to protect the personal data processed in the database. Each complementary actor is the controller of the personal data it processes in the database to perform its task. is not to have direct access to the complementary actors data contained in the database, and conversely the complementary actors are not to have direct access to the labour market policy database. The Inquiry proposes that privacy-sensitive personal data may only be processed in the database provided by the . Under the proposed Act on complementary actors, it is only certain sensitive personal data defined in Section 13 of the Act (concerning health or revealing ethnic origin) that may be processed at all. It is proposed that this sensitive data, which may be processed by the complementary actors if the data was released within the framework of the task or if the data is absolutely necessary to the performance of the task, be protected by restricting where the data may be processed. The same restrictions should apply to data on social circumstances as well as to evaluations, conclusions or other value information about an individuals delicate personal data, and data on those close to jobseekers. In addition, regular notes taken by complementary actors about jobseekers and their lives in connection with the performance of the task should be protected in a similar , since they often provide a detailed picture of the jobseeker and his or her life. Restrictions corresponding to those in the statutes on registers should also be stated in the Act. This means that personal data that reveals political opinions, religious or philosophical beliefs, or trade union membership, or personal data concerning a persons sex life, may not be processed in the database. Other data that may not be processed in the database includes personal data on violations of the law, data indicating that the individual has been cared for under the Act or has been the subject of measures under the Aliens Act. For complementary actors to use their business ideas and make use of their own systems in the task of getting jobseekers into work and matching jobseekers with employers, it should be possible to process personal data normally not considered as privacysensitive outside the database. This category of data includes data that a jobseeker normally provides to an employer when submitting a job application, i.e. name, contact information and qualifications (CV information). This regulation means that complementary actors may enter data in their candidate databases, book meetings by means of their calendars and, where applicable, use their own matching tools for internal use. The Inquiry does not propose any restrictions concerning the use of search terms. In view of the in which the complementary actors will be allowed to process personal data in the database, no such need exists. The way the proposal is formulated, they will only have access to one jobseeker at a time. There is no risk that a sensitive compilation of data will become an official document since it is not proposed that the have direct access to data in the database. Personal data in the database will be deleted when it is no longer necessary for carrying out the task, but no later than two years after the end of the year in which the task carried out for the is concluded. This means that in certain cases, a complementary actor that concludes a task can access the data for a longer period of time, since it is still in the database. for consequential amendments to the Act to handle personal information in labour market policy activities (2002:546) (Register Act) For the sake of clarity, it should be made clear in the Register Act that it does not cover databases for complementary actors. The provisions of the Register Ordinance limiting the Services opportunities to process data on health and social circumstances that has been released in a case, or which is absolutely necessary to its processing, should be removed. Since complementary actors are considered to have a need to process this kind of data, this amendment is necessary for communications between complementary actors and the to function in an efficient and legally secure . Data that, following a secrecy check, the is allowed to release should be available on media for auto- This does not require any amendments to the register statues. Processing of union representatives personal data in the Platsbanken database The Inquiry considers that the should be permitted to process data revealing union membership of the employers contacts in connection with a job advertisement. This data fulfils a function that is desired by the trade union organisations, and employer representatives do not have any objections to this data being published. The Inquiry proposes that it be clarified in the Register Act that the may, in connection with a job advertisement, process and publish data that reveals the trade union membership of an employers contact person, provided that the person in question has given their consent to the employer. Processing of personal data concerning offences, etc. at has been instructed by the Government to develop work to ensure correct payments from the unemployment insurance funds and to combat benefit fraud. To be able to carry out this task, needs to systematically follow up any incorrect payments from the unemployment insurance funds, the extent to which cases are reported to the under the Benefit Crime Act (2007:612) and the outcome of reported cases. Under its current Register Ordinance, is not permitted to process data on offences, etc. in its statistics and supervisory database, and searches of these reports and follow-ups must therefore be conducted manually. This unjustifiably limits the Boards possibilities of effectively developing procedures for preventing incorrect payments and combating benefit fraud. The Inquiry proposes that be permitted to process such data on benefit fraud in its statistics and supervisory database if this data has been released in a case or is necessary for the processing of a case. It should also be possible to use the data as search terms for the supervision, followup and compilation of de-identified statistics. By including a limitation in the Ordinance on processing data concerning benefit fraud involving compensation under the Act (1997:238), the processing will be less of an encroachment on individual privacy. The fact that is now permitted to use data on benefit fraud as a search term means that any compilations generated by the use of the search term are official documents. This type of data at is currently covered by secrecy under Chapter 28, Section 13 of the Public Access to Information and Secrecy Act. This provision states that the presumption is in favour of public access. In light of the fact that data on violations of the law that constitute criminal offences are considered to be particularly privacy-sensitive, the Inquiry considers that the interest of protecting data outweighs the interest of transparency. The Inquiry therefore proposes the introduction of a new paragraph in Chapter 28, Section 13 of the Public Access to Information and Secrecy Act under which data on violations of the law constituting criminal offences and judgments in criminal cases concerning unemployment benefit matters under the Act (1997:238), and in matters on membership fees for unemployed members under the Act (1997:239), is covered by secrecy unless it is clear that the data may be disclosed without the individual or those close to him or her suffering harm, i.e. a presumption of secrecy. The legislative proposals are expected to result in more secure and efficient personal data processing in the labour market policy area. They will ensure good protection for the personal privacy of the individual regardless of who performs the employment service. The regulations make clear the conditions under which the complementary actors may process personal data and which special restrictions are to apply to protect privacy-sensitive data. The introduction of legislative support for processing by complementary actors and a provision overriding secrecy, as well as the potential for secure electronic communications, are expected to make it easier to take measures faster than is currently the case. This provides the potential to reduce the time an individual spends in unemployment. This should be positive for employment in and thus also for the states finances, resulting in reduced costs for the unemployment insurance system. Processing personal data in activities run by complementary actors places great demands on security from both a technical and an organisational perspective. The proposed solution that the provide a database for complementary actors is expected to substantially reduce the costs for the companies data processing, not least as regards IT security. Tasking the with providing the system and being responsible for its security should result in costsavings and less trouble, particularly for small companies. Overall, the Inquirys proposals should improve the competitiveness of small companies compared with large companies. has stated that the costs of setting up a database for complementary actors with the desired functionality are expected to amount to some million. It is estimated that the project period for setting up the new support system will take about one year. It is proposed that the system be financed within the framework of the budget, or through loans from the Debt Office. The Inquirys proposal on allowing to process data on offences in its statistics and supervisory database is expected to facilitate and streamline the Boards work on preventing incorrect payments and combating benefit fraud. This in turn should lead to savings for the state in the form of reduced payments from the unemployment benefit system. It is proposed that the Act on complementary actors and the other legislative amendments enter into force on 1 2013.