Law (2007:259) Concerning The Processing Of Personal Data In The National Defence Radio Institute Defence Intelligence And Development Activities

Original Language Title: Lag (2007:259) om behandling av personuppgifter i Försvarets radioanstalts försvarsunderrättelse- och utvecklingsverksamhet

Subscribe to a Global-Regulation Premium Membership Today!

Key Benefits:

Subscribe Now for only USD$20 per month, or Get a Day Pass for only USD$4.99.
Chapter 1. General provisions



The law's scope of application, etc.



section 1 of this Act apply to the processing of personal data in

National defence radio Institute defence intelligence and

development activities, if the processing is wholly or partly

automated or if the information included in or intended for

be part of a structured set of personal data which are

available for searching or compilation according to specific

criteria.



Personal data Act (1998:204) does not apply to such processing

of personal data referred to in the first subparagraph.



2 § the purpose of the Act is to protect people against their

personal privacy is violated by the action of

personal data in the national defence radio Institute

defence intelligence and development activities.



Relationship to the principle of



paragraph 3, the provisions of this law shall not apply in the

extent it would restrict national defence radio Institute

obligation under Chapter 2. freedom of the Press Act to disclose

personal data.



Definitions



section 4 of this Act, the following definitions shall apply the following

importance.



Indication Significance



Treatment



(personal data) Any operation or set of operations

taken in respect of personal data,

whether by automated means

or not, eg. the collection,

registration, organization, storage,

adaptation or alteration, retrieval,

consultation, use, disclosure

by transmission, dissemination or

otherwise making available,

alignment or combination,

blocking, erasure or destruction.



Blocking

(personal data) An action taken to

personal data shall be

associated with information about the

is blocked and the reason for

latch and to the personal data

shall not be disclosed to third parties

other than pursuant to Chapter 2.

freedom of the Press Act.



The recipients to whom the personal data is provided

out. When personal information is disclosed from

National defence radio establishment to a

other authority to carry out

such supervision, control or revision

as it is required to operate, is considered

However, cannot the authority that

receiver.



Personal data is All kinds of information that directly or

indirectly attributable to a natural

person in life.



Processor The processing personal data for

on behalf of the controller.



Data protection officer the natural person who, after

the appointment of the

controller, independently

shall ensure that personal data

processed fairly and lawfully

way.



It registered it as a personal data relates.



Third parties other than the data subject, the

controller,

the data protection officer,

processor and such

persons who, under the

controller or

direct responsibility of the processor

has the power to treat

personal data.



Data collection a collection of information using

of automated processing is used

in common.



Privacy responsibility



paragraph 5 of the national defence radio establishment is responsible for the

processing of personal data by the Agency.



Basic requirements for the processing of personal data



section 6 of the national defence radio establishment shall ensure that



1. personal data may be processed only if it is legal,



2. personal data is always processed in a proper manner and in

accordance with good practice,



3. personal data may be collected only for specified, explicit and

specified and legitimate purposes,



4. personal data processed for any purpose that is

incompatible with that for which the data were collected,



5. the personal data processed is adequate and relevant in

relation to the purposes of the processing,



6. no more personal data than necessary with

the light of the purposes of the processing,



7. the personal data that is processed is correct and, if it is

necessary, current, and



8. all reasonable measures are taken to correct, block or

wipe out such personal information that is incorrect or

incomplete with respect to the purposes of the processing.



Data collections



section 7 of the national defence radio Institute defence intelligence and

development activities may, under the conditions set out in

This law, personal data are processed in the data collections.



Government Announces detailed rules or decisions of the

individual case if the data collections that may exist and

the data may be processed in the respective collection.



When the processing of personal data is lawful



Defence intelligence activity



paragraph 8 of the personal data may be processed in the national defence radio Institute

defence intelligence operations if necessary to

carry out the activities specified in the Act (2000:130) about

Defense intelligence operations.



Data on a person may only be processed if the person has

affiliation with a specific focus of

defence intelligence function and processing is necessary

to pursue this approach.



Development activities



section 9 personal data may be processed by the national defence radio establishment if

It is necessary to



1. follow the changes of signal environment in the world, the technical

the development and signalskyddet, and



2. continuously develop the technology and methodology needed for

to carry out the activity;



section 10 of the personal data may be processed by the national defence radio establishment

If it is necessary in order to assist other authorities in

valuation, development, acquisition and operation of

electronic surveillance system.



Notwithstanding anything in this Act on the processing of

information for any purpose other than that for which the data

collected and disclosure of data, personal data

be treated pursuant to the first subparagraph cannot be used for other

purposes or disclosed otherwise than as referred to in paragraph 3.



The processing of sensitive personal data



section 11 of the personal information shall not be treated solely on the basis of what

is known about the person's race or ethnic origin, political

opinions, religious or philosophical convictions, membership in the

Trade Union, health or sex life.



If a person is treated on other grounds, the

be supplemented with such tasks as referred to in the first subparagraph

When it is strictly necessary for the purpose of treatment.

Data that describes a person's appearance will always

designed in an objective manner with respect for human dignity.



When searching, personal data revealing racial or ethnic

origin, political opinions, religious or philosophical

beliefs, trade-union membership, or concerning health

or sex life can be used as a search term only if it is

absolutely necessary for the purpose of treatment.



Processing of personal number



section 12 information on the social security number or co-ordination number may

be treated only when it is clearly justified by the



1. the purpose of the processing,



2. the importance of a secure identification, or



3. any other noteworthy reasons.



The processing of personal data in some cases



13 § Treatment that involves data collection through the

signals intelligence, the retention of data is done immediately

After that, and the processing of information in the form of

kryptoforcering and linguistic translation shall not be regarded as

incompatible with the provisions of 6 and 8-12 § § in the stage of

reading then it has not yet been established if

the information includes personal data.



Disclosure of personal data on the medium of automated

treatment



section 14 of the only single person data may be released to the media

automated processing, unless the Government has announced

regulations or in an individual case decided that data

may be disclosed in such a medium, even in other cases.



Direct access



section 15 of the Government Announces rules on which authorities

may have direct access to the data collections.



Government, or the Government authority determines,

Announces additional regulations or decisions in individual cases

If the extent of direct access.



Access to personal data



section 16 of the access to personal data must always be limited

to what each one needs to be able to fulfil their

work tasks.



Transfer of personal data to other countries



section 17 of the personal data processed pursuant to this Act may

be transferred to other countries or people-to-people

organizations only if privacy is not preventing it, and it is

necessary to enable the national defence radio establishment to fulfil

their tasks within the framework of the international

defence intelligence and security cooperation, if not


the Government has announced regulations or in an individual case

decided that the transfer may take place also in other cases where it is

necessary for the activities of the national defence radio establishment.



Chapter 2. Information to the individual, the rectification and indemnity



Information to the individual



Information to be submitted upon application



section 1 of the national defence radio establishment is obliged to to anyone who

applying for the once per calendar year free leave notice of

whether or not personal data concerning the applicant are processed or

not. Processed such data shall be written information

also if



1. what information about the applicant that is processed,



2. where this information is retrieved,



3. the purposes of the processing, and



4. the recipients or categories of recipients who are

the data are disclosed.



An application referred to in the first subparagraph shall be made in writing in

National defence radio establishment and be signed by the applicant

itself. Information referred to in the first subparagraph shall be provided within a

month from the date the application was made. If there are special reasons

for it, the information be left not later than four months after

the application was made.



section 2 of the Information pursuant to paragraph 1 need not be given if

personal data in running text that did not receive their final

the design when the application was made or that constitutes the memory note

or similar. However, this does not apply if the data are

disclosed to third parties or, in the case of continuous text

that did not receive their final form, if the information has

treated for longer than a year.



Exemption from the duty to provide information on privacy



the provisions of paragraph 3 of article 1 shall not apply to the extent

Privacy prevents the transfer of information to the

registered.



Corrigendum to:



section 4 of the national defence radio establishment is obliged, at the request of the

registered as soon as correct, block or delete such

personal data that has not been treated in accordance with this

law or regulations issued under the law.

National defence radio establishment shall also inform third parties to

whom the data are disclosed on the action, if the

data subject requests it or if more significant damage or

inconvenience to the data subject could be avoided through a

intelligence. Any such notice need not

provided, if this is impossible or would involve a

disproportionate effort.



Damages



§ 5 the State shall replace the registered for damage and

violation of privacy as a treatment for

personal information in contravention of this Act or regulations

has been issued under the law has caused.



Liability, to the extent that it is reasonable

be adjusted, if the national defence radio establishment shows that the error is not attributed

on authority.



Chapter 3. Security of processing



section 1 of the processor and the person or persons

working under counsel's or the national defence radio Institute

management may process personal data only in accordance with

instructions from the national defence radio establishment.



There should be a written agreement if the

the processor for the processing of personal data

National defence radio Institute's behalf. In the agreement, the

especially given that the processor may treat

the personal data only in accordance with instructions from the

National defence radio establishment, and that the processor is

required to take the measures referred to in paragraph 2 of the first

paragraph.



In terms of privacy and confidentiality in the public

activities should apply the provisions of the public access to information and

secrecy (2009:400) instead of the first paragraph.

Law (2009:521).



section 2 of the national defence radio establishment shall take appropriate technical and

organisational measures to protect personal data

treated. Measures shall ensure a level of security

appropriate having regard to the



1. the technical possibilities available,



2. what it would cost to implement the measures,



3. the specific risks associated with the treatment of

the personal data, and



4. how that sensitive personal data is processed.



When the national defence radio establishment engages a processor,

shall satisfy itself that the processor

can implement the security measures that must be taken and ensure

to the processor really take those measures.



Chapter 4. Data protection officer



section 1 of the national defence radio establishment shall designate one or more

data protection officer and report them to the supervisory authority

referred to in Chapter 5. A dismissal of a

the personal data shall be notified to the supervisory authority.



section 2 of the data protection officer shall be responsible for

independently to ensure that the national defence radio establishment treats

personal information in a lawful and correct manner and in accordance

with good manners and point out any shortcomings of the authority.



The data protection officer has reason to suspect that

National defence radio establishment violates the provisions applicable

for the processing of personal data and taken no rectification so

soon it may be after the remark, the data protection officer

report the fact to the supervisory authority.



The data protection officer shall otherwise consult

the supervisory authority if in doubt about how the rules

applies to the processing of personal data shall apply.



section 3 of the data protection officer shall keep a list of the

treatments that national defence radio establishment implements and which is

completely or partially automated.



Government, or the Government authority determines,

announces the rules about what the list should contain.



section 4 of the data protection officer shall assist the data subject to receive

rectification when there is reason to suspect that treated

personal data is incorrect or incomplete.



Chapter 5. The supervisory authority



§ 1 the authority the Government shall exercise supervision

of national defence radio Institute processing personal data

According to this law.



section 2 of the regulatory authority has the right to order their supervision upon request

get



1. access to the personal data processed,



2. information and documentation of the treatment of

personal data and the security of this, and



3. access to such premises which are related to

the processing of personal data.



§ 3 If the regulator finds that personal information

processed or may be processed in an unlawful manner,

the authority by observations or similar procedures

seeking rectification.



section 4 of the regulatory authority may with the administrative court within whose

territorial jurisdiction of the supervisory authority is situated may apply to such

personal data that have been processed unlawfully,

wiped out.



Decision on deleting shall be granted if it is unfair.

Law (2009:851).



Chapter 6. Other provisions



Thinning



section 1 of the personal data processed automated, screening

as soon as these data is no longer needed for the purpose for

which they are treated, if not the Government or the authority

the Government has announced regulations or in individual

cases decided that screening must take place no later than the specified time

or that the information may be kept for historical, statistical

or scientific purposes.



Penalty



2 § to fine or imprisonment not exceeding six months, or, if

the crime is gross, imprisonment for at most two years condemned it as

intentionally or recklessly



1. provide false information in such information to data subjects

provided for in Chapter 2, the notification to the supervisory authority

According to Chapter 4. section 1 or to the supervisory authority when

authority requests information according to Chapter 5. paragraph 2, or



2. processing personal data in contravention of Chapter 1. 11.



In minor cases are judged not to liability.



Appeal



paragraph 3 of the Swedish defence radio Institute decision on information to be

provided pursuant to Chapter 2. § 1 and for corrective and notification to the

third parties under Chapter 2. section 4 may be appealed to the General

Administrative Court. Other decision under this Act shall not

subject to appeal.



Leave to appeal is required for an appeal to the administrative court.



Transitional provisions



2007:259



1. this law shall enter into force on 1 July 2007.



2. the provisions of Chapter 1. section 6 of basic requirements on

the processing of personal data and Chapter 1. section 11 on the treatment of

sensitive personal data shall not take effect until the

October 1, 2007 in the matter of such manual processing of

personal data commenced before or on 24 October 1998

manual processing for a particular purpose if

manual processing for this purpose commenced before the October 24

1998.



3. the provisions of Chapter 2. paragraph 5 of the damages shall be applied

only if the claim relates to have

occurred after the law has come into force with respect to the

current treatment. In other cases older

provisions.

Related Laws