Privacy and personal data

Who can access the data?

Employees at Brå may access the personal data needed to carry out their work, provided that the processing is permitted under the data protection legislation.

Sometimes Brå also needs to share personal data with other government agencies and actors, or disclose data or official documents in accordance with the principle of public access to information. In such cases, disclosure is subject to a confidentiality assessment in accordance with the applicable rules.

Brå uses various IT systems in its operations, which means that it sometimes needs to engage third-party suppliers. The handling of personal data by third-party suppliers on Brå’s behalf is regulated by so-called data processing agreements. Brå is the data controller and determines how the suppliers may process the personal data.

How long is the data stored?

Archival legislation and the National Archives' regulations determine which documents and data are to be preserved or excised. As Brå is a government agency, public documents must be preserved as a general rule.

Brå's processing of personal data in various operations

Statistics

Official crime statistics

Brå is legally responsible for compiling Sweden's official crime statistics. The statistics are based on data that Brå collects from other government agencies and the judicial system.

Compiling these statistics involves handling personal data, such as personal identity numbers, case numbers, court case numbers, offence codes, and gender.

The data is protected by strict confidentiality at Brå. Confidentiality is regulated by Chapter 21, Section 7, and Chapter 24, Section 8, of the Public Access to Information and Secrecy Act. Under certain conditions, and following a confidentiality assessment, data may be disclosed to, for example, research projects where it remains subject to strict confidentiality.

The data is processed on the legal basis of public interest.

Statistical surveys

Brå is responsible for conducting the Swedish Crime Survey (SCS), the School Survey on Crime (SUB), and the Politician's Safety Survey (PTU).

Brå handles the personal data required to conduct the surveys. Information on the processing of personal data is provided to respondents in connection with the surveys.

The data is processed on the legal basis of public interest.

Statistics on hate crime

Brå is responsible for publishing statistics on hate crime and conducting in-depth studies on hate crime. For this purpose, Brå handles personal data obtained from the Swedish Police Authority, in cases that have been designated as hate crimes there.

The data is processed on the legal basis of public interest.

More information

Read more about Brå's statistical activities

Research

Brå is tasked with conducting research. In its research activities, Brå processes personal data collected from registers and directly from individuals through surveys. If the research is based on surveys, information on the processing of personal data is provided to respondents in connection with the surveys.

Brå handles many types of personal data as part of its research activities, including the Police Authority's casenumber, the courts' case numbers, names, personal identity numbers, age, gender, circumstances surrounding crimes committed, and register data from Statistics Sweden.

The data is processed on the legal basis of public interest.

Financial support

Brå allocates financial support to municipalities for local crime prevention, and to various actors for evaluations and follow-ups of crime prevention.

Brå processes the personal data needed to distribute the financial support, such as contact details of the applicants.

The data is processed on the legal basis of public interest.

Conferences and webinars

To organize and conduct conferences, trainings, and webinars, Brå processes personal data of participants. The data may include names, positions, email addresses, workplace postal addresses, and cell phone numbers. Brå also needs to process data on dietary preferences.

The legal basis for the processing is the performance of the contract entered into upon registration.

Visiting Brå

To receive visitors on our premises, Brå processes personal data in the form of names and organisational affiliation.

The data is processed on the legal basis of public interest.

Social media

When communicating through social media, such as LinkedIn and Instagram, Brå processes personal data. This may be names, contact details and positions of employees at Brå, but also other people who appear in the information that Brå communicates.

The data is processed on the legal basis of public interest.

Recruitment

Brå processes personal data contained in job applications as part of its recruitment activities. The personal data is processed in order for Brå to administer the applications and fill the position.

The data is processed on the legal basis of public interest.

Procurement and contracts

Brå processes personal data in connection with procurements and contracts with suppliers. This may include contact details of individuals representing bidders and suppliers.

The data is processed on the legal basis of public interest.

Whistleblowing service

Brå processes personal data as part of its whistleblowing service. This includes the personal data required to receive a report, communicate with the person who made it (unless anonymous), and follow up on the reported matter.

The data is processed on the legal basis of public interest.

Press releases, newsletters, and targeted mailings

Brå processes personal data to manage subscriptions to our press releases, newsletters, and targeted mailings.

The legal basis is the contract entered into upon registration as a subscriber.

Your rights

As a data subject, you have certain rights.

Right to information

This right means that you, subject to certain exemptions, are entitled to clear and transparent information regarding the processing of your personal data.

Right of access to data

The right to access your data, or right of access as it is also called, means that you are generally entitled to receive information about what data Brå processes about you and how the data is used.

Right to rectification

Brå has a responsibility to ensure that the data we process about you is accurate and up to date. The right to rectification means that if you discover that data about you is inaccurate, you have the right to have it corrected without undue delay. You also have the right to supplement any incomplete personal data with relevant information.

Right to erasure

In some cases, you may request the deletion of your personal data. As a general rule, personal data that is necessary for Brå to fulfil its task or that is contained in a public document cannot be deleted.

Right to restriction

In certain cases, for example if you have objected to the processing, you have the possibility to request restriction on the processing of your personal data.

Right to data portability

In certain cases, you have the right to request access to personal data that Brå processes about you to transfer it to another data controller. This only applies if Brå processes your personal data to fulfil a contract or on the basis of consent.

Right to object

When Brå processes personal data to perform tasks in the public interest, you have the right to object to the processing at any time. Brå may only continue the processing if Brå can demonstrate that there are compelling legitimate grounds for processing the data that override the data subject’s interests, rights, and freedoms, or if the processing is carried out for the establishment, exercise, or defence of legal claims.

Right to withdraw consent

You can withdraw any consent you have previously given at any time. However, it does not affect the processing that took place before the withdrawal.

Right to lodge a complaint with a supervisory authority

You can file a complaint with the Swedish Authority for Privacy Protection (IMY) at any time. Information on how to file a complant can be found at their website:

Complain about incorrect processing of your personal data External link.

More information about your rights

You can find more information about your rights on the website of the Swedish Authority for Privacy Protection (IMY):

The rights of data subjects External link.

Data Protection Officer

Brå has a Data Protection Officer. The Data Protection Officer is a support and control function for data protection issues at Brå.

The Data Protection Officer's tasks include providing information on data protection rules, giving advice on data protection, monitoring the government agency's compliance with data protection rules, and acting as a contact person for data subjects and the supervisory authority.

Brå's Data Protection Officer can be reached by email at dataskyddsombud@bra.se