CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
(förvaltningsrätten) in Stockholm to have illegally processed personal data
destroyed (Chapter 5, section 4). According to copies of an email exchange
of April 2019 between the applicant and the Administrative Court, there was
no trace in that court’s electronic records of the latter possibility having
been used by the Data Protection Authority.
H. Notification of secret surveillance measures
58. If selectors directly related to a specific natural person have been
used, he or she is to be notified by the FRA, according to the Signals
Intelligence Act. The notification shall contain information on the date and
purpose of the measures. Such notification shall be given as soon as this can
be done without detriment to the foreign intelligence activities, but no later
than one month after the signals intelligence mission has been concluded
(section 11a).
59. However, the notification may be delayed if secrecy so demands, in
particular defence secrecy or secrecy for the protection of international
relations. If, due to secrecy considerations, no notification has been given
within a year from the conclusion of the mission, the person does not have
to be notified. Furthermore, notification shall not be given if the measures
solely concern the conditions of a foreign power or the relationship between
foreign powers (section 11b).
60. In its 2010 report, the Data Protection Authority noted, inter alia,
that the procedure for notification to individuals had never been used by the
FRA, due to secrecy considerations (see paragraph 75 below).
I. Remedies
61. The Signals Intelligence Act provides that the Foreign Intelligence
Inspectorate, at the request of an individual, must investigate if his or her
communications have been intercepted through signals intelligence and, if
so, verify whether the interception and treatment of the information have
been in accordance with the law. The Inspectorate shall notify the individual
that such an investigation has been carried out (section 10a). A request can
be made by legal and natural persons regardless of nationality and
residence. During the period 2010-2017, 132 requests were handled and no
unlawfulness was established. In 2017, ten such requests were processed; in
2016 the number was 14. The Inspectorate’s decision following a request is
final.
62. Under the FRA Personal Data Processing Act, the FRA is also
required to provide information upon request. Once per calendar year, an
individual may demand information on whether personal data concerning
him or her is being or has been processed. If so, the FRA must specify what
information on the individual is concerned, from where it was collected, the
15