/Entry into force: 02/12/2016

The policy of the law



§ 1 the aim of this law is to give the immigration service, Police and judiciary able to process personal data in an appropriate manner in their activities pursuant to the immigration and citizenship legislation to protect people against their personal integrity is violated by such treatment.



The scope of the law



section 2 of this Act apply to the processing of personal data in immigration and utlandsmyndigheternas activities



1. the entry of aliens in Sweden, in a State that is part of the European Union, in a State that is connected to the European economic area or Switzerland,



2. an alien's stay or work in Sweden and departure or removal from Sweden,



3. status explanation,



4. reception of asylum seekers and other foreigners,



5. assistance and support to foreigners,



6. Swedish citizenship,



7. State compensation for costs of aliens, 8. residence of foreigners, or



9. the issuance of travel documents.



section 3 of this Act also applies to the processing of personal data in the Police activities relating to the entry and residence of aliens in Sweden and departure or removal from Sweden if the activities do not represent law enforcement activities.



section 4 of the Act applies only if the processing of personal data pursuant to section 2 or 3 is completely or partially automated or if the personal data form part of a filing system or are intended to form part of a structured set of personal data that are available for searching or compilation according to specific criteria.



section 5 of this Act does not apply where personal data are processed with the aid of



1. Act (2000:344) on the Schengen information system,



2. European Parliament and Council Regulation (EC) no 810/2009 of 13 July 2009 establishing a Community code on visas (Visa code), or



3. European Parliament and Council Regulation (EC) no 603/2013 of 26 June concerning the establishment of ' Eurodac ' for the comparison of fingerprints for the effective application of the Regulation (EU) no 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection as a third country national or a stateless person in any of the Member States and for when law enforcement authorities of the Member States requesting comparisons with Eurodac data by for law enforcement purposes , and amending Regulation (EC) no 1077/2011 establishing a European Agency for the operational management of large-scale it systems in the area of freedom, security and justice (recast).



6 § When personal data are processed with the support of the European Parliament and Council Regulation (EC) no 767/2008 of 9 July 2008 concerning the visa information system (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), the provisions of §§ 28 and 48 personuppgiftslagen (1998:204) for rectification and damages subject to the VIS regulation. In addition, this Act does not apply where personal data are processed with the aid of the VIS regulation.



The relationship to the personal data Act



section 7 unless otherwise specified in section 8 of this Act, apply in place of the personal data Act (1998:204).



section 8 When personal data are processed in accordance with this Act, or in accordance with the rules given in connection with the Act, the following provisions of the personal data Act (1998:204):



1. paragraph 3 of the definitions,



2. section 8 of the relationship to the principle,



3. section 9 on essential requirements on processing of personal data,



4. section 22 of the treatment of social security numbers,



5.23 and 25 to 27 sections of information to the data subject,



6. section 28 of the rectification,



7. paragraphs 30 and 31, and paragraph 32 of security of processing,



8. paragraphs 33 to 35 on the transfer of personal data to third countries,



9. paragraphs 38 to 41 of the personal data, etc.,



10. paragraph 42 for information to the public on some treatments,



11. paragraphs 43 and 44, paragraph 45 and 47 § if the powers of the supervisory authority,



12. paragraph 48 for damages, and



13. paragraph 51, paragraph 52 and 53 § on the appeal.



If personal information for screening under this Act, or in accordance with the rules given in connection with the Act, does not apply the second subparagraph of paragraph 8 of the Privacy Act.



The prohibition under section 44 or 45 of the Swedish personal data Act cannot be reconciled with a penalty.



Privacy responsibility



section 9 of the immigration service, the Police Department and a foreign mission are each responsible for the processing of personal data by the Agency.

The Swedish Migration Board, however, is personal responsible for utlandsmyndigheternas automated processing of personal data.



section 10 of the immigration service and police authority shall each designate one or more personal.



The controller shall notify the supervisory authority pursuant to the personal data Act (1998:204) when a data protection officer appointed or dismissed.



Purpose



section 11 of the immigration service, Police and judiciary to process personal data if necessary



1. handling of matters or a Government Counsel in such matters in the activities referred to in paragraphs 2 and 3,



2. control of alien in connection with entry and exit as well as control during their stay in Sweden,



3. execution of tasks relating to the reception and settlement of asylum seekers and other foreigners,



4. the production of statistics,



5. performance of test activities, or



6. performance of a legal obligation to register or otherwise document a personal task.



section 12 of the immigration service may also process personal data as necessary for the retrieval of



1. decisions, legal research and other legal information, or



2. information concerning conditions in other countries.



paragraph 13 of the personal data processed according to §§ 11 and 12 will also be treated when it is necessary to provide the information to the



1. Parliament or the Government,



2. another government agency or an individual, if the information is given on the basis of law or regulation, or



3. a foreign authority, an agency of the European Union or an international organization, if the disclosure of data flowing from Sweden's membership in the European Union or of an obligation under an International Convention to which Sweden is a party or under one of the Parliament approved the agreement with a foreign State or international organization.



In an individual case, personal data is processed according to §§ 11 and 12 also processed to provide information for any purpose other than those referred to in the first subparagraph, provided that the purpose is not incompatible with the purposes for which the data was collected for.



The migration agency's register of fingerprints and photographs



section 14 of the immigration service must keep separate records of fingerprints and photographs taken under Chapter 9. section 8 of the Aliens Act (2005:716).



With the limitation of the purposes that would otherwise apply under sections 11 and 13 receive information on fingerprints and photographs in the registers used only 1. in applications where the reasons given in Chapter 4. 1-2 (a) of the Aliens Act is invoked, 2. in cases of expulsion and deportation,



3. in testing, 4. If it is necessary to verify the identity of a person in a photograph submitted to the Migration Board, or



5. If necessary, to the Immigration Office to check a fingerprint against the fingerprint and signalements register Prefecture pursuant to Chapter 4.

section 11 of the police data Act (2010:361).



The Government, with the support of Chapter 8. section 7 of the Constitution notify



1. additional regulations on what data may be processed in the registers of fingerprints and photographs, and 2. regulations on screening.



The processing of sensitive personal data



section 15 Such sensitive personal data as set out in paragraph 13 of the personal data Act (1998:204) may be processed only



1. for the purposes set out in section 11 of 1 – 4 and 6, section 13, if the information is absolutely necessary for the purpose of treatment, or



2. in the text for the purpose specified in section 12 (2), if the information is absolutely necessary for the performance of duties in such activities as set out in section 2.



The Government, with the support of Chapter 8. section 7 of the Constitution notify



1. additional regulations on the restriction of the ability to process sensitive personal data, and



2. regulations on screening.



Access to personal data, section 16 of the access to personal information shall be limited to that which every officer needs to be able to fulfil their tasks.



The Government or the authority that the Government can, with the support of Chapter 8. section 7 of the Constitution notify details relating to access to personal data.



Search restrictions



section 17 in search of personal data, it is prohibited to use as a search term data revealing



1. racial or ethnic origin,



2. political opinions,



3. religious or philosophical beliefs,



4. Trade Union membership,



5. health, or



6. sexual life.



section 18 of the processing of personal data for the purposes set out in section 12 2, personal data that directly identifies the data subject cannot be used as a search term.



In search of personal data, such data on


violations of law, etc., as set out in section 21 of the personal data Act (1998:204) not be used as a search term. Details of the decision on custody under the Aliens Act (2005:716) may be used as a search term.



Direct access



section 19 of the access to personal data by the immigration service may only be granted



1. Police authorities,



2. The security police,



3. the judiciary,



4. Insurance Agency,



5. the authority,



6. The tax office, or



7. a party or a party's agent or lawyer.



Direct access in accordance with the first paragraph 7 may only refer to personal data in that party's case.



The Government or the authority that the Government can, with the support of Chapter 8. section 7 of the Constitution notify 1. additional regulations on limitations of direct access in accordance with the first paragraph, and 2. rules on access and security for such access.



Obligation to provide data



section 20 of the police authority have the right to access personal data that the Migration Board deals with under 11 or 14 § direct access under section 19. The security police and the judiciary has the corresponding right to direct access to some of the tasks that the Migration Board deals with under section 11.



The Swedish Migration Board shall, on the request of the police, the security police or a competent authority abroad to disclose personal information pursuant to section 11 of the work deals with 1 or 2.

The Swedish Migration Board shall also, at the request of the police to disclose personal details that the work processes in accordance with paragraph 1, 2 or 5.



If there are reasons for it to the Migration Board, on its own initiative, provide the information referred to in the second subparagraph, second sentence, to the police.



Transfer of personal data to third countries



21 section 33 Notwithstanding section reference to personal data Act (1998:204) in paragraph 8, it is allowed that even without the data subject's consent to transfer personal data to third countries if the transfer is absolutely necessary for the purposes set out in section 11 (1) and (2) and 12 (1), unless it meets the obstacle of privacy according to the public access to information and secrecy (2009:400).



The Government or the authority that the Government can, with the support of Chapter 8. section 7 of the Constitution notify additional regulations on the restriction of the ability to transfer personal data to third countries.



Separation



section 22 of the personal data that is processed for the purposes referred to in section 11 1-4 and section 13 shall be separated so that access to them is limited if they are no longer needed in the Agency's day-to-day operations.



The Government or the authority that the Government can, with the support of Chapter 8. section 7 of the Constitution notify additional regulations on separation of personal data.



Security measures



section 23 of the Government or the authority that the Government can, with the support of Chapter 8. section 7 of the Constitution provide for security measures for the protection of personal data.