2023-05-312022/23:KU35 · p.1KUConstitution
Confidentiality exception in disclosure for technical processing or technical storage of data
Secrecy-breaking rule for outsourcing public authorities' IT operations
What's at stake: The rule determines whether authorities can outsource their IT operations, for instance to cloud services, and thus what protection sensitive personal data receives. It also means that the freedom to communicate information is restricted for those bound by professional secrecy in such outsourcing.
Case texts and AI reasoning are AI-translated from the Swedish originals; the Swedish text is authoritative.
What the vote decides
The question is whether a secrecy-breaking provision should be introduced so that authorities may disclose classified data for technical processing or storage by someone else, or whether shortcomings in authorities' information security must be remedied first.
Yes Yes — the committee proposal
The committee shares the government's assessment that a secrecy-breaking provision should be introduced, since outsourcing or pooling IT operations does carry particular risks but can also give safer and more robust data protection than running it in-house. The committee notes that data may be disclosed only if, after a suitability assessment, it is not inappropriate, and that the restricted freedom to communicate information strengthens protection for the outsourced data, and proposes that the government's bill be adopted and the motion rejected.
No No — the reservations
Reservation 1 (V)
The reservation wants the identified shortcomings in authorities' information security to be remedied before secrecy-breaking rules for outsourced data storage are accepted, pointing to earlier leaks of protected personal data when public bodies stored data with outside providers.
Summarised from the committee report. Party labels in the summary come from the report, not from the vote.
What do the votes mean here?
Yes The committee proposal: adopting the government's legislative proposal and rejecting the motions (keeping things as they are).
No Backing the counter-proposal: reservation 1 by V.
Abstain The party marks a position of its own that is not one of the two final alternatives.
What each plan points to — and how the party voted
For each party: the vote its own election manifesto and party programme point to in this case, next to how the party actually voted. A plan can only point to Yes or No; a party can also abstain.
| Plan | Vote | Confidence | Evidence | ||
|---|---|---|---|---|---|
| V | No | No 0/20/0/4 | follows the plan | confidence: medium | derived |
| S | No | Yes 94/0/0/13 | departs from the plan | confidence: medium | derived |
| MP | No | Yes 16/0/0/2 | departs from the plan | confidence: medium | derived |
| C | No | Yes 19/1/0/4 | departs from the plan | confidence: medium | derived |
| L | No | Yes 13/0/0/3 | departs from the plan | confidence: medium | derived |
| KD | No | Yes 17/0/0/2 | departs from the plan | confidence: medium | derived |
| M | No | Yes 60/0/0/8 | departs from the plan | confidence: low | not addressed |
| SD | No | Yes 62/0/0/10 | departs from the plan | confidence: medium | derived |
Broke with the party line
| CMalin Björk (C, Stockholms kommun) | No — party line: Yes |
MPs whose vote differs from their party's majority position in this division. Marked with a dark ring in the chamber view.
Committee proposal
Parliament adopts the Government's proposal for a law amending the Public Access to Information and Secrecy Act (2009:400). Parliament thus approves proposition 2022/23:97 and rejects motion 2022/23:2376 by Jessica Wetterling et al. (V).
Original (Swedish)
Riksdagen antar regeringens förslag till lag om ändring i offentlighets- och sekretesslagen (2009:400). Därmed bifaller riksdagen proposition 2022/23:97 och avslår motion 2022/23:2376 av Jessica Wetterling m.fl. (V).
Riksdag decision: Parliament approved the Government's proposal for new rules for situations where an authority discloses information for the purpose of technical processing or technical storage of the information with another party. According to the Government's proposal, authorities should be able to disclose information covered by confidentiality to an individual or to an authority that has the task of technically processing or technically storing the information. The proposal also includes a restriction on the freedom to disclose for those subject to confidentiality obligations under the law on confidentiality obligations in outsourcing of technical processing or storage of information. The Government's proposal aims to create better conditions for authorities to outsource or coordinate their IT operations. It also aims to strengthen protection for information disclosed to an individual when outsourcing IT operations. The legislative changes enter into force on 1 July 2023.
Counter-proposals
- The counter-proposal wants identified shortcomings in government agencies' information security to be addressed before secrecy-breaking rules for outsourced data storage are accepted. (V) — Reservation 1
Plan vs actual vote
Every party, in chamber order: what its own plan pointed to, how it voted, and the reasoning behind both. Highlighted rows are where the two differ — but a vote that follows the plan is a result too, so the reasoning is there for every party.
The plan protects personal integrity and a broad private sphere and wants to counter growing registration of data, while viewing privatisations and outsourcing as a threat to the public sector's fundamental idea.
Plan documents: party programme
Reasoning and quotes
The plan protects personal integrity and a broad private sphere and wants to counter growing registration of data, while viewing privatisations and outsourcing as a threat to the public sector's fundamental idea. The counter-proposal's requirement that deficiencies in public authorities' information security be addressed before secrecy is broken for outsourced data storage follows from that. The plan moreover values freedom of information as one of democracy's cornerstones.
Original (Swedish)
Planen slår vakt om den personliga integriteten och en bred privat sfär och vill motverka växande registrering av uppgifter, samtidigt som den ser privatiseringar och entreprenader som ett hot mot den offentliga sektorns grundidé. Motförslagets krav att brister i myndigheternas informationssäkerhet åtgärdas innan sekretessen bryts för utlokaliserad datalagring följer av det. Planen värnar dessutom meddelarfriheten som en av demokratins byggstenar.
- protection of privacyweak support»Alla människor har rätt till en bred privat sfär« (party programme ↗)“All people have the right to a broad private sphere”
- scepticism towards outsourcingdecisive»därför ett allvarligt hot mot den offentliga sektorns grundidé« (party programme ↗)“therefore a serious threat to the public sector's fundamental idea”
- counter registration»och registrering ska motverkas.« (party programme ↗)“and registration must be countered.”
- value freedom of information»föreningsfriheten, yttrande- och tryckfriheten, offentlighetsprincipen« (party programme ↗)“freedom of association, freedom of speech and press, the public access principle”
flags: citat_svagt
The plan chooses public management precisely to prevent sensitive information from falling into the wrong hands, and calls it society's absolute duty to protect personal integrity.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The plan chooses public management precisely to prevent sensitive information from falling into the wrong hands, and calls it society's absolute duty to protect personal integrity. First addressing known gaps in authorities' information security before introducing secrecy-breaking rules for outsourced data storage follows from that principle, especially when protected personal data has previously leaked. The plan also wants to strengthen the ability to withstand cyber attacks and values employees' freedom to speak. The plan therefore supports the requirement.
Original (Swedish)
Planen väljer offentlig regi just för att förhindra att känsliga uppgifter hamnar i fel händer, och kallar det samhällets absoluta skyldighet att skydda den personliga integriteten. Att först åtgärda kända brister i myndigheternas informationssäkerhet innan sekretessbrytande regler för utlokaliserad datalagring införs följer av den principen, särskilt när skyddade personuppgifter tidigare läckt. Planen vill dessutom stärka förmågan att stå emot cyberattacker och värnar de anställdas meddelarfrihet. Planen stöder därför kravet.
- sensitive information under public managementdecisive»att förhindra att känsliga uppgifter hamnar i fel händer, vill vi att 1177 drivs i offentlig regi« (2022 manifesto ↗)“to prevent sensitive information from falling into the wrong hands, we want 1177 to be run under public management”
- protection of personal integrity»Det är samhällets absoluta skyldighet att skydda friheten och den personliga integriteten« (party programme ↗)“It is society's absolute duty to protect freedom and personal integrity”
- strengthened cyber security»Arbetet för att stärka förmågan att stå emot cyberattacker och desinformation ska stärkas.« (2022 manifesto ↗)“The work to strengthen the ability to withstand cyber attacks and disinformation shall be strengthened.”
- protect freedom to speak»De anställdas yttrande- och meddelarfrihet får inte« (party programme ↗)“Employees' freedom of expression and freedom to speak shall not”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan wants to protect people's privacy against both state and commercial actors and requires that freedom of information and the public access principle apply to all publicly funded activity, which speaks against introducing secrecy breaches and restricted freedom of information before shortcomings are remedied.
Plan documents: party programme
Reasoning and quotes
The plan wants to protect people's privacy against both state and commercial actors and requires that freedom of information and the public access principle apply to all publicly funded activity, which speaks against introducing secrecy breaches and restricted freedom of information before shortcomings are remedied. The plan also warns of dependence on large-scale, vulnerable technical infrastructure. Therefore, the plan supports the counter-proposal's demands.
Original (Swedish)
Planen vill värna människors integritet mot både statliga och kommersiella aktörer och kräver att meddelarfrihet och offentlighetsprincip gäller all offentligt finansierad verksamhet, vilket talar mot att införa sekretessgenombrott och inskränkt meddelarfrihet innan bristerna är åtgärdade. Planen varnar också för beroendet av storskalig, sårbar teknisk infrastruktur. Därför stöder planen motförslagets krav.
- privacy against state and companiesdecisive»Vi vill värna människors rätt till integritet och« (party programme ↗)“We want to protect people's right to privacy and”
- freedom of information shall apply»Meddelarfrihet och offentlighetsprincipen ska gälla« (party programme ↗)“Freedom of information and the public access principle shall apply”
- reduce vulnerable large-scale systems»Samhället förlitar sig i dag i alltför hög grad på en« (party programme ↗)“Society today relies to too great an extent on a”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The party programme makes respect for personal integrity a cornerstone and requires that all legislation be tested against its impact on integrity, with protection against both state and private intrusions.
Plan documents: party programme · 2022 manifesto
Reasoning and quotes
The party programme makes respect for personal integrity a cornerstone and requires that all legislation be tested against its impact on integrity, with protection against both state and private intrusions. The counter-proposal requires precisely that identified information security deficiencies be remedied before data can be released to third parties, citing previous leaks of protected personal information. The plan also wishes to strengthen protection for people with protected identity.
Original (Swedish)
Partiprogrammet gör respekten för den personliga integriteten till en grundsten och kräver att all lagstiftning prövas mot sin påverkan på integriteten, med skydd mot både statliga och privata ingrepp. Motförslaget kräver just att konstaterade brister i informationssäkerheten åtgärdas innan uppgifter får lämnas ut till utomstående, med hänvisning till tidigare läckor av skyddade personuppgifter. Planen vill dessutom stärka skyddet för personer med skyddad identitet.
- integrity testing of lawsweak support»All lagstiftning bör prövas mot dess påverkan på människors personliga integritet.« (party programme ↗)“All legislation should be tested against its impact on people's personal integrity.”
- personal integritydecisive»Respekten för den enskildes personliga integritet är en grundsten i varje demokrati.« (party programme ↗)“Respect for the individual's personal integrity is a cornerstone of every democracy.”
- strong integrity protection»Ett starkt integritetsskydd är därför en omistlig del av ett öppet och demokratiskt samhälle.« (party programme ↗)“Strong integrity protection is therefore an indispensable part of an open and democratic society.”
- protection for protected identity»Vi vill bland annat att elektronisk fotboja används oftare och stärka skyddet för familjer med skyddad identitet.« (2022 manifesto ↗)“We want, among other things, electronic tagging to be used more often and strengthen protection for families with protected identity.”
flags: citat_svagt
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan requires that protection of the individual's privacy is strengthened and that privacy-impacting measures are only justified if a conflicting interest clearly outweighs it and the measure is effective.
Plan documents: party programme
Reasoning and quotes
The plan requires that protection of the individual's privacy is strengthened and that privacy-impacting measures are only justified if a conflicting interest clearly outweighs it and the measure is effective. To address known deficiencies in agencies' information security before confidentiality-breaking rules for outsourced data storage are introduced follows from that assessment. The plan also requires that freedom of the press is guaranteed in law, which argues against it being restricted in outsourcing.
Original (Swedish)
Planen kräver att skyddet för den enskildes integritet stärks och att integritetspåverkande åtgärder bara är berättigade om ett motstående intresse väger uppenbart tyngre och åtgärden är effektiv. Att åtgärda kända brister i myndigheternas informationssäkerhet innan sekretessbrytande regler för utlokaliserad datalagring införs följer av den avvägningen. Planen kräver dessutom att meddelarfriheten garanteras i lag, vilket talar mot att den inskränks vid utkontraktering.
- privacy assessment of new rulesdecisive»Åtgärder som påverkar den personliga integriteten negativt är endast berättigade om ett motstående intresse väger uppenbart tyngre och åtgärden är effektiv.« (party programme ↗)“Measures that negatively impact personal privacy are only justified if a conflicting interest clearly outweighs it and the measure is effective.”
- strengthened privacy protection»Skyddet för den enskildes integritet ska stärkas.« (party programme ↗)“Protection of the individual's privacy shall be strengthened.”
- protected freedom of the press»meddelarfriheten för privat personal garanteras i lag« (party programme ↗)“freedom of the press for private personnel is guaranteed in law”
- embraced digitalization»En central princip är därför att alla offentliga funktioner som till en rimlig kostnad kan göras digitalt tillgängliga också ska göras digitalt tillgängliga.« (party programme ↗)“A central principle is therefore that all public functions that can be made digitally accessible at reasonable cost should also be made digitally accessible.”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The plan requires that the public exercise great caution and respect for personal integrity when handling personal data and that integrity have strong constitutional protection.
Plan documents: party programme · 2022 manifesto
Reasoning and quotes
The plan requires that the public exercise great caution and respect for personal integrity when handling personal data and that integrity have strong constitutional protection. To first address known deficiencies in authorities' information security before implementing secrecy-breaking rules for outsourced data storage follows from that caution. The plan also wants to review secrecy rules so information can be shared, but not at the cost of leaked protected information.
Original (Swedish)
Planen kräver att det offentliga tillämpar stor försiktighet och respekt för den personliga integriteten vid hantering av personuppgifter och att integriteten har ett starkt grundlagsskydd. Att först åtgärda kända brister i myndigheternas informationssäkerhet innan sekretessbrytande regler för utlokaliserad datalagring införs följer av den försiktigheten. Planen vill samtidigt se över sekretessreglerna så att uppgifter kan delas, men inte till priset av läckta skyddade uppgifter.
- caution with personal datadecisive»försiktighet och respekt för den personliga integriteten« (party programme ↗)“caution and respect for personal integrity”
- strong privacy protection»Den personliga integriteten ska ha ett starkt« (party programme ↗)“Personal integrity shall have strong”
- review of secrecy rules»Total översyn av sekretessreglerna, så att myndigheter kan dela uppgifter mellan sig för att förebygga och klara upp brott.« (2022 manifesto ↗)“Complete review of secrecy rules, so that authorities can share information with each other to prevent and solve crime.”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The counter-proposal wants deficiencies in authorities' information security to be addressed before secrecy-breaking rules for outsourced data storage are introduced.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The counter-proposal wants deficiencies in authorities' information security to be addressed before secrecy-breaking rules for outsourced data storage are introduced. The plan promises an action plan against hybrid threats and cyberattacks, developed cyber defence and state support to operations exposed to espionage, and the party programme values personal integrity. Outsourcing IT operations is not addressed, so the conclusion is derived and uncertain.
Original (Swedish)
Motförslaget vill att bristerna i myndigheternas informationssäkerhet åtgärdas innan sekretessbrytande regler för utlokaliserad datalagring införs. Planen lovar en handlingsplan mot hybridhot och cyberattacker, utvecklat cyberförsvar och statligt stöd till verksamheter som är utsatta för spionage, och idéprogrammet värnar den personliga integriteten. Utkontraktering av it-drift behandlas inte, varför slutsatsen är härledd och osäker.
- measures against cyber threatsdecisive»Införa en handlingsplan med konkreta åtgärder mot hybridhot och cyberattacker« (2022 manifesto ↗)“Introduce an action plan with concrete measures against hybrid threats and cyberattacks”
- stronger cyber defence»Utveckla cyberförsvaret« (2022 manifesto ↗)“Develop cyber defence”
- protection of security-sensitive operations»Ge företag som är engagerade i säkerhetskänslig verksamhet bättre stöd från staten att kunna möta cyberattacker, spionage och stöldförsök från främmande makt« (2022 manifesto ↗)“Give companies engaged in security-sensitive operations better support from the state to meet cyberattacks, espionage and theft attempts by foreign powers”
- protection of personal data»Den personliga integriteten ska värnas« (party programme ↗)“Personal integrity should be protected”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
The election manifesto demands that society's vulnerability is evaluated better, especially how an increasingly digital society affects exposure, and the party programme states that sectors of strategic and security policy significance should be under strong state control.
Plan documents: 2022 manifesto · party programme
Reasoning and quotes
The election manifesto demands that society's vulnerability is evaluated better, especially how an increasingly digital society affects exposure, and the party programme states that sectors of strategic and security policy significance should be under strong state control. The counter-proposal's demand that deficiencies in agencies' information security be remedied before secrecy-breaking rules for outsourced data storage are introduced follows from that cautionary approach. The plan does not however address secrecy regulations directly, which is why the support is derived.
Original (Swedish)
Valmanifestet kräver att samhällets sårbarhet utvärderas bättre, särskilt hur ett allt mer digitalt samhälle påverkar utsattheten, och partiprogrammet slår fast att sektorer av strategisk och säkerhetspolitisk betydelse bör stå under stark samhällskontroll. Motförslagets krav på att brister i myndigheternas informationssäkerhet åtgärdas innan sekretessbrytande regler för utlokaliserad datalagring införs följer av den försiktighetslinjen. Planen behandlar dock inte sekretessregler direkt, varför stödet är härlett.
- evaluate digital vulnerabilitydecisive»Samhällets sårbarhet behöver bättre utvärderas, inkluderat hur ett allt mer elektrifierat och digitalt samhälle påverkar utsattheten vid en kris eller störning.« (2022 manifesto ↗)“Society's vulnerability needs to be better evaluated, including how an increasingly electrified and digital society affects exposure in a crisis or disruption.”
- state control of critical infrastructure»såsom el- och vattendistributionen, bör stå under stark samhällskontroll« (party programme ↗)“such as electricity and water distribution, should be under strong state control”
- plan for crises»Analysera och planera för olika typer av stora kriser« (2022 manifesto ↗)“Analyze and plan for various types of major crises”
- the precautionary principle»Försiktighetsprincipen är således central inom Sverigedemokraternas miljöpolitik« (party programme ↗)“The precautionary principle is thus central to Sweden Democrats' environmental policy”
The plan takes no explicit position on what the committee actually decided — often because the committee's reason was procedural. The stance is derived and fully cited, but it does not show the party broke a commitment.
Share and embed
Sources and documents
- The committee report on riksdagen.se (2022/23:KU35)
- Committee report full text (HA01KU35)
- Per-MP voting data (API)
- Case status (API)
Documents under consideration
- Motion 2022/23:2376 — med anledning av prop. 2022/23:97 Sekretessgenombrott vid utlämnande för teknisk bearbetning eller teknisk lagring av uppgifter av Jessica Wetterling m.fl. (V)
- Proposition 2022/23:97 — Sekretessgenombrott vid utlämnande för teknisk bearbetning eller teknisk lagring av uppgifter
Source: The Swedish Parliament