6.1 What are the data subject’s rights?

One of the main principles of the GDPR is that the data subject shall be given clear information about how his/her personal data are to be processed and clear terms and conditions regarding his/her rights. It is the responsibility of the controller to take appropriate measures to provide the data subject with all the information and communication required under the terms of the GDPR (Art. 13-22 and 34). Such information must be concise, clear and comprehensible and supplied in an easily accessible form using clear and plain language, particularly when specifically addressed to children. The information shall be provided in printed or electronic form.

The data subject has, amongst other rights, the right to:

know the purposes for which his/her personal data are to be processed;
know the name and contact details of the personal data controller and, if relevant, the name of the processor;
know for how long his/her personal data will be processed (as precisely as possible, e.g. for 10 years from the publication of a research paper);
know the details of the personal data to be processed, how they will be processed and to whom (if anyone) they will be passed on. The data subject is entitled to obtain a copy of such data on request and free of charge;
have inaccurate personal data rectified or deleted
have his/her personal data transferred to another person (i.e. data portability), other than in exceptional cases;
object to the processing of his/her data and, on request, to have them restricted;
lodge a complaint about the processing of his/her personal data to the Swedish Authority for Privacy Protection.

In applicable cases, the information shall also contain

the name and contact details of the processor
details of which other party or parties will or might be given access to the data. This is particularly important if the personal data are to be transmitted to a recipient in a third country or an international organisation.

There are some limitations, however, to the rights of the data subject. For example, the controller is not required to inform the data subject of which personal data he/she possesses on the data subject if it is impossible or would require inordinate effort to produce the data (e.g. if the controller only has pseudonymised personal data and no access to a decryption key that can be used to render the data identifiable). The data subject is also not entitled to have his/her personal data deleted if they are necessary for archiving purposes.

6.2 What is meant by sufficient information about the data subject?

The information provided for the data subject must be written in clear and plain language and in printed or other form (e.g. on a website). If the information is addressed to multiple persons, and it is either impossible or inordinately difficult to contact them in person, it is sufficient for the information to be provided in a general declaration or via an accessible website.

6.3 Can you refuse to delete personal data?

The data subject is entitled to request his/her personal data be deleted and/or subject to restricted processing at any time. You do not need, however, to delete pseudonymised data if the decryption key is held elsewhere (e.g. the National Board of Health and Welfare). It is not possible for a data subject to have his/her personal data removed from a scientific study that has been completed and thus archived.