The policy of the law
§ 1 the aim of this law is to
1. give colleges and universities the opportunity to create surface
for various research projects about what heritage and environmental
the emergence and development of various kinds of diseases and
for human health in General, and
2. protect the individual's right to privacy in such
The scope of the law
section 2 of the Act applies to the processing of personal data by
State universities and colleges covered by
the higher education Act (1992:1434) and with the individual's
express consent is made for such purposes as specified in section 1 1.
The law applies only if the treatment is completely or partially
automated or if the information included in or is intended
be part of a structured set of personal data which are
available for searching or compilation under
Government Announces rules on what state
universities and colleges that may process personal data
According to this law and the records according to the law which may
The relationship to the personal data Act
paragraph 3 of the personal data Act (1998:204) applies to the processing of
personal data, unless otherwise provided by this Act.
4 § The universities or high schools that perform the processing of the
personal data are data controllers.
paragraph 5 of the personal data may be processed for purposes that
1. create a basis for various research projects about what heritage and
environment means for the emergence and development of the different types
of diseases and human health in General, and
2. disclose information for such research as stated in 1 of the
extent and in the manner set out in section 6.
section 6 of the personal data which has been registered under section 9,
be disclosed to such research referred to in paragraph 1 during the
provided that both the research that the processing of
the data have been approved under the Act (SFS 2003:460) if
ethics review of research involving humans and the
the research is conducted by a government agency.
Disclosure in accordance with the first paragraph may only refer to
personal information that is not directly attributable to the
individual. Personal data may, however, upon the disclosure be
provided with an indication of the
controller can be attached to the data subject's
social security number or similar identifier.
section 7 of the personal data processed for the purposes referred to in
section 5 may also be disclosed to an investigation of research misconduct
such research referred to in section 6, first paragraph, or to
an opinion shall be provided in connection with such
investigation. When such disclosures, section 6, second paragraph
If personal information has been disclosed pursuant to section 6, first paragraph
get the controller to another authority
such indications as referred to in section 6, second paragraph, and the
data subject's social security number or equivalent
identifier, if necessary to the
receiving authority to disclose information if the same
people to the research disclosure has been made to
According to section 6 of the first subparagraph 1.
Personal information that is registered under this Act may
always be disclosed to the data subject himself.
paragraph 8 of the personal data processed for the purposes referred to in
section 5 may, in addition to the provisions of paragraphs 6 and 7, only be disclosed
If there is a legal obligation to do so.
Personal data in the register kept under this Act shall
only be processed for the purposes referred to in the first subparagraph
and 5 – 7 sections as well as for such conservation as set out in section 12.
The personal data in the registry
section 9 in a register under this Act shall, in respect of
personal information is only present
1. information to the data subject himself has left in order
they will be included in the register,
2. information or in the form of recordings that the
registered has contributed to in order that they should be included in the
3. details of surveys which the data subject has
undergone in order that the result will be included in the register,
4. categorisation of data referred to in 1 to 3,
5. the contact information to the data subject,
6. data other than that referred to in 1 to 5 which the
registered expressly consented to be included in
the registry, and
7. information on the disclosure made to the research.
The Government or the authority, as the Government determines
Announces rules on the extent to which the data
with regard to genetic tests may be registered.
Internal electronic access
section 10 of the controller to restrict their employees '
and contractors ' electronic access to personal information
to what each one needs to be able to fulfil their
duties in relation to the register.
Disclosure by direct access
11 § Disclosure by direct access to personal data in the
table must not occur.
section 12 of the personal data that are no longer needed for the purpose
referred to in paragraph 1 and 2 for screening, unless the Government or
the authority that the Government has announced
regulations or in a particular case, decided to
data may be kept for historical, statistical or
section 13 the provisions of section 28 of the personal data Act (1998:204) about
rectification shall apply mutatis mutandis to the processing of
personal information in contravention of this Act.
Consent and information
section 14 of the personal information referred to in section 9 shall not be collected in
to be registered in a register kept in accordance with the
This law without the data relate specifically
agreed that personal data are processed in accordance with this Act.
Before a person gives its consent in accordance with the first subparagraph
He or she shall have been informed of the
1. that it is optional to provide information, assist
recordings or undergo tests designed to
This information is entered in the register as well as to the
data subjects may at any time cancel his whistle-blowing,
their involvement or their participation in whole or in part,
2. for what purposes the treatment can be carried out in accordance with sections 5 to 7 and
the information to be registered under section 9,
3. the privacy and security regulations
4. who is the data controller,
5. how long the data will be saved,
6. the right to rectify the data,
7. the right to information under section 15 of this Act and section 26 of the
personal data Act (1998:204),
8. the authority which has oversight of this law
9. the right to compensation, and
10. the right to have the data erased.
Information disclosure for research
section 15 of the data subject has the right to request information
for the research project data on him or
her has been disclosed.
Deletion of data
section 16 of the data subject has the right to request at any time that
entries in the register relating to him or her shall be erased. A
such request shall be made in writing in the
controller and be signed by the
registered itself. If the request involves the destruction of such
information referred to in section 9, first subparagraph 7, this particular
The controller shall, within two months from the
the request was wiping out the data in accordance with the request
and send it registered a confirmation that it has
occurred. If the individual has not requested deletion even of
information referred to in paragraph 9 7, a copy of
This data is attached to the confirmation with a reminder that
the individual has the right to request that even get them wiped out.
section 17 the provisions of § 48 personuppgiftslagen (1998:204) about
damages shall apply mutatis mutandis in the case of
treatment of personal information that has been made in contravention of this