Frequently asked questions

No, IMY cannot delete your personal data for you.

A common misunderstanding is that IMY can delete your personal data regardless of where it is processed. This is not the case. IMY only holds data about you if you have interacted with us in some way. For example, if you have submitted a complaint, registered a Data Protection Officer, asked a question or registered for one of our conferences. In order to exercise your right to erasure, you must therefore contact each of the data controllers that processes your data.

Your rights as a data subject

Guides in Swedish:

Har du svårt att få bort uppgifter om dig på sidor med utgivningsbevis?

Rätten att få sökresultat borttagna

Yes, you may be entitled to compensation if you have suffered material or immaterial damages due to your personal data being processed in violation of the General Data Protection Regulation (GDPR). You can request compensation by contacting the data controller directly or by bringing a compensation claim in the appropriate court. IMY cannot help you in claiming compensation.

Your rights to claim compensation (in Swedish)

Damages compensation (Swedish courts)

Personal data shall not be kept longer than necessary for the purposes of the processing. When the purposes of a particular data processing are fulfilled, the main rule is therefore that the data in question should be de-identified or deleted.

The principle of storage limitation is one of the fundamental principles of the General Data Protection Regulation (GDPR).

The GDPR fundamental principles

No, you do not need to notify all personal data breaches to IMY. If the breach is unlikely to result in a risk to the rights and freedoms of natural persons, it does not need to be reported to us. Even if you decide to not notify us, you are however still required to document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.

Personal Data Breach (in Swedish)

Notification of a personal data breach

Yes, in some cases. IMY can request that the search engine delete search results that appear during searches that can be linked to you as a person, for example, your first and last name. This requires that you first have contacted the search engine to request erasure.

If your request has been denied, you can file a complaint with IMY. In some cases, we may initiate supervision. If our supervision concludes that the search engine has not demonstrated that the public interest in the information outweighs your right to have the search results removed, we can request a deletion of the search results.

The right to have search results deleted (in Swedish)  

Our website provides information on what you can do if you want to remove information on social media.

Targeting on social media (in Swedish)

If the post is offensive or harmful, it may be a crime of defamation or insulting behaviour. If you have been the victim of a crime, you may contact the police in order to file a police report.

Yes, it does not matter where the data subject is located in your assessment of whether or not you need to notify the breach to a data protection authority. If you are established in the EU/EEA, the General Data Protection Regulation (GDPR) applies to your processing of personal data. This is regardless of whether the processing takes place in the EU/EEA or not.

Article 3.1 and 33 GDPR

Personal data breaches (in Swedish)