Processing of Personal Data

FBA processes personal data for a number of purposes, including providing information about our activities, administering conferences and training programmes, handling matters and cases, registering official documents, responding to enquiries, and recruiting staff, participants and experts. Further information about FBA’s mandate and governing instructions can be found in Ordinance (2024:1026).

Most of the processing of personal data carried out by FBA is based on the legal ground that the processing is necessary for the performance of a task carried out in the public interest. This applies in particular to the tasks that FBA is required to perform under its mandate.

Some processing is based on the legal ground of compliance with a legal obligation. This includes the processing of personal data during recruitment, which must be retained in the event of an appeal.

In certain cases, consent may be applicable as a legal basis. If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time.

FBA’s Data Protection Officer (DPO)

You can contact our Data Protection Officer if you have questions concerning our processing of your personal data or if you wish to exercise your rights, for example by requesting access to your personal data.

Questions concerning the processing of personal data may be addressed to FBA’s Data Protection Officer by email at dataskyddsombud@fba.se, or by post to:

Data Protection Officer

FBA, Folke Bernadotte Academy

Box 270 68

102 51 Stockholm

Sweden

Principle of Public Access to Official Records

FBA is a government agency. Information submitted to us may constitute official records. Personal data may therefore be processed in order to comply with obligations arising from the Freedom of the Press Act, the Public Access to Information and Secrecy Act, and archival legislation. Official records may be disclosed in accordance with the principle of public access to official records unless the information is subject to confidentiality.

Categories of Personal Data Processed

FBA processes personal data such as names, contact details, email correspondence, photographs, participant information relating to training programmes and activities, and, in some cases, travel information, employer, professional role and organisational affiliation.

Processing of Sensitive Personal Data

FBA may occasionally process sensitive personal data. This may include information submitted to the agency or information required in connection with participation in an activity.

Such information is processed only for the purpose for which it was collected. Sensitive personal data is processed on the basis of substantial public interest or, where applicable, consent—for example, in the case of dietary preferences and medical information required in connection with a course or activity.

Retention Period

The length of time personal data is retained varies depending on the purpose for which it is processed. Personal data is retained only for as long as it is necessary for the purposes for which it is processed.

Once a case has been concluded, an assessment is made of which documents must be retained in accordance with archival legislation.

As a government agency, FBA is subject to archival legislation. This requires the agency to preserve official records and to dispose of documents only in accordance with regulations issued by the Swedish National Archives. FBA complies with these rules concerning the preservation and disposal of official records.

Recipients of Personal Data

Only staff members who need access to personal data as part of their work process such data.

Personal data may also be disclosed as a result of the principle of public access to official records.

FBA may, in certain cases, use data processors. Engaged data processors may process personal data only in accordance with the purposes and instructions provided by FBA. These instructions are set out in a data processing agreement. The processor, and anyone acting under the processor’s authority, may never access more information than is necessary to perform the services covered by the agreement.

Personal data may also be disclosed to other government agencies or organisations where this is required by law, regulation or FBA’s mandate.

Transfers to Third Countries

FBA conducts international activities that may involve sharing personal data with international organisations, foreign authorities and other partners. In some cases, this may involve transferring personal data to countries outside the EU/EEA or to international organisations.

Such transfers are made only when necessary to carry out FBA’s mandate and in accordance with the General Data Protection Regulation (GDPR). FBA ensures that there is a legal basis for the transfer and that appropriate safeguards are in place to protect the personal data of data subjects.

Examples of situations in which personal data may be transferred include the secondment or assignment of staff to international organisations, the delivery of international training programmes, conferences and workshops, and cooperation with foreign authorities and organisations.

Your Rights as a Data Subject

You have rights under the General Data Protection Regulation (GDPR). Please note that certain rights, such as the right to erasure and the right to data portability, may be restricted when FBA processes personal data in order to carry out its statutory mandate or comply with legal obligations.

You have the right to:

Obtain confirmation as to whether personal data concerning you is being processed.

• Find out which categories of personal data are being processed.

• Find out the purposes for which the personal data is being processed.

• Request access to your personal data.

• Find out which recipients or categories of recipients the personal data has been or will be disclosed to.

• Where possible, obtain information about the period for which the personal data will be stored.

• Request the rectification or, in certain circumstances, erasure of your personal data and, where the legal requirements are met, receive the transfer of your personal data (data portability).

• Request restriction of the processing of your personal data or object to such processing.

• Receive information about the source from which personal data has been obtained where the data has not been collected directly from you.

You can read more about the General Data Protection Regulation (GDPR) on the website of the Swedish Authority for Privacy Protection (IMY).

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe that FBA is processing your personal data in breach of data protection rules.