{"id":10372,"date":"2024-05-24T11:45:10","date_gmt":"2024-05-24T10:45:10","guid":{"rendered":"https:\/\/www.arbetsgivarjuristen.se\/?p=10372"},"modified":"2025-07-27T14:48:27","modified_gmt":"2025-07-27T13:48:27","slug":"what-the-employer-does-to-comply-with-gdpr","status":"publish","type":"post","link":"https:\/\/staging.lewlex.se\/en\/what-the-employer-does-to-comply-with-gdpr\/","title":{"rendered":"What employers do to comply with GDPR"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Data protection regulations in Sweden<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

There are several reasons why employers should do the right thing when it comes to complying with the GDPR rules. First, the fines can be high, but above all, it is stupid that employees can have a hold on their employer for not following the rules. The Data Protection Regulation consists of 99 articles and 173 reasons. This means that the work with data protection can be done extensively, this text can of course not be exhaustive. But with this guide that you can get through in 10 minutes, you can do it better than most.<\/p>

I hela EU till\u00e4mpas dataskyddsf\u00f6rordningen som stiftades 2016 av Europaparlamentet och Europar\u00e5det. Den b\u00f6rjade g\u00e4lla 2018. Den f\u00f6rordningen tillsammans med den svenska kompletteringslagen (2018:218) till\u00e4mpar vi i Sverige p\u00e5 all behandling av personuppgifter. Det finns fler lagar som reglerar behandling av personuppgifter. Men n\u00e4r det g\u00e4ller arbetsgivares behandling av personuppgifter s\u00e5 \u00e4r det fr\u00e4mst dataskyddsf\u00f6rordningen som till\u00e4mpas, \u00e4ven kallad GDPR (General Data Protection Regulation). Det \u00e4r i princip samma regler som g\u00e4ller f\u00f6r arbetsgivare s\u00e5som f\u00f6retag utan anst\u00e4llda, med n\u00e5got undantag. Det \u00e4r IMY som har till uppgift att kontrollera efterlevnaden av dataskyddsf\u00f6rordningen samt ta emot klagom\u00e5l fr\u00e5n allm\u00e4nheten.<\/span><\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

What is personal data?<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

All information that can identify a currently living person is personal data and is covered by the General Data Protection Regulation. Various pieces of information that can be linked to a person are also considered personal data. For example, photos, personal identification numbers, registration numbers on cars owned by individuals, films, IP addresses and telephone numbers.\u00a0<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Employer's responsibilities<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

De \u00e5tta principerna<\/span><\/h4>

Det finns ett antal principer som arbetsgivaren ska ha som gyllene regler i sin behandling av personuppgifter. Dessa \u00e4r <\/span>laglighet, korrekthet, \u00f6ppenhet, \u00e4ndam\u00e5lsbegr\u00e4nsning, uppgiftsminimering, lagringsminimering, intergritet\/ konfidentialitet och ansvarsskyldighet.<\/span> <\/em>Dessa principer finns f\u00f6rklarade p\u00e5 m\u00e5nga st\u00e4llen. Men i korthet s\u00e5 f\u00e5rpersonuppgifter enbart behandlas med en laglig grund, en av dessa \u00e4r anst\u00e4llningsavtal. Vidare ska de uppgifter som lagras vara korrekta, det ska ske p\u00e5 ett \u00f6ppet och transparent s\u00e4tt, de f\u00e5r enbart behandlas utifr\u00e5n \u00e4ndam\u00e5len, de personuppgifter som behandlas ska utg\u00f6ras av ett minimum i f\u00f6rh\u00e5llande till \u00e4ndam\u00e5let. De ska vidare lagras s\u00e5 kort tid som m\u00f6jligt. Uppgifterna ska skyddas samt s\u00e5 \u00e4r den personuppgiftsansvariga, oftast arbetsgivaren som \u00e4r ansvarig f\u00f6r reglernas efterlevnad.<\/span><\/p>

Plan f\u00f6r inbyggt dataskydd<\/span><\/h4>

Vidare beh\u00f6ver arbetsgivaren ha en tanke med hur denne ska till\u00e4mpa inbyggt dataskydd i sin verksamhet. Det vill s\u00e4ga l\u00e4mpliga tekniska och organisatoriska \u00e5tg\u00e4rder f\u00f6r att underbygga principerna, exempelvis pseudonomyisering. <\/span><\/p>

N\u00e4r du sl\u00e5r in ditt personnummer n\u00e4r du g\u00e5r till tandl\u00e4karen s\u00e5 brukar de fyra sista siffrorna bli fyrkanter. Det \u00e4r ett exempel p\u00e5 hur verksamhetsut\u00f6varen haft en tanke kring inbyggt dataskydd. <\/span><\/p><\/blockquote>

Uppr\u00e4tta personuppgiftsbitr\u00e4desavtal med dina leverant\u00f6rer<\/span><\/h4>

De f\u00f6retag som arbetsgivaren samarbetar med och delar arbetstagarnas personuppgifter med s\u00e5som revisionsbyr\u00e5 eller f\u00f6retagsh\u00e4lsa m\u00e5ste arbetsgivaren uppr\u00e4tta personuppgiftsbitr\u00e4desavtal med.<\/span><\/p>

Register \u00f6ver behandling<\/span><\/h4>

Ett register \u00f6ver hur arbetsgivaren behandlar personuppgifterna beh\u00f6ver uppr\u00e4ttas. Denna ska IMY kunna f\u00e5 ta del av om de efterfr\u00e5gar det. Registret ska bland annat inneh\u00e5ller namn och kontaktuppgifter till arbetsgivaren, vilka uppgifter som behandlas, vilka \u00e4ndam\u00e5l som arbetsgivaren vilar sina sk\u00e4l f\u00f6r behandling p\u00e5 mm.<\/span><\/p>

Plan f\u00f6r att skydda datan<\/span><\/h4>

The employer must have a structure and plan for how they work with the security of the personal data they store.<\/p>

Anm\u00e4lningsplikt vid incidenter<\/span><\/h4>

If an incident occurs, for example a computer is stolen, the incident sometimes needs to be reported to IMY within 72 hours.<\/p>

Konsekvensbed\u00f6mningar vid h\u00f6g risk<\/span><\/h4>

The employer needs to carry out impact assessments if the treatment poses a high risk to the employees and document this. If there is a high risk with the treatment, the employer must consult with IMY.<\/p>

Skyldighet att utse dataskyddsombud vid viss behandling<\/span><\/h4>

There are mainly three different areas that require the employer to appoint a data protection officer. These are if the employer's core business and, due to its nature and purpose, requires regular and systematic monitoring of the data subjects or if the employer processes sensitive personal data on a large scale.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

The nine fundamental rights of the employee<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

Information om behandling och vid incidenter<\/span><\/h4>

When the employee starts work, he has the right to receive information about how the employer will use his personal data. This is why the personal data policy has been created. The information that must be included is stated in Article 13 of the Data Protection Regulation. If the employer receives the employee's information from someone other than the employee, for example a recruitment agency, he also has the right to receive a personal data policy, the content of which is stated in Article 14.<\/p>

Tillg\u00e5ng<\/span><\/h4>

The employee has the right to find out what personal data the employer handles. A so-called register extract. In addition to what personal data is being processed, the employee must also find out what the personal data is used for, how long it will be saved, where it comes from, whether the personal data is shared with someone else, for example an accounting firm, whether the data is used for automated decision-making or profiling, etc. However, this right is not absolute. There are exceptions if, for example, the employee makes the request frequently or if the request would negatively affect the rights and freedoms of other people, which should, however, be rare in a normal workplace. However, there may be such situations, for example to protect whistleblowers.<\/p>

R\u00e4ttelse<\/span><\/h4>

If the personal data is incorrect, the employee has the right to have it corrected and also to have it supplemented if this is consistent with the purpose of the processing.<\/p>

Radering (r\u00e4tten till att bli bortgl\u00f6md)<\/span><\/h4>

There are several conditions that must be met for an employee to have the right to have their data deleted. This may be the case, for example, if the employment has ended and the employer's original purpose for the processing is no longer relevant. However, just because an employment has ended does not mean that there is no basis for having the data deleted for that reason. For example, the employer still needs to be able to administer pensions and store employment contracts.<\/p>

Begr\u00e4nsning av behandling<\/span><\/h4>

Restriction, as it sounds, means that processing is limited to individual areas and purposes. For example, while correction is in progress.<\/p>

Dataportabilitet (att arbetsgivaren skickar vidare uppgifterna)<\/span><\/h4>

\u00a0For example, if the employee changes jobs, the employer is obliged to facilitate the transfer of personal data to the new employer at the employee's request. However, this only applies to data that the employee has provided to the employer and if it is technically possible.<\/p>

Inv\u00e4ndning<\/span><\/h4>

For the majority of the data that the employer processes, it can use the legal basis of a contract. If the employer also applies the legal basis of balancing interests to process individual data for other data, the employee has the right to object to that processing. The employer then has an obligation to demonstrate that his interest outweighs that of the employee, otherwise the processing must cease.<\/p>

Automatiserade beslut<\/span><\/h4>

In the vast majority of cases, automated decisions and profiling based on personal data should not occur within the framework of employees and employers. An exception could be in connection with the employee having saved too many vacation days, where these are paid to the employee. In that case, however, there is an exception if it is necessary to be able to fulfill the fulfillment of a contract, which is the employment contract.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Control of IT systems, camera surveillance and GPS tracking of company cars<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

There is a specific part of employment law around employee privacy that is linked to GDPR. It is in the nature of things that employers sometimes need to monitor the workplace and its employees. The purpose does not have to be to monitor employees to ensure that they behave, but there are usually more legitimate reasons such as safety, work environment or to comply with other laws and regulations, such as GPS in cars in the form of electronic driving logs. But what is important to keep in mind here is that this is also personal data that is covered by the rules.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Specific GDPR rules for employer whistleblower handling<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

The Whistleblower Act (2021:890) contains specific rules regarding the handling of personal data. What stands out is that only those who are authorized to receive, follow up and provide feedback on reports are allowed to have access to the personal data being processed. Access to personal data should be limited to what each person needs to be able to fulfill their job duties. The maximum period for which an employer may store the information is two years.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Data protection rules in collective agreements<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

Collective agreements may contain rules regarding the processing of personal data, both central and local.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

Does it feel big? Start with the privacy policy<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t

Establishing a personal data policy is what I recommend smaller employers start with. It is your outward facade regarding the processing of personal data and what an outsider immediately notices whether you have any thoughts at all regarding the processing of personal data. The second is to document all your considerations. In accordance with the principle of accountability, it is the employer's responsibility to be able to prove to IMY that they comply with the GDPR.<\/p>

Good luck, and don't forget to get in touch if you have any questions.<\/p>

Kind regards,<\/p>

\"\"
Christoffer Lewinowitz
Employer lawyer<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t
\n\t\t\t\t

With us, the first call is free!<\/h2> \n\t\t\t\t\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We believe it should be easy as an employer and manager to do the right thing. The distance to ask for help must be short, which is why an initial consultation is always free with us. We will hear from you within 24 hours.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\n\t\t\t\n\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t