Processing of personal data within Arbetsmarknads- förvaltningen

The purpose of the General Data Protection Regulation is to strengthen the rights of the individual and tighten the requirements for the authority, association or company that processes personal data.

The GDPR also aims to create a uniform and equivalent level of protection of personal data throughout the EU and adapt the regulatory framework to the digital society.

Personal data:

Personal data is any information relating to an identified or identifiable natural person who is alive. A personal data can be, for example, an individual's name, address, telephone number, e-mail address, date of birth and social security number. Pictures, films and audio clips where it is possible to identify someone are also considered personal data, as well as property identifiers. An IP address that can be linked to a living person is also personal data.

Sensitive personal data:

Certain categories of personal data are considered sensitive under the General Data Protection Regulation:

• Ethnic origin
• Political views
• religious or philosophical beliefs
• membership in a trade union;
• health and disease data
• information about a person's sex life or sexual orientation
• genetic or biometric data

There are higher demands on us as data controllers when we process such data. As a general rule, sensitive personal data may not be processed, unless it is necessary for reasons of important public interest that is regulated in, for example, the Education Act and is also proportionate to the purpose pursued. For example, it is permitted to process personal data on ethnicity if it is necessary for the processing of a pupil's mother tongue teaching. It is also permitted for the student health service to process information about a pupil's illness, if this is necessary to carry out their duties within the organisation. Similarly, it is permitted to process data on special diets (e.g. due to allergies) in connection with the serving of school meals, if this is necessary to ensure that the right food is served to the right person.

Treatment of personal data:

The concept of processing of personal data basically includes everything that can be done with personal data. It can be the collection, storage, registration, organization, compilation, transfer and deletion of the data, and more. It is important to keep in mind that a processing is not dependent on it being done on a computer or other digital tool – a processing also includes manual handling where the information is in paper format.

Personal data controller:

The personal data controller is the organization that determines the purpose of the personal data processing, ie the one that decides how the processing will take place and what data will be processed. The personal data controller in this case is the Municipal Executive Board of Labor Market and Upper Secondary School.

Personal data assistant:

In some cases, your child's and/or your personal data will also be processed by a so called personal data assistant. This is about a natural or legal person, authority, agency or other body that processes personal data on our behalf. This may be, for example, a company that delivers an IT system for us as an authority, which is necessary to carry out our business.

A data processor may only process the personal data according to our explicit instructions and is also subject to the requirements of data protection legislation. The instructions are regulated in a so called personal data assistant agreement (PUB agreement).

Registered:

Terms used to describe the person whose data is processed.

Legal basis:

In order for us to process your child's and/or your personal data, a so called legal basis for this is required. Examples of legal grounds are to perform tasks in the public interest, exercise of public authority, contracts or consent.

Sometimes this is also called a legal basis.

We process personal data about the following categories of data subjects: Participants/students, staff within our activities and contact persons at companies, associations, council administrations.

The purpose of our processing is to administer, provide and/or manage:

• job seekers initiative
• Adult education in Swedish for immigrants
• Primary and secondary adult education
• Municipal adult education
• Higher vocational education
• Coordinating holiday jobs for young people
• Activity responsibility for 16-19 year olds who are not in upper secondary education
• Collaboration with internal and external actors e.g. the employment service, employers, etc.
• Social orientation for new arrivals
• Communication
• Work training
• Language traning
• Learning center
• Contract teaching
• Coordination of the councils work with the reception and establishment of new arrivals.
• Study and career guidance
• Archiving (paper and/or digital archives). The job seekers agency uses a digital register (diary) where incoming, outgoing and prepared documents are registered.

Legal basis

The legal bases relevant to the job seekers agency are primarily those that are necessary for the performance of a task carried out in the public interest or are related to the exercise of public authority and legal obligation.

Arranging and conducting job seekers initiatives and training is in many cases a task of public interest due to the requirements set by the council executive board's ordinance and the provisions of the Education Act.

When it comes to legal obligations as a basis, it may be that we must be able to implement education according to the requirements contained in the Education Act – for example, it may be about administering the application for a place in adult education, monitoring compulsory schooling and administering the choice of subjects, courses or study guidance.

When it comes to exercising public authority within our operations, it may concern areas such as grading, testing and validation, special support, action programmes, disciplinary measures and handling and investigating reports of discrimination, harassment and offensive treatment.

Linked to certain activities, the legal basis agreement is also used. It's about when you borrow a computer or tablet. In these cases, you sign an agreement with the council about this.

In some limited cases, it may also be consent. Processing that is done with consent as a legal basis may be when, for example, adult education takes pictures (photo, film or sound recordings) to post on social media to present its activities. In these cases, the school obtains consent from participants/students. Consent as a legal basis concerns those situations where the processing of personal data is not linked to a task for the purpose of completing training and which goes beyond the educational activities regulated in a statute or ordinance, such as the Education Act.

We gain access to the personal data when you contact us, for example by filling in an application form, e-service or contacting us by phone and e-mail. In some cases, we may have access to your information from a third party, such as authorities or other administrations within Arbetsmarknads- och utbildningsförvaltningen.

Information for the municipality's population register is obtained from the Swedish Tax Agency.

• The personal data is mainly retrieved from the population register, Navet (the Swedish Tax Agency's system for distribution of population registration information to public actors, i.e. authorities, municipalities and regions)
• Other internal systems via technical integration
• By updating our administrative staff
• Information you have provided to us

Your personal data may be shared with, for example:

• UHR (Swedish Council for Higher Education)
• CSN (Swedish Board of Student Finance)
• Statistics Sweden (Statistics Sweden)
• Nordea (bank payments)
• Insurance
• Employment
• Other administrations within the council, authorities and in some cases other counties.
• Our personal data assistants (procuring suppliers and their possible subcontractors) who provide our digital systems/services.
• Administrators/administrators within our business
• City Archives (material to be preserved)
• Companies, associations with which we have a collaboration
• Yourself

Note that information may also be disclosed on request in accordance with the principle of public access to official records after a confidentiality assessment.

Collection for publication

We sometimes takes pictures (photo, film) or makes audio recordings to post on social media for the purpose of presenting the business or marketing. In these cases, we obtain the consent of the person.

Transfer third country

We may also share your personal data with a third country provided that it is in accordance with the law and that we need to do so in order to carry out our assignment. In cases where personal data is transferred to countries outside the EU/EEA, this only happens if the country concerned has a so-called adequate level of protection, or if the transfer is subject to appropriate safeguards under the Data Protection Regulation.

Principle of public access to official documents

At Arbetsmarknads- och utbildningsförvaltningen, the so-called principle of public access to official records applies. This means that it is possible to request public documents from us. Such documents are those that, according to the Freedom of the Press Act, have been drawn up or have been received by the authority. Examples of public documents include letters, minutes and decisions. The aim is to provide the public with insight into how public authorities and other public bodies work.

Public documents may contain personal data. When a document is requested, a confidentiality assessment is carried out. This means that certain information may be exempted from the disclosure obligation. This, for example, if the information is deemed to violate someone's privacy. There must always be legal support for us to have the right to classify documents as confidential.

Arbetsmarknads- och utbildningsförvaltningen processes your personal data during the time required to handle the case concerned and/or as long as you are registered in our business.

When the matter in question is completed or when you have completed an education or internship, your information will either be retained or deleted in accordance with the Board's document management plan.

If you have your personal data registered with us, you have a number of rights under the General Data Protection Regulation:

• You have the right to receive information about and access to your personal data.
• You have the right to request correction of incorrect data.
• You also have the opportunity to request completion of incorrect information.
• You have the right to request that your data be deleted, for example if you believe that we are processing the data incorrectly or if there is no legal basis. But this does not apply if it is necessary for us to retain the data, for example to comply with the law or fulfill an agreement we have with you.
• You have the right to request restriction of our processing of your data. In some cases, you can request that the councils processing of your personal data be restricted. This, among other things, if you contest the accuracy of the personal data during the time that the council checks whether they are correct. Or if the processing is unlawful and you oppose deletion. It may also be because the personal data is no longer needed or during the time that the council assesses an objection to processing.
• You have the right to make a data portability request. If the legal basis is consent or agreement, you can request to receive the information you provided in a structured and machine-readable format.
• You have the right to object to the processing of the data. If the processing is based on a balance of interests or public interest, you can object to the processing. The council then has to assess whether the council has compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms or whether it is based on legal claims.

If you want to exercise your rights, please use our e-service for register extracts and other rights under the Data Protection Regulation. Länk till annan webbplats.

If you want to report a personal data breach, you can do so in our e-service for personal data incident Länk till annan webbplats..

If you have questions/concerns or perhaps are not satisfied with how we handle your personal data, you can contact the councils data protection officer dataskyddsombud@lulea.se

You also have the right to turn to the supervisory authority, the Swedish Authority for Privacy Protection (IMY). For more information, see File a complaint under the GDPR (imy.se) Länk till annan webbplats.

Personal data controller

The board of Labor Market and Upper Secondary School is responsible for personal data and the processing of personal data.

Mailing address: Arbetsmarknadsförvaltningen, Luleå Kommun, 971 85 Luleå
Contact via e-mail: agnkansli@lulea.se
Phone: +46(0)920- 45 30 00

Data protection officer

The data protection officer of Luleå council can answer questions regarding the management of personal data. If you have questions or disagree on how we are processing your personal data, please contact dataskyddsombud@lulea.se or by sending a mail to: Dataskyddsombud, Luleå kommun, 971 85 Luleå