EPAN egovernment working group

Transcription

1 Page 1/9 EPAN egovernment working group 10 th of January 2005 PREPARATORY SURVEY Interoperability of egovernment systems The identification number, data sharing and data protection issues Country Ministry or agency Office Web site Sweden The Swedish Agency for Public Management Contact Person Name Göran Ribbegård Address Statskontoret, Fleminggatan 20, Box 8110 SE Stockholm Sweden Telephone Fax goran.ribbegard@statskontoret.se Please fill out and send back before the 24 th of February 2005 to the Centre de Recherche Public - Gabriel Lippmann (see address on the next page)

2 Swedish answer Page 2/9 Introduction to the questionnaire This questionnaire has a twofold objective: The first objective is to update the single identification number part of the study on The electronic identification of citizens and organisations in the European Union: State of affairs, realised by the Belgian Presidency in This aim results from the fact that on the one hand, a 4 years period signifies a long period given the speed of development of ICT, E-Government and the numerous European and national initiatives and projects in these areas. On the other hand, with the entrance of the 10 new member states on the 1 st of May 2004, it is necessary to consider the situation in these countries, and an update of the Belgian study is expedient now. The second general objective of this study is to evaluate the national legislation put in place following the Directive 95/46/EC of the European parliament and the Council from October 24, 1995 on the protection of individuals with regard to the processing of personal data in terms of sharing personal identity data. This part of the questionnaire is limited to all provisions related to the creation and processing of single identification numbers in the member states. We would like to invite those member states who have participated in the "2001"-study to verify their former answers which are available online at the EPAN CIRCA web site and would be obliged if they could refer to this information wherever appropriate. This will allow us to highlight the differences between the situation in 2001 and now. Furthermore, whenever you think that any question can be answered or completed by a document already disposable either online or in any other form, don t hesitate to indicate the according references to us. In case of any problem with this questionnaire, please feel free to contact Centre de Recherche Public Gabriel Lippmann -Department CREDI- Attn. Patrik Hitzelberger 162a, avenue de la Faïencerie L-1511 Luxembourg Tel.: Fax : hitzelbe@crpgl.lu in order to avoid any misunderstandings or problems and to help in the delivering of a good and useful report.

3 Swedish answer Page 3/9 I. Existence of a single identification number If your country has already filled out the 2001 questionnaire (see above), could you please describe, first the evolution of the corresponding subject ever since and then the current situation? We are also interested in obtaining such delta information by the new member states. Does your country have a single identification number: for natural persons? YES for legal persons (companies, associations, foundations, etc.)? YES for technical bodies or units belonging to a larger group or holding? YES : Systems established since long. Only recent change is that registration of legal bodies was moved to a new agency on July 1st 2004: The Swedish Company Registration Office ( Does your country use specific identification numbers in the different sectors of the public administration (tax administration, social security, etc.)? for natural persons? NO for legal persons (companies, associations, foundations, etc.) and other entities, technical bodies or units belonging to a larger group or holding? NO In case there is no national identification number in your country: a) Is there in your opinion any other number that comes close to such a concept (for natural and/or legal persons)? b) What other technical or organisational possibilities are used to map identity information between different public agencies? Are there some plans to change the current situation of identity management in your country and, if so, when and in which way? NO N/A

4 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 4/9 II. Technical aspects of the single identification number Please answer to this part only if a single identification number exists. Could you explain the construction and technical characteristics of the single identification number. In this context we would particularly like you to answer the following questions: a) is it made up of a random series of numbers or does it contain a coding of personal data (such as the sex, year, month, and region of birth of the individual in question, as is the case in some countries)? CODING OF PERSONAL DATA b) does this number never change or can it change over time? If the number changes, what are the reasons for this? RARELY, (CHANGE OF SEX ) N.B.: If your country uses separate single identification numbers for natural persons, legal persons and/or other entities, please answer these questions separately for each type of number. As regards the single identification number for natural persons, what personal data including data regarding civil status is compulsorily and intangibly linked to this single identification number? name; YES first names; YES sex; YES date of birth; YES place of birth; YES domicile; YES other: please specify. Social relations: Spouse, children etc. The Swedish Trade and Industry Register ( The Swedish Trade and Industry Register is an extensive commercial register containing information about all forms of Swedish business enterprise. The register holds all details you need to determine the status of a business. The register can deliver tailored information and can now offer on-line access to our Swedish register through a search function on the Internet web. The information registered is depending on form of business enterprise. There are five main forms of business enterprise that can be registered: Sole trader Trading partnership Limited partnership Limited company Economic association

5 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 5/9 III. Organisational aspects of the single identification number Please answer to this part only if a single identification number exists. The allocation of the single identification number for natural persons: a) to which people is an identification number allocated, and who does not have such a number (children, migrant workers, etc.)? ALL b) when and by which authority is this number allocated? First registration at birth, maternity clinic. Final number allocated and registered at The Swedish National Tax Board. Migrant workers etc. at national registration. c) when is it given to the individual (for instance, only at the age of legal majority as in some countries)? AT BIRTH. What public authority in your country is in charge of the management of the database where the single identification number and the corresponding personal data are centralised? The Swedish National Tax Board. Regarding the processing and transfer of the single identification number: a) Which other central registers (public/private) in your country may access, store and process this number and how is this technically realised? The Swedish population register is administered by the The Swedish National Tax Board. The Swedish Person Address Register (SPAR) holds an excerpt from the national register that is made available electronically to public and private organisations in Sweden. The SPAR register and extracts from this is distributed on commercial basis from InfoTorg ( Access to the SPAR register is managed by a Swedish Government Agency: SPAR-nämnden. b) Which specific documents (e.g. passports, social security cards etc.) that are issued by those registers comprise the national single identification number? IN PRINCIPLE ALL OFFICIAL DOCUMENTS. N.B.: If your country uses separate single identification numbers for natural persons, and/or other bodies, please answer these questions separately for each type of number. For register information on legal bodies The Swedish Trade and Industry Register can deliver tailored information and can offer on-line access to. (

6 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 6/9 IV. Legal issues Which national laws, regulations and administrative provisions were brought into force in your country to comply with article 8.7 of the Directive 95/46/EC of the European parliament and the Council from October 24, 1995 on the protection of individuals with regard to the processing of personal data? Answer: On 24 October 1998 a new act entered into force aimed at preventing the violation of personal integrity by the processing of personal data, namely the Personal Data Act (SFS 1998:204). The Act is based on common rules decided within the EU. The Personal Data Act repeals the Data Act of The Data Act applies for a transitional period as regards personal data processing in progress when the new Act enters into force. In this context, could you please describe succinctly the main provisions and possible restrictions in terms of the creation and/or processing of a national single identification number (or to any other identifier of general interest)? Not relevant for Sweden. Please indicate which authority/ies in your country is/are responsible for monitoring the application of the legislation of data protection, in particularly in the domain of the exchange and processing of data between and by public authorities and other institutions and bodies in the public sector (cf. article 28 of the Directive 95/46/EC)? Answer: The Data Inspection Board is the supervisory authority under the Personal Data Act and may, in that capacity, provide information about the new rules. Information is also available on the Board s website of the Internet: Article 18 of the fore-said Directive 95/46/EC regulates the obligation to notify the supervisory authority (cf. article 28) before carrying out any processing operation of personal data (cf. article 2.b). Article 18.2 allows for exemptions to the notification requirement. Regarding the usage of a single identification number and the exchange of data between administrations making use of this identifier: a) Are those processing operations subject to a general notification requirement in your country? Answer: According to the Personal Data Act, there is a primary obligation to notify all data processing to the supervisory authority, which must maintain a register of the notifications. b) Do exist exemptions to this rule making use of the provisions of article 18.2, especially in terms of the possible appointment of a personal data protection official? Answer: The Government or the Data Inspection Board may issue regulations concerning exemptions from the duty give notice for such kinds of processing as are not likely to result in an improper violation of personal integrity.

7 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 7/9 c) Are those processing operations subject to prior checks as provided in article 20 of the directive? Answer: The Government may issue regulations that particularly sensitive processing must be notified to the supervisory authority for prior examination three weeks in advance. This applies even if a data representative has been appointed. The Directive 95/46/EC guarantees several rights to the "data subjects", hence the person whose data is processed or recorded: an information and notification right (articles 10, 11), an access right (article 12) and a right to object (article 14). a) Could you describe succinctly how those rights are realised in your national legislation? Answer: The controller is liable to provide, free of charge, notification once per calendar year concerning whether personal data relating to a particular person has been processed or not, provided the person so requests. If such data is processed, written information shall be provided about which data concerning the applicant is processed, where the data has been collected, the purpose of the processing and to which recipient or categories of recipients the data is disclosed. b) Regarding the right to access personal related data in general and/or the register(s) where single identification number is stored: Can the concerned person access this data online or in any other way? How is this technically implemented? Answer: An application for information shall be made in writing to the controller and signed by the applicant personally. The information shall be provided within one month from when the application was made. However, if there are special reasons for so doing, the information may be provided not later than four months after the application. If the controller is a public authority, the concerned person would normally have a right to access her own information under the freedom of information regulation. The concerned person has no general right to access data concerning herself if that data is held by a controller other than a public authority.

8 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 8/9 Regarding the transfer, the sharing, the interconnection and the exchange of personal data between public agencies or administrative authorities by using a single identification number: a) Have those to be authorised explicitly by a specific law or any other provision, in particular if the public interest pursued and the purpose for which the data is intended by the different administrations are different? In most cases, exchange of data between agencies is governed by sector specific data protection laws ( database acts ) and regulations. Some agencies and sectors do not have such laws. b) Has the authority responsible for the application of the Data Protection Laws to be asked for comments before giving such an authorisation? Not mandatory. c) When such transfers etc. are cross-border (EU or non-eu), are they subject to specific provisions? No, that would be included in the database laws (except for laws or regulations governing purely international exchanges, such as the Schengen system). Does your national law allow the construction of shared databases if these databases are deployed by public authorities and agencies and data stored includes at the same time common entities recorded/accessed by all organisations and entities restricted to the or those organisation(s) for which these entities are relevant? No If this is the case, can you describe succinctly the provisions, conditions and restrictions applicable in your country regarding this area? Can the single identification number be used a) by private bodies for their internal use? Yes b) in contacts between private bodies and citizens? Yes c) in contacts between private bodies and public administration? Yes

9 egov_study_dsdp_deliverable_ _questionnaire_en_v01 Page 9/9 How do you asset the current legal situation in your country in terms of any legal or regulative hindrances concerning the sharing of identity data? The regulation lacks an overarching information resource perspective. This has resulted in fragmented legislation, and different technical and administrative solutions in different sectors. What are the drivers, legal and others, to increase the sharing of identity data? Financial drivers and the strife for efficiency and better services. Are there any short or mid-term legal or other projects in your country concerning the sharing of identity data? Yes, numerous, with various scopes. Most projects are sector specific. (end of the document)