1. Text Privacy and Data Protection in Sweden Christine Kirchberger

2. Presenter Lawyer, LL.M. (Law and Information Technology) Teaching IT law, legal information retrieval, at Stockholm University since 2001 PhD on legal information retrieval Publications: Cyber Law in Sweden Co-editor-in-chief for VoxPopuLII, Legal Information Institute, Cornell Law School

3. Contact Christine Kirchberger e-mail christine.kirchberger@juridicum.su.se twitter iinek web iinek.net IT lawlegalgeekgirls.com

4. Presentation International Background Swedish situation Challenges in Sweden Questions

5. Text International Background

6. Europe European Convention for the Protection of Human Rights and Fundamental Freedoms - 1950) Article 8 – Right to respect for private and family life 1. Everyone has the right to respect for her/his private and family life, her/his home and her/his correspondence.

7. European union European Parliament and Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter ‘Data Protection Directive’) under review at the moment http://ec.europa.eu/justice/data-protection/

8. Text Swedish situation

9. Swedish constitution Swedish Instrument of Government (Regeringsform (1974:152)) - one of the four constitutional laws in Sweden Chapter 2 Article 6 paragraph 2: [e]veryone shall be protected in their relations with the public institutions against significant invasions of their personal privacy, if these occur without their consent and involve the surveillance or systematic monitoring of the individual’s personal circumstances. no definition of privacy!

10. Swedish privacy legislation Swedish Penal Code (Brottsbalk (1962:700)) - provisions on libel, slander, etc 1973: Swedish Data Act (Datalag (1973:289)) - focus on computer registers 1998: Personal Data Act (Personuppgiftslag (1998:204)), based on Data Protection Directive for authorities: specific laws with regards to processing of their data specific rules for privacy within electronic communications - Electronic Communications Act (lag (2003:389) om elektronisk kommunikation) including cookies

11. Definitions - data protection personal data: any information that directly or indirectly may be attributed to a natural person sensitive data: race or ethnic origin, political opinions, religious or philosophical belief, health, data controller (personuppgiftsansvarig): the natural or legal person that de facto decides on the processing processing: any type of processing of personal data, storing, collecting, changing, sharing, …

12. Principles of data protection Requirements when processing data (Sec 9 PDA, Art 6 Data Protection Directive), such as personal data is only collected for specific, explicitly stated and justified purposes; the personal data that is processed is adequate and relevant in relation to the purposes of the processing Processing only allowed under certain circumstances (Sec 10 PDA, Art 7 Data Protection Directive) consent of the individual processing is necessary for performance of a contract, legal obligation, or balance of interest in favour of person processing

13. Exemptions (less or no rules) simplified rules unstructured processing (Sec 5a PDA) journalistic purposes (Sec 7 para 2 PDA) Personal Data Act not applicable if processing purely for private purposes (Sec 6) if processing falls under freedom of press or freedom of expression (Sec 7 para 1) if processing alls within principle of openness for public authorities (Sec 8)

14. Text Challenges IT & privacy related

15. Recent challenges websites that fall under freedom of expression and do not have to adhere to personal data legislation right to be forgotten trend on EU level data retention of traffic data collected by electronic communications providers who are obliged by law to do that