All processing of personal data requires at least one lawful basis under Article 6. Some data is also especially sensitive and requires more.
The six lawful bases
- Consent. The person has said yes freely, specifically, in an informed way and unambiguously. It must be as easy to withdraw consent as to give it.
- Contract. The processing is necessary to perform a contract with the person, or for steps the person has asked for before the contract. An example is the customer's delivery address for an order.
- Legal obligation. The law requires the processing, for example data for bookkeeping or for the Swedish Tax Agency (Skatteverket).
- Protecting vital interests. The processing is necessary to protect someone's life, for example in an emergency.
- Task in the public interest or exercise of official authority. This is the most common basis for authorities and municipalities.
- Legitimate interests. The processing is necessary for a legitimate interest of the company, and that interest outweighs the person's privacy. Public authorities cannot use this basis when they carry out their tasks.
Consent among employees
In an employment relationship the employer has power over the employee. So it is rarely free when an employee says yes. Employers should rely instead on contract, legal obligation or legitimate interests. Do not assume that a colleague's yes is valid consent just because you asked.
Special category data
Article 9 calls them special categories of personal data. In principle they may not be processed, and exceptions apply only in particular cases. Data about:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data for identifying a person
- health
- sex life or sexual orientation
A common exception is that the processing is necessary for the employer or the employee to meet obligations in employment law. Examples are data about sick leave and rehabilitation. Even then the data should reach only those who need it. Do not write diagnoses in e-mails or chats that several people can read.
Data about offences
Under Chapter 3, Section 8 of the Data Protection Act, data about offences, convictions and criminal procedural coercive measures may be processed by public authorities. Others may process it only in certain cases, mainly when regulations or decisions from the Government or IMY allow it (Chapter 3, Section 9). If you are a private employer and want to ask for an extract from the criminal record or similar, first ask the person responsible for data protection.
Personal identity numbers
The personal identity number (personnummer) is a very strong identifier. That is why Sweden has special rules (Article 87 of the GDPR). Under Chapter 3, Section 10 of the Data Protection Act, personal identity numbers and coordination numbers may be processed without consent only when this is clearly justified by the purpose, the importance of secure identification or some other noteworthy reason.
In practice this means:
- Do not ask for a personal identity number when a name and e-mail address are enough.
- Do not write personal identity numbers in subject lines, open lists, file names or messages sent over open channels.
- Do not send personal identity numbers in ordinary e-mail if there is a safer way.
- Use only the part of the number that is needed, for example the last four digits, if that is enough for the task.
Children
For online services, a child in Sweden can consent alone from the age of 13. If the child is younger, consent from the person with parental responsibility is required. Children's data must be protected with special care.
Your role
Always ask yourself: what is our basis for doing this? If you do not know, ask your manager, the data protection officer or the person responsible for data protection before you collect or share data.