Processing of personal data at the Swedish Competition Authority
This information aims to provide general information on the personal data processing for which the Swedish Competition Authority is the data controller. The information also aims to give data subjects guidance on the legal basis for the various processing operations, the rights they have as data subjects, and where they can turn with any questions.
What are personal data?
Personal data mean any information relating to a living person. Examples include name, address, e-mail address, audio recordings and images. A company registration number can be personal data, for instance in the case of sole traders.
What does personal data processing entail?
Processing is a broad term, which means basically any operation that can be performed on personal data. It can for example mean reading, gathering, storing, deleting, aligning or printing data.
The principle of public access to official records
The principle of public access to official records means that each person has the right to access public documents held by an authority. As the Swedish Competition Authority is an authority, messages sent to us become public documents which are normally registered and which can, upon request, be provided to the public. It is important to remember that the data protection rules do not prevent personal data in public documents being provided upon request. However, the authority may find in an assessment that the personal data are covered by secrecy in accordance with the Public Access to Information and Secrecy Act (2009:400). Such an assessment is always made when someone requests public documents.
How the Swedish Competition Authority process personal data
The Swedish Competition Authority gathers the information and data needed to perform its supervisory operations. In this work, personal data are processed. The legal basis for the personal data processing is that it is necessary in the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
The Swedish Competition Authority processes personal data to communicate with the party making a query or providing a tip-off. The legal basis for this processing is that it is necessary in the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Within our research operations, we continuously receive applications and contest entries that must be managed in order to deal with these matters. The legal basis for processing is that it is necessary in the performance of a task carried out in the public interest or in the exercise of official authority vested in us. The personal data processing that occurs as a result of entering into a contract for a research grant is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
The Swedish Competition Authority collaborates in networks and with various entities, both nationally and internationally, and must process contact information related to people within these collaborations in order to communicate with them. The legal basis for processing is that it is necessary for the performance of a task carried out in the public interest.
The Swedish Competition Authority processes personal data in connection with orders for products from the authority’s ordering service. This processing is done to manage the orders and the legal basis for processing is fulfilment of the contract entered into in connection with the order, or it is necessary for the performance of a task carried out in the public interest. In the cases where we charge for the materials, the invoicing information is stored as we have a legal obligation to do so under applicable bookkeeping regulations.
The Swedish Competition Authority processes personal data in connection with the registration of subscriptions to press releases and newsletters. The processing is done to manage the subscription and send out the desired information. The legal basis for the processing is that the subscriber agrees to it and that the Swedish Competition Authority shall have the opportunity to fulfill the agreement entered into in connection with the registration.
The Swedish Competition Authority processes personal data in connection with registration for seminars and conferences organised by the Swedish Competition Authority. The processing is performed to manage the registration and the legal basis for processing is that it is necessary for the performance of a task carried out in the public interest.
The Swedish Competition Authority processes personal data in connection with applications for employment being sent to the Swedish Competition Authority. Such processing is done in order for us to manage the applications and fill vacant positions. The legal basis for processing is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
In connection with purchases and procurement, the Swedish Competition Authority processes personal data in order to communicate and manage the matter and perform contract monitoring. The legal basis for processing of personal data in this context is that it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract or for the performance of a task carried out in the public interest.
The Swedish Competition Authority's entrances are monitored by cameras as part of the authority's security work. The purpose of monitoring is
1) to prevent unauthorised intrusion with the risk of violation of person, property and access to confidential material, and
2) to investigate and prosecute suspected unauthorised intrusion and crime on the Swedish Competition Authority's premises.
Personal data is processed as part of the performance of a task of general interest. Recorded material is stored for 72 hours from the date of recording and then deleted automatically. In the event of an investigation of suspected unauthorised intrusion, some of the recorded material may be stored for as long as necessary.
Those who can receive the personal data are employees of the Swedish Competition Authority and others who need to get them to handle a possible security incident. The information may then be disclosed during a police investigation of a suspected intrusion.
Categories of personal data processed
The Swedish Competition Authority processes only the personal data needed for the purposes stated above. This primarily encompasses the names and contact information of natural persons that appear in matters. If a matter pertains to an organisation of some kind and a contact person has been designated for that organisation, the name and contact information of that contact person is processed.
Period during which personal data are stored
The Swedish Competition Authority does not normally store personal data in a form that enables the identification of data subjects for a longer period than is necessary for the purposes for which the personal data is processed. The Swedish Competition Authority has also an obligation to observe regulations on archiving, which mean that public documents must be stored. The Swedish Competition Authority observes these rules and deletes public documents in accordance with applicable regulations on deletion. Personal data contained in public documents is thus deleted only when the public document can be sort out.
Personal data in documents of temporary or little importance are deleted after reading or after a certain shorter period, which is described in the local deletion decisions of the Swedish Competition Authority.
Your rights
As a data subject, you have a number of rights. These rights mean, in brief, that you have the possibility to request information regarding if, how and when your personal data are processed. To help you keep track of your own data, there is among other things a right to access registered data. In some cases, you can also have your data rectified, object to processing, or have data erased.
Read more on the Swedish Authority for Privacy Protection’s site about the data subject’s rights
If you want to exercise your rights
If you as a data subject at the Swedish Competition Authority want to exercise your rights or have any questions or opinions related to the authority’s processing of your personal data, you can contact the data protection officer of the Swedish Competition Authority.
By e-mail:
dataskyddsombud@kkv.se
Or by mail:
The Data Protection Officer/Dataskyddsombudet
The Swedish Competition Authority/Konkurrensverket
Ringvägen 100
SE-118 60 Stockholm
Sweden
Complaints regarding how we process your personal data
The Swedish Data Protection Authority is responsible for supervising the application of the General Data Protection Regulation in Sweden. If you have any complaints regarding the Swedish Competition Authority’s processing of your personal data, you can present a complaint to the Swedish Data Protection Authority (Swedish site).