CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
FRA, the Personal Data Act (Personuppgiftslagen; 1998:204) continues to
apply, although it is otherwise replaced by the new EU Regulation and the
supplementary act. It gives the Data Protection Authority the same general
supervisory task. In performing this task, the Authority may receive and
examine individual complaints.
J. Secrecy at the FRA
71. The Public Access to Information and Secrecy Act (Offentlighetsoch sekretesslagen; 2009:400) contains a specific provision on the FRA’s
signals intelligence activities. Secrecy applies to information on an
individual’s personal or economic circumstances, unless it is evident that
the information can be disclosed without the individual concerned or any
other person closely related to him or her being harmed. The presumption is
for secrecy (Chapter 38, section 4).
72. According to the Act, secrecy also generally applies to foreign
intelligence activities in regard to information concerning another State,
international organisation, authority, citizen or legal person in another State,
if it can be presumed that a disclosure will interfere with Sweden’s
international relations or otherwise harm the country (Chapter 15,
section 1).
73. Secrecy further applies to information on activities related to the
defence of the country or the planning of such activities or to information
that is otherwise related to the country’s comprehensive defence strategy, if
it can be presumed that a disclosure will harm the country’s defence or
otherwise endanger national security (Chapter 15, section 2).
74. Information which is protected by secrecy under the Public Access
to Information and Secrecy Act may not be disclosed to a foreign authority
or an international organisation unless (i) such disclosure is permitted by an
express legal provision (cf. section 7 of the FRA Personal Data Processing
Ordinance, paragraph 34 above), or (ii) the information in an analogous
situation may be communicated to a Swedish authority and the disclosing
authority finds it evident that the communication of the information to the
foreign authority or the international organisation is consistent with Swedish
interests (Chapter 8, section 3 of the Act).
K. The reports of the Data Protection Authority
75. On 12 February 2009 the Government ordered the Data Protection
Authority to examine the handling of personal data at the FRA from an
integrity perspective. In its report, published on 6 December 2010, the
Authority stated that its conclusions were overall positive. Issues relating to
the processing of personal data and to personal integrity were given serious
consideration by the FRA and a considerable amount of time and resources