GDPR

GDPR stands for the General Data Protection Regulation and is a new data protection regulation from the EU that will become a law in all EU member states from 25 May 2018. GDPR will replace the current law of the Personal Data Act (PUL). The law is intended to protect the integrity of individuals and intends to modernize, harmonize and strengthen protection within the EU.

Within each EU member country there is a supervisory authority that will check this. In Sweden, this authority is called the Integrity Protection Authority, former Computer Inspectorate. On their website there is more information and assistance to share. https://www.datainspektionen.se/dataskyddsreformen/

Processing of personal data

The law is about how personal data are treated, which are two important concepts to understand. Personal data can be explained as any information relating to an identified or identifiable individual (also called a registered person), an identifiable physical person being a person identified directly or indirectly, in particular with reference to an identifier such as a name, an identification number, a location or online identifiers, or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of the physical person. Processing of these data means that a person carries out an action or combination of personal data or sets of personal data, regardless of whether they are performed automated or not. Examples of such treatment are collection, structuring, storage, processing, dispersion or deletion.

Sensitive personal data

There is a special category of personal data that the law takes up and as a person responsible for personal information need to pay particular attention to the sensitive personal data. Examples of sensitive personal data are data revealing ethnic origin, political opinions, religious or philosophical beliefs or information on health and sex life. The starting point is that it is forbidden to process these personal data, but there are a number of exceptions. In Sweden, an investigation is being carried out on these tasks and they are looking forward to developing supplementary Swedish legislation. Read more about sensitive personal information here.

Personal Data Responsible and Personal Data Counselor

In the processing of personal data, there are primarily two roles to know and depending on the role, there are different areas of responsibility. The personally responsible person (PuA) is the one who, under the law, has ultimate responsibility for the treatment and determines the purpose and means. The person responsible for personal data shall ensure that the law is followed, inform the persons whose personal data are processed and shall ensure compliance with the privacy data. The Personal Data Adviser (PuB) processes the personal data on behalf of the Data Protection Officer and is responsible for the technical and organizational security measures.

The company as a Personal Data Responsible

All processing of personal data about you as a customer, user or participant at our tour is our responsibility when you order the Company’s services. We have described in our Privacy Policy what we do, or not, with your personal information.

Basic principles of GDPR

The law is based on 7 basic principles:

• Legality, Correctness and Transparency
• Purpose limitation
• Data Minimization
• Correctness
• Storage Minimization
• Integrity and confidentiality
• Accountability.

You can read more basic principles on the website of the Privacy Authority

Legal basis

In compliance with the principle of legality, regularity and transparency, support is required in the Data Protection Ordinance to allow the processing of personal data. These legal grounds relate to the need for consent, agreement, legal obligation, fundamental interests, public interest, authority or balance of interests in order to process personal data.

Legal basis for tasks in the Company’s services

What legal grounds exist for the processing of personal data in the Company’s services, “personal data administrators” must find out and document. It may vary on a case-by-case basis depending on the activity, which laws you need to follow, if you collect information that is required or that may be good to have.

Unstructured material

In PUL we have had an exception in Sweden where we did not have to think about how personal data are processed, this exception is called the “Code of abuse”. This has meant that we have been able to have personal data in so-called unstructured material, which is running text and free text such as document, e-mail, web pages or notepad in a system. The abuse rule now disappears through GDPR and means that it needs to be mapped which personal data is contained in all unstructured material and handled in the same way as structured material.