Region Stockholm requested, pursuant to the obligation to provide information between public authorities, Chapter 6, section 5 of the Public Access to Information and Secrecy Act, that the National Board of Health and Welfare should disclose to the Region certain personal data from the register of healthcare staff. In the case, the question arose as to whether such information was compatible with the so-called principle of finality according to the General Data Protection Regulation (EU) 2016/679. The principle of finality entails that where a contemplated processing of personal data which have already been collected is not covered by the original purpose, an assessment must be made of whether the purpose of the subsequent processing is compatible with the original purposes or not.
The Supreme Administrative Court stated that providing personal data from a register of healthcare staff was compatible with the principle of finality. The obligation to provide information between public authorities in the Public Access to Information and Secrecy Act presupposes that only information that are not subject to secrecy are disclosed, i.e. by virtue of the secrecy provisions, public authorities are prevented from providing privacy-sensitive data to other authorities. Thus, the legislators must be deemed to have adopted a position as to when the provision of data is incompatible with the purpose or purposes for which the data were collected. Over and above the secrecy examination, the public authority which is the controller is thus not to conduct any verification of the compatibility of the principle of finality in connection with the provision of data in accordance with Chapter 6, section 5 of the Public Access to Information and Secrecy Act.
The Supreme Administrative Court stated that the National Board of Health and Welfare was obliged to provide personal data to Region Stockholm in accordance with applicable data protection regulations, e.g. that data in addition to what is required in order to fulfil the needs of the Region may not be provided.
Read the judgment here: