The last lesson is about what happens when the rules are not followed, and about what is the employer's job and what is yours.
IMY's powers
Under Article 58, the Swedish Authority for Privacy Protection (IMY) can:
- investigate complaints and carry out inspections (supervision)
- request information and gain access to data and premises
- issue orders, warnings and reprimands
- ban a particular processing operation or decide that data must be corrected or deleted
- decide on an administrative fine
IMY chooses a measure according to how serious the infringement is. Not every case leads to a fine. A reprimand or an order is common.
Administrative fines
The amounts in Article 83 are maximum amounts:
- up to EUR 10 million or 2 per cent of the company's worldwide annual turnover, whichever is higher, for failings in, among other things, security, record keeping, data protection by design and notification of breaches
- up to EUR 20 million or 4 per cent, whichever is higher, for breaches of the basic principles, the lawful basis, data subjects' rights and the rules on transfers to third countries
For public authorities in Sweden the ceilings are lower: SEK 5 million and SEK 10 million respectively (Chapter 6, Section 2 of the Data Protection Act).
The fine is set according to the nature of the infringement, how long it lasted, how many people were affected and how the organisation acted.
Compensation and other consequences
- A person who has suffered damage because of an infringement can receive compensation (Article 82).
- The organisation's reputation and trust are damaged.
- For you as an employee it can have employment law consequences. Anyone who knowingly looks at data without a work reason or passes it on can, for example, be given a warning or be dismissed. In some cases unauthorised access to data can be a criminal offence, for example unauthorised intrusion into data under Chapter 4, Section 9 c of the Swedish Criminal Code (brottsbalken), and a duty of confidentiality may also apply.
What the employer is responsible for
The training you are taking now gives you knowledge of the rules. It does not replace what the employer must do itself:
- draw up its own guidelines and procedures for personal data
- keep a record of processing activities (Article 30), where the obligation applies
- appoint a data protection officer when required (Articles 37 to 39)
- carry out data protection impact assessments when processing involves a high risk (Article 35)
- conclude processing agreements and assess suppliers
- give instructions for the systems you use and control who has access
- have procedures for breaches and for requests from data subjects
- provide training tailored to the role and the business, for example for staff in HR, health care, schools or marketing
Your checklist
- Process personal data only for what the job requires.
- Keep the principles in mind: purpose, minimisation, accuracy, storage and security.
- Ask if you are unsure whether you may collect, share or keep something.
- Protect passwords, screens, papers and e-mail. Be suspicious of unexpected messages.
- Recognise a request from a data subject and pass it on at once.
- Report a breach immediately, better once too often than once too seldom.
- Never look at data just out of curiosity.
- Find out who the data protection officer or contact person is where you work and where the guidelines are.
Closing words
Data protection is about respect for people. When you handle data with care, you protect those who trust your workplace, and you protect yourself and your employer.