Information on the processing of personal data
SHK’s remit
The Swedish Accident Investigation Authority (SHK) is tasked with investigating all types of serious civilian and military accidents and incidents from a safety perspective, regardless of whether they occur on land, at sea or in the air. The aim of an accident investigation is primarily to answer three questions: What happened? Why did it happen? What can be done to prevent a similar occurrence from happening again in the future or to mitigate the consequences of such an occurrence? In those cases where the occurrence has resulted in an operation involving the emergency services, the investigation will also provide evidence on which to make an assessment of the rescue operation and, if there are grounds to do so, for improvements on the part of the emergency services. SHK’s remit has been established in both act and ordinance.
The purpose of processing personal data
In order to execute our remit, we need to process personal data. The authority is the controller of that processing of personal data. The authority has the legal right to remove, review and obtain documents or objects which can be assumed to be of significance to an investigation. The authority is also entitled to question or interview anyone who is believed able to provide information of importance to the investigation. These interviews are often recorded. SHK may furthermore request that witnesses or experts are examined in court or that a party be ordered to provide documents or objects. However, these options are only used in exceptional cases, and only if someone refuses to participate voluntarily in an interview or to provide the authority with documents or objects.
In our investigative operations, SHK primarily processes personal data pursuant to Article 6 c) and e) of the General Data Protection Regulation
External link. processing that is necessary for compliance with a legal obligation, for performance of a task carried out in the public interest or in the exercise of official authority). Processing in accordance with Article 6 b) may also occur (performance of a contract). Information about “sensitive personal data”, primarily health data, is processed in accordance with Article 9 g) and j) (processing that is necessary for reasons of substantial public interest or for archiving purposes), and in accordance with Chapter 3, Sections 2 and 6 of the Act (2018:218) with Supplementary Provisions concerning the EU General Data Protection Regulation. In exceptional cases, SHK may process personal data on the basis of consent in accordance with Article 6 a) and Article 9 a). In these cases, SHK will request special consent for the processing of personal data for a specific purpose and special information about the processing will be provided.
Where is personal data obtained?
SHK obtains information both directly from the individual (the data subject) and from other government agencies or stakeholders, such as operators and employers. Examples of documents containing personal data and which are regularly obtained for our investigations include licence details, formal qualifications, work schedules, logs and logbooks. There may also be cause to obtain different forms of medical documentation and certificates. Note that these documents are only used for the safety investigation. SHK does not investigate the issue of culpability or liability and has no supervisory role.
Which personal data categories are processed?
The personal data that we process includes information such as name, age and address along with other contact details. There may also be cause to process health data. In addition to the recordings from our own interviews, we also process recordings, for example, from alarm centres, traffic control, aircraft cockpits and ship bridges. We also process photographs and videos, which may feature natural persons.
Data recipient and transfer of personal data to a third country
The data that we obtain in the investigations is primarily only processed by SHK. Only those persons who have been assessed as requiring the data in order to carry out their tasks have access to it. In cases where SHK cooperates with an investigative authority in another country, information from the investigation may come to be shared with that other investigative authority. This is due to SHK’s legal obligation, concerning some of the transport modes, to cooperate and share information with other investigative authorities. This is mainly a matter of collaboration with other EU countries. However, in some cases, it may be necessary to share investigation material with investigative authorities in a third country. If the European Commission has not determined that the country in question ensures an adequate level of protection, an agreement regarding suitable protective measures will be concluded between the investigative authorities prior to transferring and disclosing the personal data. Disclosure of documents is always preceded by a confidentiality assessment, provided that there is no obligation for SHK to provide information in relation to the data recipient.
Retention of personal data
Personal data that is part of official documents is retained in accordance with the provisions of the Archives Act, unless SHK has grounds to return or delete the documents based on certain provisions. Such provisions give SHK grounds to delete audio recordings from various types of traffic control, rescue and alarm services. The same applies to logbooks, documents included in preliminary investigations, digital and analogue photographs, as well as videos and audio recordings from interviews in the investigations. Documents of limited or temporary importance may be deleted following an authority decision once they are no longer necessary for the operation, and they shall then also be erased in accordance with internal procedures.
Rights of the data subject
The data subject is entitled to make a request to SHK for access to, as well as correction and erasure of personal data, or limitation of the processing, or to object to the processing. Such a request shall be examined by SHK. The data subject is also entitled to lodge a complaint with the supervisory authority. As a rule, SHK does not process personal data on the basis of consent. However, if consent has been given, the data subject is entitled to at any time revoke their consent. SHK does not use automated decision-making. Profiling may occur, however. Profiling is used in some instances to analyse and assess factors such as the health, ability to perform and alertness of a natural person in a certain situation. However, no position is founded solely on such processing of personal data. SHK does not process the data collected during an investigation for any purpose other than the safety investigation.
For more information on SHK’s operations, the laws and regulations that govern our activities, as well as our processing of personal information, see www.shk.se External link..
SHK has appointed a Data Protection Officer. As a data subject, you can turn to the Data Protection Officer with any questions relating to the processing of your personal data. The authority’s Data Protection Officer can be reached at dataskyddsombud(at)shk.se or through the authority switchboard.