Chapter 1. General provisions
The law's scope of application, etc.
section 1 of this Act apply to the processing of personal data in
National defence radio Institute defence intelligence and
development activities, if the processing is wholly or partly
automated or if the information included in or intended for
be part of a structured set of personal data which are
available for searching or compilation according to specific
criteria.
Personal data Act (1998:204) does not apply to such processing
of personal data referred to in the first subparagraph.
2 § the purpose of the Act is to protect people against their
personal privacy is violated by the action of
personal data in the national defence radio Institute
defence intelligence and development activities.
Relationship to the principle of
paragraph 3, the provisions of this law shall not apply in the
extent it would restrict national defence radio Institute
obligation under Chapter 2. freedom of the Press Act to disclose
personal data.
Definitions
section 4 of this Act, the following definitions shall apply the following
importance.
Indication Significance
Treatment
(personal data) Any operation or set of operations
taken in respect of personal data,
whether by automated means
or not, eg. the collection,
registration, organization, storage,
adaptation or alteration, retrieval,
consultation, use, disclosure
by transmission, dissemination or
otherwise making available,
alignment or combination,
blocking, erasure or destruction.
Blocking
(personal data) An action taken to
personal data shall be
associated with information about the
is blocked and the reason for
latch and to the personal data
shall not be disclosed to third parties
other than pursuant to Chapter 2.
freedom of the Press Act.
The recipients to whom the personal data is provided
out. When personal information is disclosed from
National defence radio establishment to a
other authority to carry out
such supervision, control or revision
as it is required to operate, is considered
However, cannot the authority that
receiver.
Personal data is All kinds of information that directly or
indirectly attributable to a natural
person in life.
Processor The processing personal data for
on behalf of the controller.
Data protection officer the natural person who, after
the appointment of the
controller, independently
shall ensure that personal data
processed fairly and lawfully
way.
It registered it as a personal data relates.
Third parties other than the data subject, the
controller,
the data protection officer,
processor and such
persons who, under the
controller or
direct responsibility of the processor
has the power to treat
personal data.
Data collection a collection of information using
of automated processing is used
in common.
Privacy responsibility
paragraph 5 of the national defence radio establishment is responsible for the
processing of personal data by the Agency.
Basic requirements for the processing of personal data
section 6 of the national defence radio establishment shall ensure that
1. personal data may be processed only if it is legal,
2. personal data is always processed in a proper manner and in
accordance with good practice,
3. personal data may be collected only for specified, explicit and
specified and legitimate purposes,
4. personal data processed for any purpose that is
incompatible with that for which the data were collected,
5. the personal data processed is adequate and relevant in
relation to the purposes of the processing,
6. no more personal data than necessary with
the light of the purposes of the processing,
7. the personal data that is processed is correct and, if it is
necessary, current, and
8. all reasonable measures are taken to correct, block or
wipe out such personal information that is incorrect or
incomplete with respect to the purposes of the processing.
Data collections
section 7 of the national defence radio Institute defence intelligence and
development activities may, under the conditions set out in
This law, personal data are processed in the data collections.
Government Announces detailed rules or decisions of the
individual case if the data collections that may exist and
the data may be processed in the respective collection.
When the processing of personal data is lawful
Defence intelligence activity
paragraph 8 of the personal data may be processed in the national defence radio Institute
defence intelligence operations if necessary to
carry out the activities specified in the Act (2000:130) about
Defense intelligence operations.
Data on a person may only be processed if the person has
affiliation with a specific focus of
defence intelligence function and processing is necessary
to pursue this approach.
Development activities
section 9 personal data may be processed by the national defence radio establishment if
It is necessary to
1. follow the changes of signal environment in the world, the technical
the development and signalskyddet, and
2. continuously develop the technology and methodology needed for
to carry out the activity;
section 10 of the personal data may be processed by the national defence radio establishment
If it is necessary in order to assist other authorities in
valuation, development, acquisition and operation of
electronic surveillance system.
Notwithstanding anything in this Act on the processing of
information for any purpose other than that for which the data
collected and disclosure of data, personal data
be treated pursuant to the first subparagraph cannot be used for other
purposes or disclosed otherwise than as referred to in paragraph 3.
The processing of sensitive personal data
section 11 of the personal information shall not be treated solely on the basis of what
is known about the person's race or ethnic origin, political
opinions, religious or philosophical convictions, membership in the
Trade Union, health or sex life.
If a person is treated on other grounds, the
be supplemented with such tasks as referred to in the first subparagraph
When it is strictly necessary for the purpose of treatment.
Data that describes a person's appearance will always
designed in an objective manner with respect for human dignity.
When searching, personal data revealing racial or ethnic
origin, political opinions, religious or philosophical
beliefs, trade-union membership, or concerning health
or sex life can be used as a search term only if it is
absolutely necessary for the purpose of treatment.
Processing of personal number
section 12 information on the social security number or co-ordination number may
be treated only when it is clearly justified by the
1. the purpose of the processing,
2. the importance of a secure identification, or
3. any other noteworthy reasons.
The processing of personal data in some cases
13 § Treatment that involves data collection through the
signals intelligence, the retention of data is done immediately
After that, and the processing of information in the form of
kryptoforcering and linguistic translation shall not be regarded as
incompatible with the provisions of 6 and 8-12 § § in the stage of
reading then it has not yet been established if
the information includes personal data.
Disclosure of personal data on the medium of automated
treatment
section 14 of the only single person data may be released to the media
automated processing, unless the Government has announced
regulations or in an individual case decided that data
may be disclosed in such a medium, even in other cases.
Direct access
section 15 of the Government Announces rules on which authorities
may have direct access to the data collections.
Government, or the Government authority determines,
Announces additional regulations or decisions in individual cases
If the extent of direct access.
Access to personal data
section 16 of the access to personal data must always be limited
to what each one needs to be able to fulfil their
work tasks.
Transfer of personal data to other countries
section 17 of the personal data processed pursuant to this Act may
be transferred to other countries or people-to-people
organizations only if privacy is not preventing it, and it is
necessary to enable the national defence radio establishment to fulfil
their tasks within the framework of the international
defence intelligence and security cooperation, if not
the Government has announced regulations or in an individual case
decided that the transfer may take place also in other cases where it is
necessary for the activities of the national defence radio establishment.
Chapter 2. Information to the individual, the rectification and indemnity
Information to the individual
Information to be submitted upon application
section 1 of the national defence radio establishment is obliged to to anyone who
applying for the once per calendar year free leave notice of
whether or not personal data concerning the applicant are processed or
not. Processed such data shall be written information
also if
1. what information about the applicant that is processed,
2. where this information is retrieved,
3. the purposes of the processing, and
4. the recipients or categories of recipients who are
the data are disclosed.
An application referred to in the first subparagraph shall be made in writing in
National defence radio establishment and be signed by the applicant
itself. Information referred to in the first subparagraph shall be provided within a
month from the date the application was made. If there are special reasons
for it, the information be left not later than four months after
the application was made.
section 2 of the Information pursuant to paragraph 1 need not be given if
personal data in running text that did not receive their final
the design when the application was made or that constitutes the memory note
or similar. However, this does not apply if the data are
disclosed to third parties or, in the case of continuous text
that did not receive their final form, if the information has
treated for longer than a year.
Exemption from the duty to provide information on privacy
the provisions of paragraph 3 of article 1 shall not apply to the extent
Privacy prevents the transfer of information to the
registered.
Corrigendum to:
section 4 of the national defence radio establishment is obliged, at the request of the
registered as soon as correct, block or delete such
personal data that has not been treated in accordance with this
law or regulations issued under the law.
National defence radio establishment shall also inform third parties to
whom the data are disclosed on the action, if the
data subject requests it or if more significant damage or
inconvenience to the data subject could be avoided through a
intelligence. Any such notice need not
provided, if this is impossible or would involve a
disproportionate effort.
Damages
§ 5 the State shall replace the registered for damage and
violation of privacy as a treatment for
personal information in contravention of this Act or regulations
has been issued under the law has caused.
Liability, to the extent that it is reasonable
be adjusted, if the national defence radio establishment shows that the error is not attributed
on authority.
Chapter 3. Security of processing
section 1 of the processor and the person or persons
working under counsel's or the national defence radio Institute
management may process personal data only in accordance with
instructions from the national defence radio establishment.
There should be a written agreement if the
the processor for the processing of personal data
National defence radio Institute's behalf. In the agreement, the
especially given that the processor may treat
the personal data only in accordance with instructions from the
National defence radio establishment, and that the processor is
required to take the measures referred to in paragraph 2 of the first
paragraph.
In terms of privacy and confidentiality in the public
activities should apply the provisions of the public access to information and
secrecy (2009:400) instead of the first paragraph.
Law (2009:521).
section 2 of the national defence radio establishment shall take appropriate technical and
organisational measures to protect personal data
treated. Measures shall ensure a level of security
appropriate having regard to the
1. the technical possibilities available,
2. what it would cost to implement the measures,
3. the specific risks associated with the treatment of
the personal data, and
4. how that sensitive personal data is processed.
When the national defence radio establishment engages a processor,
shall satisfy itself that the processor
can implement the security measures that must be taken and ensure
to the processor really take those measures.
Chapter 4. Data protection officer
section 1 of the national defence radio establishment shall designate one or more
data protection officer and report them to the supervisory authority
referred to in Chapter 5. A dismissal of a
the personal data shall be notified to the supervisory authority.
section 2 of the data protection officer shall be responsible for
independently to ensure that the national defence radio establishment treats
personal information in a lawful and correct manner and in accordance
with good manners and point out any shortcomings of the authority.
The data protection officer has reason to suspect that
National defence radio establishment violates the provisions applicable
for the processing of personal data and taken no rectification so
soon it may be after the remark, the data protection officer
report the fact to the supervisory authority.
The data protection officer shall otherwise consult
the supervisory authority if in doubt about how the rules
applies to the processing of personal data shall apply.
section 3 of the data protection officer shall keep a list of the
treatments that national defence radio establishment implements and which is
completely or partially automated.
Government, or the Government authority determines,
announces the rules about what the list should contain.
section 4 of the data protection officer shall assist the data subject to receive
rectification when there is reason to suspect that treated
personal data is incorrect or incomplete.
Chapter 5. The supervisory authority
§ 1 the authority the Government shall exercise supervision
of national defence radio Institute processing personal data
According to this law.
section 2 of the regulatory authority has the right to order their supervision upon request
get
1. access to the personal data processed,
2. information and documentation of the treatment of
personal data and the security of this, and
3. access to such premises which are related to
the processing of personal data.
§ 3 If the regulator finds that personal information
processed or may be processed in an unlawful manner,
the authority by observations or similar procedures
seeking rectification.
section 4 of the regulatory authority may with the administrative court within whose
territorial jurisdiction of the supervisory authority is situated may apply to such
personal data that have been processed unlawfully,
wiped out.
Decision on deleting shall be granted if it is unfair.
Law (2009:851).
Chapter 6. Other provisions
Thinning
section 1 of the personal data processed automated, screening
as soon as these data is no longer needed for the purpose for
which they are treated, if not the Government or the authority
the Government has announced regulations or in individual
cases decided that screening must take place no later than the specified time
or that the information may be kept for historical, statistical
or scientific purposes.
Penalty
2 § to fine or imprisonment not exceeding six months, or, if
the crime is gross, imprisonment for at most two years condemned it as
intentionally or recklessly
1. provide false information in such information to data subjects
provided for in Chapter 2, the notification to the supervisory authority
According to Chapter 4. section 1 or to the supervisory authority when
authority requests information according to Chapter 5. paragraph 2, or
2. processing personal data in contravention of Chapter 1. 11.
In minor cases are judged not to liability.
Appeal
paragraph 3 of the Swedish defence radio Institute decision on information to be
provided pursuant to Chapter 2. § 1 and for corrective and notification to the
third parties under Chapter 2. section 4 may be appealed to the General
Administrative Court. Other decision under this Act shall not
subject to appeal.
Leave to appeal is required for an appeal to the administrative court.
Transitional provisions
2007:259
1. this law shall enter into force on 1 July 2007.
2. the provisions of Chapter 1. section 6 of basic requirements on
the processing of personal data and Chapter 1. section 11 on the treatment of
sensitive personal data shall not take effect until the
October 1, 2007 in the matter of such manual processing of
personal data commenced before or on 24 October 1998
manual processing for a particular purpose if
manual processing for this purpose commenced before the October 24
1998.
3. the provisions of Chapter 2. paragraph 5 of the damages shall be applied
only if the claim relates to have
occurred after the law has come into force with respect to the
current treatment. In other cases older
provisions.
