Additional rules concerning personal data processing in the area of labour market policy

Swedish Government Official Report of The Inquiry into personal data processing in the area of labour market policy and the supervision thereof

Summary

Remit

The remit of the Inquiry was to examine the processing of certain personal data in the area of labour market policy. The remit included determining the regulations that should apply in this area and examining whether there is a need for special regulations for personal data processed by complementary actors. These external service providers conduct labour market policy activities or other activities concerning newly arrived immigrants on behalf of the Swedish Public Employment Service. The aim of the Inquiry is to create the conditions that enable public authorities1 and the complementary actors to perform their tasks in a legally secure and efficient manner while protecting the personal privacy of individuals.

In addition, the Inquiry was instructed to consider whether there is a need for a special provision overriding secrecy regarding the release of data on individuals by the Swedish Public Employment Service to complementary actors. The Inquiry was also required to assess whether professional secrecy imposed by law should be introduced concerning data about jobseekers processed in activities run by the complementary actors. The remit included proposing legislative amendments that are deemed necessary.

The Inquiry was also tasked with examining whether the Swedish Public Employment Service, when publishing available positions in the Platsbanken database, should be allowed to process data about trade union representatives in the labour market policy database, and whether the Swedish Unemployment Insurance

1 The Swedish Public Employment Service and the Swedish Unemployment Insurance Board

27

Summary SOU 2012:4

Board should be allowed to process data about violations of the law in its statistics and supervisory database.

Introduction of new Act on complementary actors to protect personal privacy of individuals

At present, the Personal Data Act, along with procured agreements, regulate the way complementary actors process data about individuals and companies. The Inquiry proposes introducing an Act on complementary actors.

The Act is to apply when complementary actors perform labour market policy activities and introduction activities for certain newly arrived immigrants on behalf of the Swedish Public Employment Service. The purpose of the Act is to protect the personal privacy of individuals in connection with the performance of a task by the complementary actors assigned to them by the Swedish Public Employment Service following a public procurement. To achieve this purpose, regulations are proposed to the effect that complementary actors may offer their services on similar terms as the Swedish Public Employment Service, while protecting the privacy of individuals in the activities carried out.

Achieving efficient personal data processing in the contracted activities of complementary actors, together with good privacy protection for individual jobseekers and individual employers, requires coherent and easily accessible legislation. Special regulations should only be introduced in areas where privacy considerations are expressly applicable in connection with the performance of a task by the complementary actors. Otherwise, the regulations contained in the Personal Data Act should apply. This matter concerns a special regulation that complements and, in some parts, replaces the Personal Data Act.

The term ‘complementary actor’ refers to a party contracted by the Swedish Public Employment Service to carry out labour market policy activities or activities under the Act on introduction activities for certain newly arrived immigrants. The Inquiry considers that it is only complementary actors providing employment services of the type also offered by the Swedish Public Employment Service itself, requiring such an extensive exchange of information and personal data processing, that are in need of professional

28

SOU 2012:4 Summary

secrecy that is subject to penalty if violated and a special register statute.

Just like the Swedish Public Employment Service, some complementary actors will, to a certain extent, provide health and medical care services, for example in connection with conducting occupational psychology examinations. Existing health and medical care regulations in the Patient Data Act (2008:355) and the Patient Safety Act (2010:659) will continue to apply to this area of services provided by complementary actors.

It is proposed that complementary actors providing services as introduction guides be exempted from the regulations on professional secrecy and the obligation to provide information in the Act on complementary actors. The Act on introduction activities for certain newly arrived immigrants (2010:197) contains regulations on professional secrecy which will be slightly changed. However, the regulations on personal data processing contained in the proposed Act will also apply to introduction guides.

Release of data from the Swedish Public Employment Service to complementary actors

In order for complementary actors to perform their tasks in an efficient manner, the Swedish Public Employment Service must be able to release certain data about jobseekers and employers to the complementary actors. At present, the Swedish Public Employment Service must largely depend upon the individual jobseeker or employer agreeing to releasing the data. If an individual does not consent to the data being released, it could lead to the complementary actors having inadequate material, which in turn would impact on the quality and effectiveness of the service as well as the opportunity for the complementary actor to claim its right to compensation.

It may be considered that society’s interest in the services offered by the complementary actors being as effective as possible, and in there being a large number of complementary actors, outweighs the individual’s interest in being able to determine what data is to be released to the complementary actor. The Inquiry therefore proposes that a special provision overriding secrecy be introduced in Chapter 28 of the Public Access to Information and Secrecy Act to the effect that the Swedish Public Employment

29

Summary SOU 2012:4

Service may release data to complementary actors notwithstanding secrecy provisions if this data is necessary for the complementary actor to perform its tasks. A detailed account of the data covered by the provision overriding secrecy will be given in the proposed Act on complementary actors and in the associated ordinance.

Within the given legislative framework, it is the Swedish Public Employment Service, and not the complementary actor, that makes an assessment of what data is necessary to perform the task in an individual case. From the perspective of equal treatment, it is important that the Swedish Public Employment Service assess the needs of complementary actors to ensure that different complementary actors providing the same service have access to the same type of information. If the complementary actors consider that they need more data than the Swedish Public Employment Service has released in accordance with the proposed provision, or if the jobseeker wishes more data to be released, there is still an opportunity contained in Chapter 10, Section 1 of the Public Access to Information and Secrecy Act to release the data with the consent of the individual.

Professional secrecy and the obligation to provide information for complementary actors

The protection in place concerning the privacy of individuals in public services should also be maintained when complementary actors are engaged. Professional secrecy which is prescribed by law and subject to penalty if violated should therefore be introduced for complementary actors. However, this must not restrict their opportunities to perform their tasks in an efficient manner.

The Inquiry proposes the introduction of professional secrecy prescribed by law for those who are, or who have been, active in services provided by complementary actors, entailing that they may not disclose information to which they have access within the framework of their task without authorisation. Professional secrecy covers both data about a private party’s personal circumstances and a private party’s business and operational circumstances, and the data may not be used in other activities run by complementary actor. ‘Without authorisation’ does not refer to releasing data if it is necessary to perform the assigned task, to someone meeting an obligation to provide information that follows

30

SOU 2012:4 Summary

from an act or an ordinance, or to a situation where an individual consents to the data being released. Professional secrecy is not applicable with regard to the individual concerned.

The Swedish Public Employment Service is obliged to report data that may affect the jobseeker’s right to benefits to the unemployment insurance system and the Swedish Unemployment Insurance Board. Carrying out this obligation depends on the complementary actors releasing the relevant data to the Employment Service. Introduction guides are already obliged to report data that may affect a newly arrived immigrant’s right to introduction benefits to the public authority specified by regulation2. The Inquiry proposes the introduction of a general obligation for complementary actors to provide data that may affect a jobseeker’s right to unemployment benefit or the right to take part in a labour market policy programme to the Swedish Public Employment Service. This kind of obligation to provide information would make clear to complementary actors that they not only provide a service for jobseekers, they also play an important role in ensuring that jobseekers receiving benefits contribute to solving their situation as unemployed in the manner required of them by society.

Regulations concerning processing of personal data by complementary actors

The Act only applies if the data processing is wholly or partly automated, or if the data is included in, or is intended to form part of, a structured compilation of searchable personal data or a compilation according to particular criteria.

The Inquiry considers that it should be stated directly in the Act that the complementary actors have the right to process data about employers, jobseekers and those close to them that is necessary to carry out the task from the Swedish Public Employment Service. This would clarify the right of complementary actors to process personal data and, in combination with an electronic procedure, speed up the process of getting the individual into work. The data that may be processed will be determined by the Government in an ordinance.

2 Section 16, Act on introduction activities for certain newly arrived immigrants (2010:197).

31

Summary SOU 2012:4

In order to bring about personal data processing that is efficient and legally secure, the Inquiry proposes that the Act state the conditions under which a complementary actor may release data on media for automated processing. One prerequisite is of course that the security requirements under Section 31 of the Personal Data Act are fulfilled when transferring data and that the complementary actor has a legal basis for breaking professional secrecy. The complementary actors should be given the opportunity to provide the Swedish Public Employment Service with data on media for automated processing if there is an obligation to provide information under an act or an ordinance, or if it is necessary to perform the assigned task. Complementary actors should also be allowed to release data electronically to employers if it is necessary to perform the task and where sensitive or delicate personal data is not involved. It is proposed that the Government may issue more detailed regulations on what data a complementary actor may release.

The Inquiry considers that the provisions in the Personal Data Act concerning rectification, damages and penalties are to apply when processing personal data under the Act on complementary actors or under regulations issued in connection with this Act.

In order to ensure good privacy protection for individuals regarding both jobseekers and individual companies, the Inquiry considers it important that the Swedish Public Employment Service provide a support system for the activities. This is also an important condition for smaller companies to be able to compete with larger companies, which usually have much greater resources to invest in their security efforts.

The Inquiry proposes that the Swedish Public Employment Service provide a database (a support system) where the complementary actors can process the personal data necessary to perform their task and to facilitate secure electronic data communications between the Employment Service and the complementary actors. The idea is for the Swedish Public Employment Service to design a system with built-in privacy protection that makes it possible for all complementary actors, large and small, to meet the strict security requirements in place when processing personal data due to its sensitivity.

The Swedish Public Employment Service is thus responsible for ensuring that appropriate technical measures such as those referred to in Section 31 of the Personal Data Act are taken to protect the

32

SOU 2012:4 Summary

personal data processed in the database. Each complementary actor is the controller of the personal data it processes in the database to perform its task.

The Swedish Public Employment Service is not to have direct access to the complementary actors’ data contained in the database, and conversely the complementary actors are not to have direct access to the Swedish Public Employment Service’s labour market policy database.

The Inquiry proposes that privacy-sensitive personal data may only be processed in the database provided by the Swedish Public Employment Service. Under the proposed Act on complementary actors, it is only certain sensitive personal data defined in Section 13 of the Personal Data Act (concerning health or revealing ethnic origin) that may be processed at all. It is proposed that this sensitive data, which may be processed by the complementary actors if the data was released within the framework of the task or if the data is absolutely necessary to the performance of the task, be protected by restricting where the data may be processed. The same restrictions should apply to data on social circumstances as well as to evaluations, conclusions or other value information about an individual’s delicate personal data, and data on those close to jobseekers. In addition, regular notes taken by complementary actors about jobseekers and their lives in connection with the performance of the task should be protected in a similar manner, since they often provide a detailed picture of the jobseeker and his or her life.

Restrictions corresponding to those in the Swedish Public Employment Service’s statutes on registers should also be stated in the Act. This means that personal data that reveals political opinions, religious or philosophical beliefs, or trade union membership, or personal data concerning a person’s sex life, may not be processed in the database. Other data that may not be processed in the database includes personal data on violations of the law, data indicating that the individual has been cared for under the Social Services Act or has been the subject of measures under the Aliens Act.

For complementary actors to use their business ideas and make use of their own systems in the task of getting jobseekers into work and matching jobseekers with employers, it should be possible to process personal data normally not considered as privacysensitive outside the database. This category of data includes data

33

Summary SOU 2012:4

that a jobseeker normally provides to an employer when submitting a job application, i.e. name, contact information and qualifications (CV information). This regulation means that complementary actors may enter data in their candidate databases, book meetings by means of their calendars and, where applicable, use their own matching tools for internal use.

The Inquiry does not propose any restrictions concerning the use of search terms. In view of the manner in which the complementary actors will be allowed to process personal data in the database, no such need exists. The way the proposal is formulated, they will only have access to one jobseeker at a time. There is no risk that a sensitive compilation of data will become an official document since it is not proposed that the Swedish Public Employment Service have direct access to data in the database.

Personal data in the database will be deleted when it is no longer necessary for carrying out the task, but no later than two years after the end of the year in which the task carried out for the Swedish Public Employment Service is concluded. This means that in certain cases, a complementary actor that concludes a task can access the data for a longer period of time, since it is still in the database.

Need for consequential amendments to the Act to handle personal information in labour market policy activities (2002:546) (Register Act)

For the sake of clarity, it should be made clear in the Swedish Public Employment Service’s Register Act that it does not cover databases for complementary actors.

The provisions of the Swedish Public Employment Service’s Register Ordinance limiting the Service’s opportunities to process data on health and social circumstances that has been released in a case, or which is absolutely necessary to its processing, should be removed. Since complementary actors are considered to have a need to process this kind of data, this amendment is necessary for communications between complementary actors and the Swedish Public Employment Service to function in an efficient and legally secure manner.

Data that, following a secrecy check, the Swedish Public Employment Service is allowed to release should be available on media for auto-

34

SOU 2012:4 Summary

mated processing. This does not require any amendments to the Swedish Public Employment Service’s register statues.

Processing of union representatives’ personal data in the Platsbanken database

The Inquiry considers that the Swedish Public Employment Service should be permitted to process data revealing union membership of the employer’s contacts in connection with a job advertisement. This data fulfils a function that is desired by the trade union organisations, and employer representatives do not have any objections to this data being published. The Inquiry proposes that it be clarified in the Swedish Public Employment Service’s Register Act that the Employment Service may, in connection with a job advertisement, process and publish data that reveals the trade union membership of an employer’s contact person, provided that the person in question has given their consent to the employer.

Processing of personal data concerning offences, etc. at the Swedish Unemployment Insurance Board

The Swedish Unemployment Insurance Board has been instructed by the Government to develop work to ensure correct payments from the unemployment insurance funds and to combat benefit fraud. To be able to carry out this task, the Swedish Unemployment Insurance Board needs to systematically follow up any incorrect payments from the unemployment insurance funds, the extent to which cases are reported to the police under the Benefit Crime Act (2007:612) and the outcome of reported cases. Under its current Register Ordinance, the Swedish Unemployment Insurance Board is not permitted to process data on offences, etc. in its statistics and supervisory database, and searches of these reports and follow-ups must therefore be conducted manually. This unjustifiably limits the Board’s possibilities of effectively developing procedures for preventing incorrect payments and combating benefit fraud.

The Inquiry proposes that the Swedish Unemployment Insurance Board be permitted to process such data on benefit fraud in its statistics and supervisory database if this data has been released in a

35

Summary SOU 2012:4

case or is necessary for the processing of a case. It should also be possible to use the data as search terms for the supervision, followup and compilation of de-identified statistics.

By including a limitation in the Ordinance on processing data concerning benefit fraud involving compensation under the Unemployment Insurance Act (1997:238), the processing will be less of an encroachment on individual privacy. The fact that the Swedish Unemployment Insurance Board is now permitted to use data on benefit fraud as a search term means that any compilations generated by the use of the search term are official documents. This type of data at the Swedish Unemployment Insurance Board is currently covered by secrecy under Chapter 28, Section 13 of the Public Access to Information and Secrecy Act. This provision states that the presumption is in favour of public access. In light of the fact that data on violations of the law that constitute criminal offences are considered to be particularly privacy-sensitive, the Inquiry considers that the interest of protecting data outweighs the interest of transparency. The Inquiry therefore proposes the introduction of a new paragraph in Chapter 28, Section 13 of the Public Access to Information and Secrecy Act under which data on violations of the law constituting criminal offences and judgments in criminal cases concerning unemployment benefit matters under the Unemployment Insurance Act (1997:238), and in matters on membership fees for unemployed members under the Unemployment Funds Act (1997:239), is covered by secrecy unless it is clear that the data may be disclosed without the individual or those close to him or her suffering harm, i.e. a presumption of secrecy.

Consequences

The legislative proposals are expected to result in more secure and efficient personal data processing in the labour market policy area. They will ensure good protection for the personal privacy of the individual regardless of who performs the employment service. The regulations make clear the conditions under which the complementary actors may process personal data and which special restrictions are to apply to protect privacy-sensitive data. The introduction of legislative support for processing by complementary actors and a provision overriding secrecy, as well as the potential for secure electronic communications, are expected to make it

36

SOU 2012:4 Summary

easier to take measures faster than is currently the case. This provides the potential to reduce the time an individual spends in unemployment. This should be positive for employment in Sweden and thus also for the state’s finances, resulting in reduced costs for the unemployment insurance system.

Processing personal data in activities run by complementary actors places great demands on security from both a technical and an organisational perspective. The proposed solution that the Swedish Public Employment Service provide a database for complementary actors is expected to substantially reduce the costs for the companies’ data processing, not least as regards IT security. Tasking the Swedish Public Employment Service with providing the system and being responsible for its security should result in costsavings and less trouble, particularly for small companies. Overall, the Inquiry’s proposals should improve the competitiveness of small companies compared with large companies.

The Swedish Public Employment Service has stated that the costs of setting up a database for complementary actors with the desired functionality are expected to amount to some SEK 28 million. It is estimated that the project period for setting up the new support system will take about one year. It is proposed that the system be financed within the framework of the Swedish Public Employment Service’s budget, or through loans from the Swedish National Debt Office.

The Inquiry’s proposal on allowing the Swedish Unemployment Insurance Board to process data on offences in its statistics and supervisory database is expected to facilitate and streamline the Board’s work on preventing incorrect payments and combating benefit fraud. This in turn should lead to savings for the state in the form of reduced payments from the unemployment benefit system.

Entry into force

It is proposed that the Act on complementary actors and the other legislative amendments enter into force on 1 July 2013.

37