Sometimes personal data has to be passed to someone else. Then a few rules apply that you should know.
Passing data on within the organisation
Only those who need the data for their work should have access. Your access rights in a system are part of the employer's protection. The fact that you can see some data does not mean that you may look at it. Looking up an acquaintance, a neighbour or a well-known person without a work reason is unauthorised access, even if no one else notices. Systems often log access, and anyone who looks without a reason may face disciplinary consequences.
Passing data on to someone outside
Before you send data to an outsider, ask:
- Who is the recipient, and what will they do with the data?
- Does the organisation have a lawful basis and a purpose that covers the disclosure?
- Is the recipient entitled to receive it? Check who the person is.
- Is there a data processing agreement, if the recipient works on your behalf?
Do not give out data over the telephone to someone you cannot identify. Ask instead to call back, and ring back on a number you have yourself.
Processors
When a supplier processes data on the employer's behalf, for example a payroll company or a cloud service, a written processing agreement is required (Article 28). The agreement regulates, among other things, which data the supplier may process, how it is protected and what applies when the agreement ends. You should not start using a new service with personal data yourself until this has been settled.
Outside the EU and EEA
Personal data can move freely within the EU and the EEA. Transfer to a country outside requires extra safeguards under Chapter V of the GDPR. This can be a decision by the European Commission that the country has an adequate level of protection, or standard contractual clauses. Some cloud services have servers or support outside the EU. This is for the employer to assess, but you should ask before you start using a new service.
The principle of public access and the GDPR
If you work at a public authority, a municipality or a region, a special system applies.
- The principle of public access to official documents (offentlighetsprincipen) is set out in the Freedom of the Press Act (tryckfrihetsförordningen). Everyone has the right to see the official documents held by authorities. A document is official if it is kept at the authority and has been received or drawn up there.
- The Public Access to Information and Secrecy Act (2009:400) determines which information is confidential and therefore may not be disclosed.
- Under Chapter 1, Section 7 of the Data Protection Act, the data protection rules do not apply to the extent that this would conflict with the Freedom of the Press Act. The GDPR is therefore no reason to refuse to disclose an official document that is not confidential.
Some important points:
- Whether to disclose is decided under the secrecy rules. A document that is not secret is released, even if it contains personal data.
- As a general rule, the authority may not ask why someone wants to see a document or who the person is, except where this is needed for the secrecy assessment (Freedom of the Press Act, Chapter 2, Section 18).
- The data protection rules do apply, however, to how the authority collects, stores, protects and weeds out data in its own systems.
So both sets of rules apply at the same time, and they complement each other. If you are unsure whether something may be disclosed, ask the person responsible, for example the registrar, a lawyer or the data protection officer.
Marketing
People have an absolute right to object to direct marketing (Article 21(3)). If someone says "stop sending me advertising", you must pass that on at once. Rules on marketing by e-mail and text message are also found in the Marketing Act (marknadsföringslagen), and the rules on cookies on websites are in the Electronic Communications Act (lagen om elektronisk kommunikation). Ask the person responsible before you send out a mailing.