sou · H3B373 · 2015-08-03 00:00:00 — Undantag från arkivlagens bestämmelser föreslås således gälla 1) för fingeravtrycks- och fotografiregister där uppgifter förslås gallras enligt nuvarande ord- ning, 2) för känsliga personuppgifter som har behandlats för ända- målen tillsyn, kontroll, uppföljning, planering av verksamheten, framställning av statistik eller testverksamhet som föreslås gallras direkt när behandlingen är nödvändig för något av de angivna ändamålen och 3) för personuppgifter som behandlar automatiskt därför att ett offentligt biträde, en tolk, en översättare eller språkanalytiker kan vara olämplig för framtida uppdrag som föreslås gallras . För att stärka de enskildas personliga integritet föreslår utred- ningen att tillgången till uppgifter som inte längre behövs för de i lagen angivna ändamålen ska begränsas genom en bestämmelse om avskiljande av sådana uppgifter. Genom bestämmelsen föreslås att personuppgifter i automatiserade uppgiftssamlingar som används i myndigheternas löpande verksamhet ska avskiljas när de inte längre behövs i denna verksamhet. Åtkomst till avskilda uppgifter föreslås vara förbehållen endast de personer som är i absolut behov av uppgifterna för att kunna utföra sina arbetsuppgifter. Den nya lagen föreslås vara en ramlag som endast innehåller de grundläggande bestämmelserna om skydd för enskildas personliga integritet. I lagförslaget ges möjlighet till föreskrifter på lägre nivå. Sådana föreskrifter kan meddelas när det gäller fingeravtrycks- och fotografiregister, tillgången till personuppgifter, direktåtkomst, överföring av personuppgifter till tredjeland, avskil- jande, gallring och säkerhetsåtgärder. Utlänningsdatalagen och den nya utlänningsdataförordningen före- slås träda i kraft . Utredningens förslag innebär att kan registrera identitetsuppgifter, speciell kompetens och avvikelser rörande andra offentliga biträden än advokater och biträdande jurister, tolkar, över- sättare och språkanalytiker. Med avvikelser avses i huvudsak upp- gifter om misskötsamhet, oskicklighet och inkompetens men även uppgifter om att en uppdragstagare har begått brott eller försatts i konkurs. Sådana avvikelser kan innebära att en uppdragstagare är olämplig för uppdrag. Registreringen av aktuella uppgifter syftar till att stärka rättssäkerheten för enskilda i asylprocessen. Av integri- tetsskäl föreslås dock att uppgifter om avvikelser ska gallras . Ett effektivare informationsutbyte vid handläggning av uppehållstillstånd för arbete och arbetstillstånd Utredningen föreslår att bör medges direktåtkomst till vissa personuppgifter i beskattningsdatabas, utsöknings- och indrivningsdatabas samt För- säkringskassans och socialförsäkringsdatabas. har tillgång till de flesta uppgifterna. Det nya är alltså att verket nu föreslås få direktåtkomst till uppgifterna. Utredningen har särskilt analyserat behov av direktåtkomst till uppgifterna samt behovet av regler som ger enskilda ett bra skydd för den personliga integriteten vid direktåtkomsten. Sistnämnda regler föreskriver ett ansvar för såväl de utlämnande myndigheterna som mottagarmyndigheten. rätt att ta del av uppgifter från fingeravtrycksregister Utredningen föreslår att bör ha rätt att ta del av uppgifter från fingeravtrycksregister (A-filen i det automatiserade fingeravtrycksidentifieringssystemet, AFIS) vid kontroller av fingeravtryck som tagits med stöd av 9 kap. 8 § utlän- ningslagen (2005:716, UtlL). Enligt den sistnämnda paragrafen får i vissa fall ta fingeravtryck på en utlänning. Det gäller bland annat om utlänningen inte kan styrka sin identitet. Bak- grunden till utredningens förslag är att kontroller mot Polismyn- dighetens fingeravtrycksregister förbättrar möjligheterna att fastställa en korrekt identitet på utlänningen. Sammantaget menar utredningen att detta intresse väger tyngre än de eventuella integritetsrisker som kan förknippas med en sådan möjlighet. Skadeståndsskyldighet efter kontroller av Schengenviseringar Bestämmelserna i 9 kap. 8 c § UtlL innebär att en utlänning är skyl- dig att låta en polisman, en särskild förordnat passkontrollant eller en tjänsteman vid , eller Migrations- verket ta hans eller hennes fingeravtryck för kontroll av identiteten och av Schengenviseringens äkthet genom sökning i informations- systemet för visering (VIS). Motsvarande skyldighet gäller även för en utlänning som vid en in- eller utresekontroll inte kan styrka sin identitet och som får kontrolleras mot VIS i identifieringssyfte. När en kontroll har genomförts ska de fingeravtryck som tagits för kontrollen förstöras. Det gäller också de biometriska data som tagits i samband med kontrollen. Utredningen föreslår en klargörande regel om att det är den myn- dighet som har utfört kontrollen som är ansvarig för att uppgifterna förstörs och att skadestånd kan utgå om förstöringsskyldigheten försummas. In this report, the Inquiry gives an account of its remit to draw up a proposal for an act on the processing of personal data in activities under the aliens and citizenship legislation (Terms of Reference 2014:76). In connection with this, we also present a survey of the processing of personal data in these activities and an analysis of whether the processing that is done is necessary and whether addi- tional personal data processing is needed to promote effectiveness and efficiency. The Inquiry also reports on several other issues that it has been specifically instructed to analyse. A new act on the processing of personal data in activities under the aliens and citizenship legislation The purpose and design of the act Under the Inquiry’s proposals, the processing of personal data in activities under the aliens and citizenship legislation will be regula- ted by an act designed to take account of the protection of personal privacy provided by Chapter 2, Article 6, second paragraph of the Instrument of Government, the Act (1998:204) and Directive 95/46/EC of Parliament and of 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the ‘Data Protection Directive’). However, it has not been possible to adapt the proposals to the ongoing reform of the EU regulations on protection of personal data, as the work on this reform has not yet been concluded (2015). The act – which it is proposed will be called the ‘Act’ – and a proposed associated ordinance will replace the current Ordinance on the Processing of in Activities under the Legislation on Aliens and Citizenship (2001:720). The proposed overall purpose of the act is to enable relevant authorities to process personal data effectively in their activities under the aliens and citizenship legislation and to protect people from violations of their personal privacy in connection with such processing. The act has been drawn up as a framework law. The basic provisions for the purpose of protecting the data subject against infringements of personal privacy are given in the act. Supplemen- tary provisions are given in subordinate statutes. The proposed act, which has been made technology-neutral, aims to make it possible for the authorities concerned to use modern and appropriate IT systems to enable the activities to be conducted as effectively as possible. Scope of the act Under the proposal, the Act will be applicable to the processing of personal data in activities under the aliens and citizenship legislation conducted by the , the Swedish Authority, the missions abroad. The act specifies more exactly and exhaustively what these activi- ties consist of. With regard to the activities of the missions abroad, the proposed application of the act will concern personal data processing relating to: 1.the entry of aliens into or some other state that belongs to Union or Economic Area, or work in , and exit from ; 3.the reception of asylum seekers and other aliens; 4.financial assistance and allowances paid to aliens; 6.compensation from central government for costs relating to aliens; and 7.the settlement of aliens. With regard to the activities of the Swedish Authority and the , the proposed application of the act will concern personal data processing relating to aliens’ entry into, exit from, in or removal from . However, under the proposal, certain personal data processing by the authorities concerned will fall outside the scope of the act even though, in and of itself, the act could have applied. This concerns, for example, the processing of personal data under the Act (2000:344) and the EU regula- tions generally referred to as the VIS Regulation, the Visa Code and the Eurodac Regulation. Moreover, the act will not be applicable when personal data is processed pursuant to the Act (2010:361). Like the Act, it is proposed that the act apply when the processing of personal data is or partly automated, and when the personal data is included in, or is intended to form part of, a structured compilation of searchable personal data or a compilation according to particular criteria. The proposed scope has therefore been widened somewhat compared with what applies under the current Ordinance, which primarily concerns the processing of personal data in various records of activities. Relationship to the Act Under the proposal, the provisions in the new act will generally take precedence over the provisions of the Act. However, certain provisions in the Act will be applicable to activities under the aliens and citizenship legislation. These provisions are specifically indicated in the new act. They include the provisions of the Act on the relationship to the principle of public access to official documents (Section 8), fundamental requirements concerning the processing of personal data (Section 9), the pro- cessing of data concerning personal identity numbers (Section 22), the transfer of personal data to third countries (Sections 33–35) and damages (Section 48). Control of personal data It is proposed that the authority undertaking processing or respon- sible for doing so should be the controller of personal data in the process. As an exception to this general rule, it is proposed that the should be the controller of personal data for automated processing of personal data by Swedish missions abroad. In addition, it is proposed that the , the Swedish Authority and the should be obliged to appoint one or more personal data representatives for the processing of personal data that they undertake or are respon- sible for undertaking. Under the proposal, the processing of personal data pursuant to the Act will only be permitted if necessary for certain specifically stated purposes. The purposes, which may be primary or secondary, will be clari- fied by the act. The proposed primary purposes of personal data processing by the , the Swedish Authority, the missions abroad are as follows: 1.processing of matters or assistance by an authority in such matters in activities within the scope of the act (see above); 2.controls of aliens in connection with entry and exit and controls during in ; 3.performance of working duties relating to the reception and settlement of asylum seekers and other aliens; 4.supervision, control, monitoring, planning of activities, pro- duction of statistics and pilot activities; or 5.fulfilment of a legal obligation to register or otherwise document personal data. Furthermore, it is proposed that the be permitted to process personal data if this is necessary to retrieve decisions, judicial investigations and other legal information or infor- mation relating to conditions in other countries. In addition, it is proposed that personal data processed in accor- dance with the above-listed primary purposes should also be per- mitted to be processed in accordance with the secondary purposes listed below if this is necessary to make information available: 1.to another public authority or individual, if the data is disclosed pursuant to an act or ordinance; or 2.to a foreign authority, an EU body or an international organi- sation, if the disclosure of data follows from ’s member- ship of Union or ’s obligation to supply information under an international convention to which has acceded or an agreement with a foreign state or international organisation that has been approved by the Riksdag. In an individual case, personal data processing will also be permitted to make information available for a purpose other than those now mentioned, provided that the purpose is not incompatible with the purpose for which the data was obtained (the ‘principle of finality’). Separate regulations with more limited provisions on purposes are proposed for the records of fingerprints and photographs kept by the . The term ‘sensitive personal data’ refers to data that reveals a person’s race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and data relating to health and sex life. Such data has to be processed extensively in the aliens and citizenship area. The Inquiry proposes that sensitive personal data should be permitted to be processed, in principle, for all the pur- poses for which processing is permitted. However, one condition, if the data subject has not given explicit consent to processing or made the data public in some obvious way, is that the data is absolute- ly essential for the purpose of the processing. The condition that the data must be absolutely essential underlines that it should be processed with caution, never as a matter of routine. Access to personal data Generally speaking, large collections of information stored in a that makes them easily searchable by electronic means entail an increased risk of violations of individuals’ privacy. As a step in strengthening the protection of privacy, a provision is proposed in the act to the effect that access to personal data will be limited to what each official needs in order to carry out their duties. In addition, it is proposed that the , the Swedish Authority and the be able to issue more detailed regulations on access to personal data for persons working in that authority. Under the Inquiry’s proposals, the should also be able to issue relevant regulations regarding data processed by automated means at Swedish missions abroad. As an additional measure to strengthen the protection of privacy, restrictions are proposed on the search terms that may be used when searching personal data for certain purposes in certain cases. It is proposed that the use of sensitive personal data as search terms will be restricted to processing for the purpose of supervision, control, monitoring, planning of activities, production of statistics or pilot activities, and for data retrieval in certain cases. needs to be able to use sensitive personal data as search terms for the production of certain statistics, for example, and in preparing activities in response to expected refugee flows. With certain exceptions, it is proposed that personal data on violations of the law should not be permitted to be used as search terms. Electronic disclosure of personal data Even if electronic disclosure of personal data involves certain risks to privacy, the Inquiry considers that, with the exception of dis- closure via direct access, there is no need to introduce special regulations on when electronic disclosure may occur. Consequently, no such provisions are proposed. It is proposed that for certain special purposes, the Swedish Authority, the , Swedish missions abroad, the , the and the be allowed direct access to certain personal data processed by automated means by the . Exhaustive regulation of direct access is proposed. The regulations on direct access have been designed bearing in mind the special risks that direct access entails for individuals’ privacy. Among other things, the receiving authorities must have a real need for the data and the data that may be made available is specified by statute as precisely as possible. In addition, before direct access is permitted, the must make sure that the receiving authority meets the authorisation and security require- ments. Further requirements proposed are that access to the data at the receiving authorities be restricted to what the individual official needs to be able to fulfil his or her duties. The Inquiry proposes some provisions overriding secrecy in consequence of direct access. Transfer of personal data to third countries The Inquiry has found that in certain cases personal data needs to be transferred to third countries irrespective of whether the indi- vidual has consented to this. A provision on further exceptions to the prohibition against transferring personal data to third countries enacted in Section 33 of the Act is therefore pro- posed for these cases. The proposed exception will mean that personal data may be transferred to a third country if this is absolutely essential for (1) the processing of a matter or assistance in such a matter; (2) controls of an alien in connection with entry or exit or controls during the alien’s stay in ; or (3) processing undertaken for the purpose of retrieving decisions, judicial investigations and other legal information. Retention, deletion and detachment In the Inquiry’s opinion, personal data processed by automated means in public documents in the activities concerned should in general be retained or deleted as directed by the provisions of the Archives Act (1990:782), as is currently the case. As the Inquiry sees it, the argument in favour of retention is the public interest in the trans- parency of the activities. This interest is particularly manifested by researchers and journalists. Furthermore, the Inquiry considers it far from obvious that the interests of privacy are best served by destroying personal data. Moreover, in these activities it is often necessary to retrieve data from previous matters. However, the Inquiry considers that exceptions should be made to this general rule in certain cases. Accordingly, exceptions to the provisions of the Archives Act are proposed for (1) the ’s fingerprint and photograph records, where it is proposed that data be deleted in accordance with the current arrange- ments; (2) sensitive personal data processed for the purposes of supervision, control, monitoring, planning of activities, production of statistics or pilot activities, where it is proposed that this data be deleted immediately the processing is no longer necessary for any of the purposes stated; and (3) personal data processed by auto- mated means by the because a public counsel, an interpreter, a translator or a language analyst may be unsuitable for future commissions, where it is proposed that this data be deleted after a short time. To strengthen individual privacy, the Inquiry proposes that access to data that is no longer needed for the purposes stated in the act be limited by means of a provision on the detachment of such data. The proposed provision will direct that personal data in auto- mated data compilations that are used in the authorities’ day-to- day activities shall be detached when it is no longer needed for these activities. It is proposed that access to detached data be limited to persons who are in absolute need of the data in order to carry out their duties. Under the proposal, the new act will be a framework law containing only the basic provisions on protection of individuals’ personal privacy. The proposed act allows the possibility of regulations at a lower level. Such regulations may be issued with regard to the ’s fingerprint and photograph records, access to personal data, direct access, transfer of personal data to third countries, detachment of data, deletion and security measures. Entry into force and transitional provisions The proposed date for entry into force of the new Act and Ordinance is 1 January 2016. Registration of quality assessments The Inquiry’s proposal means that the will be able to register data on the identity, special expertise and defects relating to public counsels other than members of the and legal associates, interpreters, translators and language analysts. The term ‘defects’ refers chiefly to data on negli- gence, inadequacy and incompetence, but also data showing that a contractor has committed an offence or been declared bankrupt. Such defects can mean that a contractor is unsuitable for commis- sions. The registration of these types of data is intended to enhance the legal security of individuals in the asylum process. However, for reasons of integrity, it is proposed that data on defects be de- leted after a short time. efficient information exchange in the processing of permits for purposes of employment and work permits The Inquiry proposes that the should be allowed direct access to certain personal data in the ’s taxation database, the Swedish Enforcement Authority’s enforcement and collection database and the Swedish Social In- surance Agency’s and ’s social insurance database. already has access to most of this data. What is new is the proposal that the Agency should now be given direct access to the data. The Inquiry has made a special analysis of the ’s need for direct access to the data and the need for rules that give the individual good privacy protection in the event of direct access. These rules entail a responsibility for both the disclosing authority and the receiving authority. The right of the to access data in the Swedish Authority’s fingerprint records The Inquiry proposes that the should have the right to access data from the Swedish Authority’s fingerprint records (the A file in the automated fingerprint identi- fication system, AFIS) when checking fingerprints taken pursuant to Chapter 9, Section 8 of the Aliens Act (2005:716). This section of the Act allows the to take an alien’s fingerprints in certain cases. This is allowed, for example, if the alien is unable to provide proof of identity. The thinking behind the Inquiry’s proposal is that checking against the Swedish Authority’s fingerprint records improves the of establishing the correct identity of the alien. On balance, the Inquiry considers that this interest outweighs the possible integrity risks that may be associated with this possibility. Liability for damages after controls of Schengen visas Under the provisions of Chapter 9, Section 8c of the Aliens Act, an alien is obliged to allow a policeman, a specially appointed passport official or an official at the Swedish Customs, the Swedish Guard or the to take his or her finger- prints in order to check the alien’s identity and the genuineness of the Schengen visa by searching in the (). A corresponding obligation also applies to an alien who is unable to prove his or her identity during entry or exit controls and who may be checked against the VIS for identification purposes. After a control has been carried out, the fingerprints taken for control purposes must be destroyed immediately. This also applies to biometric data taken in connection with the control. The Inquiry proposes a regulation clarifying that it is the authority that has carried out the control that is responsible for the data being destroyed and that damages may be payable if the obligation to destroy the data is neglected. Härigenom förskrivs följande. 1 § Syftet med denna lag är att ge , Polismyndig- heten, Säkerhetspolisen och utlandsmyndigheterna möjlighet att behandla personuppgifter på ett ändamålsenligt sätt i verksamhet enligt utlännings- och medborgarskapslagstiftningen och att skydda människor mot att deras personliga integritet kränks vid sådan be- handling. 2 § Denna lag gäller vid behandling av personuppgifter i Migrations- verkets och utlandsmyndigheternas verksamhet som rör: 1.utlänningars inresa i eller i en stat som ingår i Europeiska unionen eller i en stat som är ansluten till Europeiska ekonomiska samarbetsområdet, vistelse eller arbete i samt utresa från , 3.mottagande av asylsökande och andra utlänningar,