Page 1

Listen

Easy to read

Sign language

In English

Other languages

Search on riksdagen.se

Start

Members & parties

The committees & the EU committee Debates & decisions

Documents & laws

Dictionary

search

This is how the Riksdag works Web TV

Start Documents
/
& Laws Act (2018:
/
218) with supplementary provisions to the EU Data Protection Regulation

Law (2018: 218) with supplementary
provisions of the EU
data protection regulation
tom SFS 2020: 152

SFS no : 2018: 218
Ministry / authority : Ministry of Justice L6
Issued : 2018-04-19
Modified : until SFS 2020: 152
Change register : SFSR (Government Offices)
Source : Full text (Government Offices)

Content:
1 chap. Introductory provisions
Chapter 2 Legal basis for the processing of personal data
Chapter 3 Processing of certain categories of personal data
Chapter 4 Restrictions on use
Chapter 5 Restrictions on certain rights and obligations
Chapter 6 The supervisory authority's handling and decisions
Chapter 7 Damages and appeals
Transitional provisions

1 chap. Introductory provisions
Section 1 This Act complements Regulation (EU) of the European Parliament and of the Council
2016/679 of 27 April 2016 on the protection of natural persons with respect to
processing of personal data and on the free movement of such data and on
repeal of Directive 95/46 / EC (General Data Protection Regulation), referred to herein
EU Data Protection Regulation.
Terms and expressions in this law have the same meaning as in the EU
data protection regulation.
Extended application of the provisions of the EU Data Protection Regulation
Section 2 The provisions of the EU Data Protection Regulation, in its original wording,
and this Act shall also apply to the processing of personal data that constitutes a link
in an activity not covered by Union law and in activities which
covered by Title V, Chapter 2 of the Treaty on European Union.
Section 3 The provisions of Section 2 do not apply to activities covered by
1. the Act (2007: 258) on the processing of personal data in the Armed Forces
defense intelligence and military security services,
2. the Act (2007: 259) on the processing of personal data in the Armed Forces
radio station's defense intelligence and development activities, or
3. the Act (2019: 1182) on the Security Police's processing of personal data. Law
(2019: 1186) .
Section 4 Articles 33 and 34 of the EU Data Protection Regulation do not apply in respect of
personal data incidents that must be reported in accordance with the Security Protection Act
(2018: 585) or regulations that have been issued in connection with that law.
Lag (2018: 1248) .

Territorial scope of the law
Section 5 This Act applies to the processing of personal data carried out within the framework
for activities carried out by personal data controllers or
the personal data assistants' places of business in Sweden. The law also applies to
processing of personal data carried out by personal data controllers who do not
are established in Sweden, but in a place where Swedish law applies according to international law.
The law also applies to the processing of personal data performed by
personal data controllers or personal data assistants who are only established in
third country, if the processing concerns registered persons who are in Sweden and
is related to
1. offering of goods or services to such data subjects; or
2. monitoring of their behavior in Sweden.
The provision in ch. Section 4 applies to the processing of personal data relating to
children living in Sweden, regardless of where they were responsible for personal data or
the personal data assistants are established.

Deviating provisions in another constitution
Section 6 If another law or ordinance contains any provision which
deviates from this Act, that provision shall apply.

The relationship to freedom of the press and expression
Section 7 of the EU Data Protection Regulation and this Act shall not be applied in it
to the extent that it would be contrary to the Freedom of the Press Regulation or
the Freedom of Expression Act.
Articles 5-30 and 35-50 of the EU Data Protection Regulation and Chapters 2-5 this law
shall not be applied in the processing of personal data that takes place for journalistic purposes
purpose or for academic, artistic or literary creation.

Duty of confidentiality for data protection officers
Section 8 A person who performs a task as a data protection officer in accordance with Article 37 of the EU
the Data Protection Regulation may not unauthorisedly disclose what he or she is doing
the performance of their task has become known.
In the public service, the Public Access to Information and Secrecy Act is applied
(2009: 400) instead of the first paragraph.

Chapter 2 Legal basis for the processing of personal data
Legal obligation
Section 1 Personal data may be processed on the basis of Article 6 (1) (c) of the EU
protective regulation, if the treatment is necessary for it
personal data controller must be able to fulfill a legal obligation that follows from
law or other statute, by collective agreement or by decisions that have been announced
by virtue of law or other statute.

Task of general interest and exercise of authority
Section 2 Personal data may be processed on the basis of Article 6 (1) (e) of the EU
Data Protection Regulation, if processing is necessary
1. to perform a task of general interest arising from law or otherwise
constitution, by collective agreement or by decisions issued by law
or other constitution, or
2. as part of the personal data controller's exercise of authority in accordance with law
or other constitution.

Individual archives
Section 3 The Government or the authority determined by the Government may notify
regulations that personal data controllers who are not covered by regulations on
archives may process personal data for archival purposes of general interest.
The authority determined by the government may in individual cases decide that such
personal data controllers may process personal data for archival purposes by
public interest. A decision may be combined with conditions.

Children's consent
Section 4 When offering information society services directly to a child who lives
in Sweden, the processing of personal data must be permitted with the support of the child
consent, if the child is at least 13 years old. If the child is under 13 years of age, such shall
treatment be permitted only if consent is given or approved by the person who has
parental responsibility for the child.

Chapter 3 Processing of certain categories of personal data
Sensitive personal data
Section 1 For the purposes of this Act, sensitive personal data refers to such data as
referred to in Article 9 (1) of the EU Data Protection Regulation.

Labor law, social security and social protection
Section 2 Sensitive personal data may be processed on the basis of Article 9 (2) (b) of the EU
Data Protection Regulation, if the processing is necessary for it
personal data controller or the data subject must be able to fulfill his
obligations and exercise their special rights in labor law and in
the areas of social security and social protection.
Personal data processed on the basis of the first paragraph may be disclosed to third parties
party only if in employment law or in the areas of social security and
social protection, there is an obligation for the data controller to do so
or if the data subject has expressly consented to the disclosure.

Important public interest
Section 3 Sensitive personal data may be processed by an authority on the basis of an article
9.2 g in the EU Data Protection Regulation
1. if the information has been provided to the authority and the processing is required according to
law,
2. if the processing is necessary for the handling of a case, or
3. otherwise, if the treatment is necessary in view of an important general
interest and does not unduly infringe on the data subject's personal
integrity.
In the case of treatment that takes place solely on the basis of the first paragraph, it is forbidden to
perform searches in order to obtain a selection of people based on sensitive
personal data.
For the purposes of the first paragraph 1, other than authorities shall be equated with
authorities, to the extent that the provisions on public documents and
secrecy in the Freedom of the Press Ordinance and the Public Access to Information and Secrecy Act
(2009: 400) apply in their business.
Section 4 The Government may issue further regulations on such treatment of
sensitive personal data that is necessary with regard to an important general
interest.

Health care and social care
Section 5 Sensitive personal data may be processed on the basis of Article 9 (2 ) ( h ) of the EU
Data Protection Regulation, if the processing is necessary for
1. preventive health care and occupational medicine;
2. the assessment of a worker's work capacity;
3. medical diagnoses,
4. the provision of health care or treatment;
5. social care, or
6. management of health care services, social care and their
system.
Treatment according to the first paragraph may take place provided that the requirement of
confidentiality in Article 9 (3) of the EU Data Protection Regulation is fulfilled.

File
Section 6 Sensitive personal data may be processed for archival purposes of general interest
pursuant to Article 9 (2) (j) of the EU Data Protection Regulation, if the processing is
necessary for the personal data controller to be able to follow regulations on
file.
The government or the authority determined by the government may notify
regulations that personal data controllers who are not covered by regulations on
archives may process sensitive personal data for archival purposes of general interest.
The authority determined by the government may in individual cases decide that such
personal data controllers may process sensitive personal data for archival purposes
of general interest. A decision may be combined with conditions.

Statistics
Section 7 Sensitive personal data may be processed on the basis of Article 9 (2 ) ( j ) of the EU
Data Protection Regulation, if the processing is necessary for statistical purposes and
the societal interest of the statistical project where the treatment is included clearly outweighs
the risk of undue intrusion on the privacy of individuals as the treatment
may involve.

Personal data relating to violations of the law
Section 8 Personal data referred to in Article 10 of the EU Data Protection Regulation may
processed by authorities.
Other than authorities may also process such personal data, if
the processing is necessary for the personal data controller to be able to follow
regulations on archives.
Section 9 The Government or the authority determined by the Government may notify
further regulations on in which cases other than authorities may process such
personal data referred to in Article 10 of the EU Data Protection Regulation.
The authority determined by the government may in individual cases decide that other than
authorities may process such data. A decision may be combined with conditions.

Social security number and coordination number
Section 10 Social security numbers and coordination numbers may be processed without consent
only when it is clearly justified in view of the purpose of the treatment,
the importance of a secure identification or any other compelling reason.
Section 11 The Government may issue further regulations on in which cases treatment of
social security number and coordination number are allowed.

Chapter 4 Restrictions on use
File
Section 1 Personal data that is processed only for archival purposes of general interest
may be used to take action in respect of the data subject only if so
there are special reasons with regard to the vital interests of the data subject.
The first paragraph does not prevent authorities from using personal data such as
can be found in public documents.
When applying the second paragraph, other than authorities shall be equated with
authorities, to the extent that the provisions on public documents and
secrecy in the Freedom of the Press Ordinance and the Public Access to Information and Secrecy Act
(2009: 400) apply in their business.

Statistics
Section 2 Personal data that is processed solely for statistical purposes may be used
to take action in respect of the data subject only if there are exceptional
reasons taking into account the vital interests of the data subject.

Research
Section 3 Personal data that is processed solely for research purposes may be used
to take action in respect of the data subject only if there are exceptional
reasons taking into account the vital interests of the data subject. Lag (2018: 2002) .

Chapter 5 Restrictions on certain rights and obligations
Information and access to personal data
Section 1 Articles 13-15 of the EU Data Protection Regulation on information and the right to receive
access to personal data does not apply to data such as the
personal data controller may not disclose to the data subject in accordance with law or
another constitution or according to decisions issued on the basis of a constitution.
If the person responsible for personal data is not an authority, the exemption applies in the first
paragraph also for information that would have been classified by an authority
according to the Public Access to Information and Secrecy Act (2009: 400).
Section 2 Article 15 of the EU Data Protection Regulation does not apply to personal data on an ongoing basis
text which has not received its final form when the request was made or which constitutes
memory note or similar.
The exception in the first paragraph does not apply to personal data
1. has been disclosed to a third party;
2. treated only for archival purposes of general interest or statistical
purpose, or
3. has been treated for more than a year in a running text that has not received its
final design.

Authorization
Section 3 The Government may issue further regulations on restrictions pursuant to
Articles 23, 89 (2) and 89 (3) of the EU Data Protection Regulation.

Chapter 6 The supervisory authority's handling and decisions
Powers
§ 1 The powers of the supervisory authority under Article 58 (1), (2) and (2)
58.3 of the EU Data Protection Regulation applies to the supervision of the provisions of
this law and other regulations that supplement the EU Data Protection Regulation
followed.
The first paragraph does not mean that the supervisory authority may charge penalty fees for
infringements other than those referred to in Article 83 of the EU Data Protection Regulation.

Penalty fees
Section 2 The supervisory authority may charge a penalty fee from an authority at
infringements referred to in Article 83 (4), (5) and (6) of the EU
data protection regulation, in its original wording. In that case, Article 83 (1), (2) and
83.3 of the Regulation applies.
The penalty fee shall be set at a maximum of SEK 5,000,000 in the event of violations
referred to in Article 83 (4) of the EU Data Protection Regulation and up to a maximum of 10,000,000
infringements referred to in Article 83 (5) and (6) of the Regulation.
Section 3 The supervisory authority may charge a penalty fee for violations of an article
10 of the EU Data Protection Regulation, in its original wording. In that case, Article 83 (1)
83.2 and 83.3 of the Regulation apply. The size of the fee shall be determined by
application of Article 83 (5) of the Regulation.
Section 4 A penalty fee may not be decided if the person from whom the fee is to be charged does not
has had the opportunity to comment within five years from the date on which the infringement took place.
A decision on a penalty fee must be notified.
Section 5 A penalty fee accrues to the state.
Section 6 A penalty fee shall be paid to the authority appointed by the Government
decides within 30 days of the decision to charge the fee being made lawful
force or within the longer period specified in the decision.
If the penalty fee is not paid within the time specified in the first paragraph,
the authority to pay the unpaid recovery fee. Provisions on
collection is found in the law (1993: 891) on collection of state receivables etc. Vid
collection may be carried out in accordance with the Enforcement Code.
Section 7 The Government may issue further regulations on penalty fees in accordance with
EU Data Protection Regulation and this law.

Chapter 7 Damages and appeals
Damages
Section 1 The right to compensation from the person responsible for personal data or
the personal data assistant under Article 82 of the EU Data Protection Regulation applies to
violations of provisions of this Act and other regulations such as
complements the EU Data Protection Regulation.

Appeal against decisions of authorities responsible for personal data
Section 2 Decisions pursuant to Articles 12.5 and 15-21 of the EU Data Protection Regulation which have
issued by an authority in its capacity as personal data controller may be appealed
to the general administrative court.
Permission to appeal is required in an appeal to the Court of Appeal.
The first paragraph does not apply to decisions of the Government, the Supreme Court, the Supreme Court
the Administrative Court or the Parliamentary Ombudsmen.

Appeal against the supervisory authority's decision
Section 3 The supervisory authority's decisions in accordance with the EU Data Protection Regulation and in accordance with 6
Cape. Sections 2 and 3 of this Act may be appealed to a general administrative court. When one
decision is appealed, the supervisory authority is the other party in the court.
Permission to appeal is required in an appeal to the Court of Appeal.

Appeals against certain other decisions
Section 4 Decisions according to Chapter 2 Section 3, second paragraph, Chapter 3 Section 6, third paragraph and Chapter 3 9
§ second paragraph of this law may be appealed to a general administrative court.
Permission to appeal is required in an appeal to the Court of Appeal.

Prohibition of appeal
Section 5 Decisions pursuant to the EU Data Protection Regulation or this Act other than those which
referred to in §§ 2-4 may not be appealed.

Transitional provisions
2018: 218
1. This law enters into force on 25 May 2018.
2. The Act repeals the Personal Data Act (1998: 204).
3. Instead of what is said in ch. § 2, the repealed law shall continue to
apply in such activities at the Armed Forces and the Swedish Armed Forces' radio station as
not covered by Union law. Lag (2020: 152) .
4. Has been repealed by law (2018: 1248) .
5. The repealed law still applies to the extent that it in another
law or regulation, there are provisions that contain references to it
layers.
6. The repealed law still applies to appeals against decisions that have
notified under that law.
7. The provision in section 49 of the repealed law still applies to infringements
which has taken place before the entry into force.
8. Decisions that have been announced on the basis of section 21, fourth paragraph, the repealed
the law still applies.
2018: 1248
This Act enters into force on 1 April 2019 in respect of ch. § 4 and otherwise on 1
August 2018.

Our other websites

Follow Sweden's Riksdag

For you who want to monitor the work in the house and
committees, there are several different ways to choose from.

EU information
Open data

Subscribe

Follow President Andreas Norlén

Follow & subscribe

Celebrate democracy!

The switch

Contact

Work with us

Press

For teachers

Visit the Riksdag

The Riksdag Library

08-786 40 00
Questions about the Riksdag and the EU?
020-349 000
riksdagsinformation@riksdagen.se

Order and download

Registrar
registrator.riksdagsforvaltningen@riksdagen.se

All public power in Sweden is based on the people and the Riksdag is
the main representative of the people.

About the site

Cookies Availability

Listen

Easy to read

Sign language

In English

Other languages

Dictionary

