Almost every workplace handles information about people. A cashier sees customers' names. A receptionist writes down visitors. A nurse reads a patient record. A teacher has a class list. The rules for such information are the data protection rules, and they apply to you just as much as to your employer.
The laws in Sweden
- The General Data Protection Regulation, usually called the GDPR (EU 2016/679), is the main set of rules. It applies directly in all EU countries.
- Act (2018:218) with supplementary provisions to the EU General Data Protection Regulation, usually called the Data Protection Act (dataskyddslagen), fills in what each country may decide for itself. This covers, for example, personal identity numbers and information about offences.
- Many sectors have their own laws with rules on personal data, for example in health care, schools and public authorities.
The supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). IMY gives guidance, receives complaints and breach notifications, inspects organisations and can decide on administrative fines.
Personal data
Personal data is any information that can be linked to a living person. The information does not have to be secret. Examples:
- name, address, e-mail address and telephone number
- personal identity number and employee number
- a photo, video footage from a camera and a voice recording
- a note of what a person has said or done
- an IP address and other online identifiers
If you can tell who the information is about, even by putting several pieces of information together, it is personal data. Information about a deceased person is not covered. Pure company information, such as a company's turnover, is not personal data either, but the name and e-mail address of a contact person are.
Processing
To process personal data means almost anything you can do with it: collect, store, read, change, send, compile, delete. Even opening a patient record on the screen is processing.
The rules apply when the data is handled digitally. They also apply to paper files that are organised so that information about people can be looked up, for example a binder sorted by name. Purely private information at home is not covered.
Who is who?
- The controller decides why and how the data is processed. Your employer is usually the controller.
- The processor processes data on behalf of the controller and according to its instructions. Examples are a payroll company or a cloud service.
- The data subject is the person the data is about: customers, patients, pupils, colleagues and job applicants.
- A data protection officer (DPO) must exist at public authorities and at some other organisations. The DPO gives advice, checks that the rules are followed and is the contact point for IMY. You may turn to the DPO with questions.
The controller carries the main responsibility under the law. As an employee you work for the employer, follow its rules and process data only for the sake of the job.
What you can expect
Your employer should have its own guidelines, a record of its processing and instructions for the systems you use. This course gives you the basics, but it cannot replace that. In the last lesson we go through what the employer is responsible for.