8
CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
interception, they shall be destroyed as soon as the domestic nature of the
communications has become evident (section 2a).
27. If a permit urgently granted by the FRA (see paragraph 21 above) is
revoked or amended by the Foreign Intelligence Court, all intelligence
collected which is thereby no longer authorised must be immediately
destroyed (section 5b(3)).
28. The FRA Personal Data Processing Act (Lagen om behandling av
personuppgifter i Försvarets radioanstalts försvarsunderrättelse- och
utvecklingsverksamhet; 2007:259) contains provisions on the treatment of
personal data within the area of signals intelligence. The Act entered into
force on 1 July 2007, with amendments made on 30 June 2009 and
15 February 2010. The purpose of the Act is to protect against violations of
personal integrity (Chapter 1, section 2). The FRA shall ensure, inter alia,
that personal data is collected only for certain expressly stated and justified
purposes. Such purpose is either determined by the direction of the foreign
intelligence activities through a detailed tasking directive or by what is
necessary in order to follow changes in the signals environment, technical
advances and signals protection. Also, the personal data treated has to be
adequate and relevant in relation to the purpose of the treatment. No more
personal data than what is necessary for that purpose may be processed. All
reasonable efforts have to be made to correct, block and obliterate personal
data that is incorrect or incomplete (Chapter 1, sections 6, 8 and 9).
29. Personal data may not be processed solely because of what is known
of a person’s race or ethnicity, political, religious or philosophical views,
membership in a union, health or sexual life. If, however, personal data is
treated for a different reason, this type of information may be used if it is
absolutely necessary for the treatment. Information about a person’s
physical appearance must always be formulated in an objective way with
respect for human dignity. Intelligence searches may only use the
mentioned personal indicators as search terms if this is absolutely necessary
for the purpose of the search (Chapter 1, section 11).
30. Personnel at the FRA who process personal data go through an
official security clearance procedure and are subject to confidentiality in
regard to data to which secrecy applies. They could face criminal sanctions
if tasks relating to the processing of personal data are mismanaged
(Chapter 6, section 2).
31. Personal data that has been subjected to automated processing shall
be destroyed as soon as it is no longer needed (Chapter 6, section 1).
32. Further provisions on the treatment of personal data are laid down in
the FRA Personal Data Processing Ordinance (Förordningen om
behandling
av
personuppgifter
i
Försvarets
radioanstalts
försvarsunderrättelse- och utvecklingsverksamhet; 2007:261). It provides,
inter alia, that the FRA may keep databases for raw material containing
personal data. Raw material is unprocessed information which has been