3HUVRQDO'DWD$FW  
issued 29 April 1998.
Be it enacted as follows.
*HQHUDOSURYLVLRQV
3XUSRVHRIWKLV$FW
6HFWLRQ
The purpose of this Act is to protect people against the violation of their personal integrity byprocessing of personal data.
'HYLDWLQJSURYLVLRQVLQDQRWKHUHQDFWPHQW
6HFWLRQ
If another statute or other enactment contains provisions that deviate from this Act, those
provisions shall apply.
'HILQLWLRQV
6HFWLRQ
In this Act the following terms are used with the meaning stated below.
7HUP

0HDQLQJ

Processing (of personal data)

Any operation or set of operations which is taken as
regards personal data, whether or not it occurs byautomatic means, for example collection, recording,organisation, storage, adaptation or alteration,
retrieval, gathering, use, disclosure by transmission,
dissemination or otherwise making information
available, alignment or combination, blocking,erasure or destruction.

Blocking (of personal data)

An operation that is taken in order that personal data
shall be linked with information that they are
restricted and about the reasons for the restriction andin order that personal data should not be provided toa third party except under the provisions of Chapter 2of the Freedom of the Press Act.

Recipient

A person to whom personal data is provided.
However, when personal data is provided in orderthat an authority should be able to perform suchsupervision, control or audit that it is under a duty toattend to, the authority shall not be regarded as arecipient.

Personal data

All kinds of information that directly or indirectly
may be referable to a natural person who is alive.

2

Controller of personaldata

A person who alone or together with others decides
the purpose and means of processing
personal data.

Personal data assistant

A person who processes personal data on
behalf of the controller of personal data.

Personal data representative

A natural person, appointed by the controller of
personal data, who shall independently assure thatthe personal data is processed in a correct and lawfulmanner.

The registered person

A person to whom the personal data relates.

Consent

Every kind of voluntary, specific and unambiguous
expression of will by which the registered person,
after having received information, accepts processingof personal data concerning him or her.

Supervisory authority

The authority appointed by the Government toperform supervision.

Third country

A state that is not included in the European Union orpart of the European Economic Area.

Third party

A person other than the registered person, thecontroller of personal data, the personal data
representative, the personal data assistant and such
persons who under the direct responsibility of thecontroller of personal data or the personal dataassistant is authorised to process personal data.

6FRSH
7KHWHUULWRULDOVFRSH
6HFWLRQ
This Act applies to those controllers of personal data who are established in Sweden.
The Act is also applicable when the controller of personal data is established in a third country
but for the processing of the personal data uses equipment that is situated in Sweden.
However, this does not apply if the equipment is only used to transfer information between athird country and another such country.
In the case referred to in the second paragraph, first sentence, the controller of personal data
shall appoint a representative for himself who is established in Sweden. The provisions of thisAct concerning the controller of personal data shall also apply to the representative.

3

3URFHVVLQJRISHUVRQDOGDWDVXEMHFWWRWKH$FW
6HFWLRQ
This Act applies to such processing of personal data as is wholly or partly automated.
The Act also applies to other processing of personal data, if the data is included in or isintended to form part of a structured collection of personal data that is available for searchingor compilation according to specific criteria.
([HPSWLRQRISULYDWHSURFHVVLQJRISHUVRQDOGDWD
6HFWLRQ
This Act does not apply to such processing of personal data that a natural person performs in
the course of activities of a purely private nature.
5HODWLRQVKLSWRIUHHGRPRIWKHSUHVVDQGIUHHGRPRIH[SUHVVLRQ
6HFWLRQ
The provisions of this Act are not applied to the extent that they would contravene theprovisions concerning the freedom of the press and freedom of expression contained in theFreedom of the Press Act or the Fundamental Law on Freedom of Expression.
The provisions of Sections 9–29 and 33–44 and also Section 45, first paragraph, and Sections
47–49 shall not be applied to such processing of personal data as occurs exclusively forjournalistic purposes or artistic or literary expression.
5HODWLRQVKLSWRWKHSULQFLSOHRISXEOLFDFFHVVWRRIILFLDOGRFXPHQWV
6HFWLRQ
The provisions of this Act are not applied to the extent that they would limit an authority’s
obligation under Chapter 2 of the Freedom of the Press Act to provide personal data.
Nor do the provisions prevent an authority from archiving or saving official documents or thatarchive material is taken care of by an archive authority. The provisions of Section 9, fourthparagraph, do not apply to the use by an authority of personal data in official documents.
)XQGDPHQWDOUHTXLUHPHQWVIRUSURFHVVLQJRISHUVRQDOGDWD
6HFWLRQ
The controller of personal data shall ensure thata) personal data is processed only if it is lawful,b) personal data is always processed in a correct manner and in accordance with goodpractice,c) personal data is only collected for specific, explicitly stated and justified purposes,d) personal data is not processed for any purpose that is incompatible with that for which theinformation is collected,

4e) the personal data that is processed is adequate and relevant in relation to the purposes ofthe processing,f) no more personal data is processed than is necessary having regard to the purposes of theprocessing,g) the personal data that is processed is correct and, if it is necessary, up to date,h) all reasonable measures are taken to correct, block or erase such personal data as isincorrect or incomplete having regard to the purposes of the processing, andi) personal data is not kept for a longer period than that as is necessary having regard to the
purpose of the processing.
However, as regards the first paragraph, d), the processing of personal data for historical,
statistic or scientific purposes shall not be regarded as incompatible with the purposes forwhich the information was collected.
Personal data may be kept for historical, statistic or scientific purposes for a longer time thanthat stated in the first paragraph i). However, personal data may not in such cases be kept for alonger period than is necessary for these purposes.
Personal data that is processed for historical, statistical or scientific purposes may be used inorder to take measures as regards the person registered only if the person registered has given
his/her consent or there is extraordinary reason having regard to the vital interests of theregistered person.
:KHQSURFHVVLQJRISHUVRQDOGDWDLVSHUPLWWHG
6HFWLRQ
Personal data may be processed only if the registered person has given his/her consent to theprocessing or if the processing is necessary in ordera) to enable the performance of a contract with the registered person or to enable measuresthat the registered person has requested to be taken before a contract is entered into,b) that the controller of personal data should be able to comply with a legal obligation,c) that the vital interests of the registered person should be protected,d) that a work task of public interest should be performed,e) that the controller of personal data or a third party to whom the personal data is provided
should be able to perform a work task in conjunction with the exercise of official authority,orf) that a purpose that concerns a legitimate interest of the controller of personal data or ofsuch a third party to whom personal data is provided should be able to be satisfied, if thisinterest is of greater weight than the interest of the registered person in protection against
violation of personal integrity.

5'LUHFWPDUNHWLQJ
6HFWLRQ
Personal data may not be processed for purposes concerning direct marketing, if the registeredperson gives notice in writing to the controller of personal data that he/she opposes suchprocessing.
5HYRFDWLRQRIFRQVHQW
6HFWLRQ
In those cases where processing of personal data is only permitted when the registered person
has provided his/her consent under Section 10, 15 or 34, the registered person is entitled to
revoke at any time consent that has been given. Further personal data about the registeredperson may not subsequently be processed.
A registered person is not entitled, beyond that provided by the first paragraph and Section 11,
to oppose such processing of personal data as is permitted under this Act.
3URKLELWLRQDJDLQVWSURFHVVLQJRIVHQVLWLYHSHUVRQDOGDWD
6HFWLRQ
It is prohibited to process personal data that revealsa) race or ethnic origin,b) political opinions,c) religious or philosophical beliefs, ord) membership of a trade union.
It is also prohibited to process such personal data as concerns health or sex life.
Information of the kind referred to in the first and second paragraphs is designated as VHQVLWLYHSHUVRQDOGDWDin this Act.
([HPSWLRQVIURPWKHSURKLELWLRQRISURFHVVLQJVHQVLWLYHSHUVRQDOGDWD
6HFWLRQ
Despite the prohibition of Section 13 it is permitted to process sensitive personal data in thosecases stated in Sections 15–19.
In Section 10 there are provisions concerning the cases in which processing of personal data is
not permitted in any case whatsoever.
&RQVHQWRUSXEOLFLVLQJ
6HFWLRQ
Sensitive personal data may be processed if the registered person has given his/her explicit
consent to processing or in a clear manner publicised the information.

6

1HFHVVDU\SURFHVVLQJ
6HFWLRQ
Sensitive personal data may be processed if the processing is necessary in order thata) the controller of personal data should be able to comply with his/her duties or exercise
his/her rights within employment law,b) the vital interests of the registered person or some other person should be able to beprotected and the registered person cannot provide his/her consent, orc) legal claims should be able to be established, exercised or defended.
Information that is processed on the basis of the first paragraph a) may be disclosed to a third
party only if there is within employment law an obligation for the controller of personal data to
do so or the registered person has explicitly consented to the provision.
1RQSURILWRUJDQLVDWLRQV
6HFWLRQ
Non-profit organisations with political, philosophical, religious or trade union objects may
within the framework of their operations process sensitive personal data concerning themembers of the organisation and such other persons who by reason of the objects of theorganisation have regular contact with it. However, sensitive personal data may be provided toa third party only if the registered person explicitly consents to it.
+HDOWKDQGKRVSLWDOFDUH
6HFWLRQ
Sensitive personal data may be processed for health and hospital care purposes, provided theprocessing is necessary fora) preventive medicine and health care,b) medical diagnosis,c) health care or treatment, ord) management of health and hospital care services.
A person who is professionally operational within the health care sector and is subject to a
duty of confidentiality may also process sensitive personal data that is subject to the duty ofconfidentiality. This also applies to the person who is subject to a similar duty ofconfidentiality and who has received sensitive personal data from the operation within thehealth care sector.
5HVHDUFKDQGVWDWLVWLFV6HFWLRQ
Sensitive personal data may be processed for research and statistics purposes, provided theprocessing is necessary in the manner stated in Section 10 and provided the interest of society
in the research or statistics project within which the processing is included is manifestly

7greater than the risk of improper violation of the personal integrity of the individual that theprocessing may involve.
If the processing has been approved by a research ethics committee, the prerequisites under the
first paragraph shall be deemed satisfied. Research ethics committee means such special bodyfor consideration of research ethics issues that has representatives for both the public and theresearch and that is linked to a university or a university college or to some other instance thatto a very substantial extent funds research.
Personal data may be provided to be used in such projects referred to in the first paragraph,
unless otherwise provided by the rules on secrecy and confidentiality.
$XWKRULVDWLRQWRSUHVFULEHIXUWKHUH[HPSWLRQV
6HFWLRQThe Government or the authority appointed by the Government may issue regulations onfurther exemptions from the prohibition in Section 13 if it is necessary having regard to an
important public interest.
,QIRUPDWLRQFRQFHUQLQJOHJDORIIHQFHVHWF
6HFWLRQ
It is prohibited for other parties than public authorities to process personal data concerning
legal offences involving crime, judgments in criminal cases, coercive penal procedural
measures or administrative deprivation of liberty.
The Government or the authority appointed by the Government may issue regulations on
exemptions from the prohibition in the first paragraph.
The Government may in an individual case decide on an exemption from the prohibition in thefirst paragraph. The Government may delegate power to the supervisory authority to makesuch decisions.
3URFHVVLQJRISHUVRQDOLGHQWLW\QXPEHUV
6HFWLRQ
Information about personal identity numbers or classification numbers may, in the absence ofconsent, only be dealt with when it is clearly justified having regard toa) the purpose of the processing,b) the importance of a secure identification, orc) some other noteworthy reason.

8,QIRUPDWLRQWRWKHUHJLVWHUHGSHUVRQ,QIRUPDWLRQVKRXOGEHSURYLGHGYROXQWDULO\
6HFWLRQ
If data about a person is collected from the person him/herself, the controller of personal data
shall in conjunction therewith voluntarily provide the registered person with information about
the processing of the data.
6HFWLRQ
If personal data has been collected from another source than the registered person, thecontroller of personal data shall voluntarily provide the registered person with information
about the processing of the data when it is registered. However, if the data is intended to bedisclosed to a third party, the information need not be given before the data has been disclosed
for the first time.
Information under the first paragraph need not be provided if there are provisions concerning
the registration or disclosure of personal data in an act or some other enactment.
Nor need information be provided in accordance with the first paragraph, if it proves to be
impossible or would involve a disproportionate effort. However, if the data is used to takemeasures concerning the registered person, the information shall be provided at the latest in
conjunction with that happening.
7KHLQIRUPDWLRQWKDWPXVWEHSURYLGHGYROXQWDULO\
6HFWLRQ
Information under Section 23 or 24 shall comprisea) information concerning the identity of the controller of personal data,b) information concerning the purpose of the processing, andc) all other information necessary in order for the registered person to be able to exercise
his/her rights in connection with the processing, such as information about the recipients of
the information, the obligation to provide information and the right to apply for
information and obtain rectification.
However, information need not be provided regarding such matters as the registered person
already knows of.
,QIRUPDWLRQVKDOOEHSURYLGHGXSRQDSSOLFDWLRQ
6HFWLRQThe controller of personal data is liable to provide, to every natural person who requests it,
free of charge notification once per annum of whether personal data concerning the applicant
is processed or not. If such data is processed, written information shall also be provided abouta) which information about the applicant that is processed,b) where this information has been collected,

9c) the purpose of the processing, andd) to which recipients or categories of recipients the information is disclosed.
An application under the first paragraph shall be made in writing to the controller of personal
data and be signed by the applicant him/herself. Information under the first paragraph shall be
provided within one month from when the application was made. However, if there are special
reasons for so doing, the information may be provided not later than four months after when
the application was made.
Information under the first paragraph does not need to be provided about personal data inrunning text that has not been given its final wording when the application was made or which
comprises an DLGHPHPRLUH or the like. However, that stated here does not apply if the data has
only been disclosed to a third party or if the data was only processed for historical, statisticalor scientific purposes or, as regards running text that has not been given its final wording, if
the data has been processed for a longer period than one year.
([HPSWLRQVIURPWKHREOLJDWLRQWRSURYLGHLQIRUPDWLRQLQWKHFDVHRIVHFUHF\DQGGXW\RI
FRQILGHQWLDOLW\
6HFWLRQ
To the extent that it is specifically prescribed by a statute or other enactment or by a decisionthat has been issued under an enactment that information may not be provided to the registeredperson, the provisions of Sections 23–26 do not apply. A controller of personal data who is not
an authority may in that connection in a corresponding case as referred to in the Secrecy Act(1980:100) refuse to provide information to the registered person.
5HFWLILFDWLRQ
6HFWLRQThe controller of personal data is liable at the request of the registered person to immediately
rectify, block or erase such personal data that has not been processed in accordance with thisAct or regulations that have been made under the Act. The controller of personal data shallalso notify a third party to whom the data has been disclosed about the measure, if theregistered person requests it or if more substantial damage or inconvenience for the registeredperson could be avoided by a notification. However, no such notification need be provided if it
is shown to be impossible or would involve a disproportionate effort.
$XWRPDWHGGHFLVLRQV
6HFWLRQ
If a decision that has legal effects for a natural person or otherwise has manifest effects for thenatural person, is based solely on automated processing of such personal data as is intended toassess the qualities of the person, the person who is affected by the decision shall have an
opportunity to have the decision reconsidered by a person upon request.
Anybody who has been the subject of such a decision as is referred to in the first paragraph isentitled to on application obtain information from the controller of personal data about what
has controlled the automated processing that resulted in the decision. As regards applications
and provision of information, the applicable parts of the rules under Section 26 apply.

10

6HFXULW\LQSURFHVVLQJ
3HUVRQVZKRSURFHVVSHUVRQDOGDWD
6HFWLRQA personal data assistant and a person or those persons who work under the assistant’s or thecontroller of personal data’s direction may only process personal data in accordance with
instructions from the controller of personal data.
There shall be a written contract on the processing by the personal data assistant of personal
data on behalf of the controller of personal data. It shall be specifically stipulated in thecontract that the personal data assistant may only process personal data in accordance with
instructions from the controller of personal data and that the personal data assistant is liable totake those measures referred to in Section 31, first paragraph.
If there are special provisions in a statute or other enactment concerning processing of personal
data in public operations as regards matters referred to in the first paragraph, these shall apply
instead of that stated in the first paragraph.
6HFXULW\PHDVXUHV6HFWLRQThe controller of personal data shall implement appropriate technical and organisational
measures to protect the personal data that is processed. The measures shall provide a level of
security that is appropriate having regard toa) the technical possibilities available,b) what it would cost to implement the measures,c) the special risks that exist with processing of personal data, andd) how sensitive the personal data processed really is.
If the controller of personal data engages a personal data assistant, the controller of personal
data shall ensure for him/herself that the personal data assistant can implement the security
measures that must be taken and ensure that the personal data assistant actually takes themeasures.
7KHVXSHUYLVRU\DXWKRULW\PD\GHFLGHRQVHFXULW\PHDVXUHV6HFWLRQ
The supervisory authority may in an individual case decide on which security measures thecontroller of personal data shall implement in accordance with Section 31.
Section 45 contains rules about the powers of the supervisory authority to make the decisionsubject to a default fine.

11

7UDQVIHURISHUVRQDOGDWDWRDWKLUGFRXQWU\
3URKLELWLRQRIWUDQVIHURISHUVRQDOGDWDWRDWKLUGFRXQWU\
6HFWLRQ
It is prohibited to transfer to a third country personal data that is undergoing processing unlessthe third country has an adequate level of protection for personal data. The provision also
applies to transfer of personal data for processing in a third country.
The adequacy of the level of protection afforded by a third country shall be assessed in thelight of all the circumstances surrounding the transfer. Particular consideration shall be given
to the nature of the data, the purpose of the processing, the duration of the processing, thecountry of origin, the country of final destination and the rules that exist for the processing in
the third country.
([HPSWLRQVIURPWKHSURKLELWLRQRIWUDQVIHURISHUVRQDOGDWDWRDWKLUGFRXQWU\
6HFWLRQ
Notwithstanding the prohibition in Section 33, it is permitted to transfer personal data to athird country if the registered person has given his/her consent to the transfer or if the transfer
is necessary fora) the performance of a contract between the registered person and the controller of personal
data or the implementation of precontractual measures taken in response to the request of
the registered,b) the conclusion or performance of a contract between the controller of personal data and athird party which is in the interest of the registered person,c) the establishment, exercise or defence of legal claims, ord) the protection of vital interests of the registered person.
It is also permitted to transfer personal data for use only in a state that has acceded to theCouncil of Europe Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data.
6HFWLRQThe Government may issue regulations about exemptions from the prohibition in Section 33 of
the transfer of personal data to certain states. The Government may also as regards automatedprocessing of personal data issue regulations about transfer of personal data to a third country
being permitted, provided the transfer is regulated by a contract that provides adequate
safeguards to protect the rights of the registered person.
Furthermore, the Government or the authority appointed by the Government issue regulations
about exemptions from the prohibition in Section 33, if this is necessary having regard to an
important public interest or if there are adequate safeguards to protect the rights of theregistered person.
The Government may, subject to the preconditions mentioned in the second paragraph, decidein individual cases on an exemption from the prohibition in Section 33. The Government may
delegate power to the supervisory authority to make such decisions.

12

1RWLILFDWLRQWRWKHVXSHUYLVRU\DXWKRULW\
1RWLILFDWLRQGXW\
6HFWLRQ
Processing of personal data that is completely or partially automated is subject to a notification
duty. The controller of personal data shall provide a written notification to the supervisory
authority before such processing or a set of such processing with the same or similar purpose
is conducted.
If the controller of personal data appoints a personal data representative, this shall be notified
to the supervisory authority. Removal from office of a personal data representative shall also
be notified to the supervisory authority.
The Government or the authority appointed by the Government may issue regulations
concerning exemptions to the notification duty under the first paragraph for such kinds ofprocessing as would probably not result in an improper intrusion of personal integrity.
1RWLILFDWLRQQHHGQRWEHPDGHLIWKHUHLVDSHUVRQDOGDWDUHSUHVHQWDWLYH
6HFWLRQ
Notification under Section 36, first paragraph, need not be made if the controller of personal
data has given notice to the supervisory authority that a personal data representative has been
appointed and who he/she is.
7KHIXQFWLRQVRISHUVRQDOGDWDUHSUHVHQWDWLYHV
6HFWLRQ
The personal data representative shall have the function of independently ensuring that thecontroller of personal data processes personal data in a lawful and correct manner and inaccordance with good practice and also points out any inadequacies to him or her.
If the personal data representative has reason to suspect that the controller of personal data
contravenes the provisions applicable for processing personal data and if rectification is not
implemented as soon as is practicable after being pointing out, the personal data representative
shall notify this situation to the supervisory authority.
The personal data representative shall also otherwise consult with the supervisory authority inthe event of doubt about how the rules applicable to processing of personal data shall beapplied.
6HFWLRQ
The personal data representative shall maintain a register of the processing that the controllerof personal data implements and which would have been subject to the duty of notification if
the representative had not existed. The register shall comprise at least the information that a
notification under Section 36 would have contained.
6HFWLRQ
The personal data representative shall assist registered persons to obtain rectification when
there is reason to suspect that the personal data processed is incorrect or incomplete.

13

0DQGDWRU\QRWLILFDWLRQRISURFHVVLQJWKDWLVSDUWLFXODUO\VHQVLWLYHDVUHJDUGVLQWHJULW\
6HFWLRQThe Government may issue regulations providing that such processing of personal data as
involves particular risks for improper intrusion of personal integrity shall be notified forpreliminary examination, three weeks in advance, to the supervisory authority in accordancewith Section 36. If the Government has issued such regulations, the exemption from theobligation to give notification under Section 37 does not apply.
,QIRUPDWLRQWRWKHSXEOLFDERXWSURFHVVLQJWKDWKDVQRWEHHQQRWLILHG
6HFWLRQThe controller of personal data shall, to everybody who requests it, expeditiously and in an
appropriate manner provide information about such automated or other processing of personal
data that have not been notified to the supervisory authority. The information shall comprisethat which a notification under Section 36, first paragraph, would have comprised. However,the controller of personal data is not responsible to provide information subject to secrecy orinformation about which security measures have been taken. In that connection, a controller of
personal data who is not an authority may, in a case corresponding to those referred to in the
Secrecy Act (1980:100), refuse to provide information.
7KHSRZHUVRIWKHVXSHUYLVRU\DXWKRULW\
6HFWLRQ
The supervisory authority is entitled for its supervision to obtain on requesta) access to the personal data that is processed,b) information about and documentation of the processing of personal data and security ofthis processing, andc) access to those premises linked to the processing of personal data.
6HFWLRQ
If the supervisory authority cannot, pursuant to a request under Section 43, obtain sufficient
information in order to conclude that the processing of personal data is lawful, the authority
may prohibit, subject to a default fine, the controller of personal data to process personal data
in any other manner than by storing them.
6HFWLRQ
If the supervisory authority concludes that personal data is processed or may be processed in
an unlawful manner, the authority shall by a reminder or similar procedure endeavour to attainrectification. If it is not possible to obtain rectification in any other manner or if the matter isurgent, the authority may prohibit, subject to a default fine, the controller of personal data tocontinue processing the personal data in any other manner than by storing them.
If the controller of personal data does not voluntary comply with the decision concerning
security measures under Section 32 that has entered into final legal force, the supervisory
authority may prescribe a default fine.

14

6HFWLRQ
Before the supervisory authority decides a default fine in accordance with Section 44 or 45, thecontroller of personal data shall have been given an opportunity to express him/herself.
However, if the matter is urgent the authority, pending the expression of views, may issue a
temporary decision on a default fine. The temporary decision shall be reconsidered when the
period for expressing views has expired.
An order for a default fine shall be served on the controller of personal data. Service under
Section 12 of the Service Act (1970:428) may only be used if there is reason to assume that thecontroller of personal data has absconded or concealing him/herself in some other way.
6HFWLRQ
The supervisory authority may at the County Administrative Court in the county where theauthority is situated apply for the erasure of such personal data as has been processed in an
unlawful manner.
Decision on erasure may not be issued if it is unreasonable.
'DPDJHV6HFWLRQThe controller of personal data shall compensate the registered person for damages and theviolation of personal integrity that the processing of personal data in contravention of this Act
has caused.
The liability to pay compensation may, to the extent that it is reasonable, be adjusted if theperson providing personal data proves that the error was not caused by him or her.
3HQDOWLHV
6HFWLRQA person who intentionally or by carelessnessa) provides untrue information in such information to registered persons as is prescribed bythis Act, or in the notification to the supervisory authority under Section 36 or to thesupervisory authority when the authority requests information in accordance with Section
43,b) processes personal data in contravention of Sections 13–21,c) transfers personal data to a third country in contravention of Sections 33–35, ord) omits to give notification under Section 36, first paragraph, or in accordance withregulations issued under Section 41,
shall be sentenced to a fine or imprisonment of at most six months or, if the offence is grave,to imprisonment of at most two years.
A sentence shall not be imposed in petty cases.

15

A person who has contravened an order subject to a default fine in accordance with Section 44
or 45, first paragraph, shall not be sentenced for liability for an act that is subject to the default
fine order.
'HWDLOHGUHJXODWLRQV
6HFWLRQThe Government or the authority appointed by the Government may issue more detailed
regulations concerninga) the cases in which processing of personal data is permitted,b) the requirements which are imposed on the controller of personal data when processing
personal data,c) the cases in which use of personal identity number is permitted,d) what a notification or application to a controller of personal data should contain,e) which information shall be provided to the registered person and how information shall be
provided, andf) notification to the supervisory authority and procedure when information notified has beenaltered.
$SSHDOV6HFWLRQ
The supervisory authority’s decision in accordance with this Act, except as regards
regulations, may be appealed against to a general administrative court.
Leave to appeal is required to appeal to the Administrative Court of Appeal.
The supervisory authority may decide that its decision should apply even if it has been
appealed against.
––––––––––(QWU\LQWRIRUFHDQGWUDQVLWLRQDOSURYLVLRQV
1. This Act enters into force on 24 October 1998, upon which the Data Act (1973:289) shallcease to apply. However, the old act still applies to issues concerning appeals of decisions
that have been issued before 24 October 1998.
2. As regards processing of personal data that commenced before the entry into force, or
processing conducted for a particular decided purpose if processing for the purpose wascommenced before the entry into force, the old act shall apply instead of the new act up to
and including 30 September 2001. This also applies to the rules in the old act on appeals.
3. The rules of Sections 9, 10, 13 and 21 in the new act shall not start to be applied before 1
October 2007 as regards such manual processing of personal data as was commenced
before the entry into force, or as regards manual processing that is conducted for a16particular decided purpose if manual processing for the purpose was commenced before
the entry into force.
4. As regards personal data that at entry into force are stored for historical research, theprovisions of Sections 9, 10, 13 and 21 of the new act shall first begin to be applied when
the information is processed in some other way. The corresponding rules in the old act
shall be applied until then. However, the said rules in the new act shall not be applied
before the time prescribed by 2 or 3 by reason of that stated here.
5. Notification under Section 36 of the new act may be made before the new act has enteredinto force for the processing in question.
6. Consent that has been provided before the new act has entered into force for the processing
in question shall also apply after the entry into force provided the consent fulfils therequirements in the new act.
7. If a request for registration under Section 10 of the old act was received before the new act
entered into force for the processing in question but has drawn out or not been carried out
before entry into force, the request shall be considered to be an application under Section
26 of the new act.

 The rules of the new act on damages shall only be applied if the circumstances to which
the application relates have occurred before the new act has entered into force for theprocessing in question. In other cases the old rules apply.