Legal bases for the processing of personal data
In order to process personal data, there must be a clear purpose and a legal basis for the processing.
The most common legal bases for our processing of personal data are contractual obligations, the exercise of official authority and performing tasks in the public interest, legal obligations, weighing of interests and consent.
Contractual obligations
When you as a customer buy a course from us, we enter into a legal agreement and in order for us to fulfil our obligations and administer the course for instance, we need to process your personal data.
Exercise of official authority or tasks in the public interest
This legal basis is common in our school activities and reporting to various authorities such as the Swedish Higher Vocational Education Authority or the Swedish Public Employment Service when we perform authority-like tasks and tasks of public interest, for example when reporting attendance, grading and conferring degrees.
Folkuniversitetet processes personal data to ensure compliance with the rules and conditions for government grants through the Swedish National Council of Adult Education and to meet the requirements of other public contributors. We must, for instance, be able to follow up, evaluate and review the activities of Folkuniversitetet through participant surveys, and we must take part in joint reviews between two or more of the ten study associations in Sweden. In such cases, the processing of personal data is carried out on the legal basis of tasks in the public interest.
Legal obligations
There are laws that require us to process personal data. We must, for instance, save data for a certain amount of time under the Swedish Accounting Act and, under the Swedish Schools Act, our upper secondary schools must submit the final grades for students to the municipality in which the school is located.
Weighing of interests
With the weighing of interests as a legal basis, we can manage personal data, for example, to carry out those parts of our business that are not governed by legislation and agreements. In these cases, the processing of personal data must be necessary for a legitimate purpose and assumes that the data interest of the data subject in the protection of their personal data does not carry more weight.
Consent
Consent is used when there are no other applicable legal bases. The data subject must be able to say no without negative consequences and be able to withdraw their consent at any time.
Want to know more about legal bases? Go to the Swedish Authority for Privacy Protection