convert_library_version: 'v2 ; Compat Mode: [3] {[< v2++] Handling of the new "fix_count"
  column in order to ADD or SUBTRACT from the counter (replace "skip_count"). Fixed
  the URN writing issue when "skip_count" was true and a "ref_id" was defined.}'
urn: urn:intuitem:risk:library:gdpr
locale: en
ref_id: GDPR
name: General Data Protection Regulation
description: 'REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
  of 27 April 2016 on the protection of natural persons with regard to the processing
  of personal data and on the free movement of such data, and repealing Directive
  95/46/EC (General Data Protection Regulation)

  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679'
copyright: European Union law
version: 2
publication_date: 2025-09-24
provider: EU
packager: intuitem
translations:
  sv:
    name: "allm\xE4n dataskyddsf\xF6rordning"
    description: "EUROPAPARLAMENTETS OCH R\xC5DETS F\xD6RORDNING (EU) 2016/679 av\
      \ den 27 april 2016 om skydd f\xF6r fysiska personer med avseende p\xE5 behandling\
      \ av personuppgifter och om det fria fl\xF6det av s\xE5dana uppgifter och om\
      \ upph\xE4vande av direktiv 95/46/EG (allm\xE4n dataskyddsf\xF6rordning)\nhttps://eur-lex.europa.eu/legal-content/SV/TXT/?uri=CELEX:32016R0679"
objects:
  framework:
    urn: urn:intuitem:risk:framework:gdpr
    ref_id: GDPR
    name: General Data Protection Regulation
    description: 'REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
      of 27 April 2016 on the protection of natural persons with regard to the processing
      of personal data and on the free movement of such data, and repealing Directive
      95/46/EC (General Data Protection Regulation)

      https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679'
    translations:
      sv:
        name: "allm\xE4n dataskyddsf\xF6rordning"
        description: "EUROPAPARLAMENTETS OCH R\xC5DETS F\xD6RORDNING (EU) 2016/679\
          \ av den 27 april 2016 om skydd f\xF6r fysiska personer med avseende p\xE5\
          \ behandling av personuppgifter och om det fria fl\xF6det av s\xE5dana uppgifter\
          \ och om upph\xE4vande av direktiv 95/46/EG (allm\xE4n dataskyddsf\xF6rordning)\n\
          https://eur-lex.europa.eu/legal-content/SV/TXT/?uri=CELEX:32016R0679"
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:gdpr:preambule
      assessable: false
      depth: 1
      ref_id: Preambule
      translations:
        sv:
          name: Preambule
    - urn: urn:intuitem:risk:req_node:gdpr:recital-1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 1
      description: "The protection of natural persons in relation to the processing\
        \ of personal data is a fundamental right. Article 8(1) of the Charter of\
        \ Fundamental Rights of the European Union (the \u2018Charter\u2019) and Article\
        \ 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide\
        \ that everyone has the right to the protection of personal data concerning\
        \ him or her."
      translations:
        sv:
          name: "Sk\xE4l 1"
          description: "Skyddet f\xF6r fysiska personer vid behandling av personuppgifter\
            \ \xE4r en grundl\xE4ggande r\xE4ttighet. Artikel 8.1 i Europeiska unionens\
            \ stadga om de grundl\xE4ggande r\xE4ttigheterna (nedan kallad\_stadgan)\
            \ och artikel 16.1 i f\xF6rdraget om Europeiska unionens funktionss\xE4\
            tt (EUF-f\xF6rdraget) f\xF6reskriver att var och en har r\xE4tt till skydd\
            \ av de personuppgifter som r\xF6r honom eller henne."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 2
      description: The principles of, and rules on the protection of natural persons
        with regard to the processing of their personal data should, whatever their
        nationality or residence, respect their fundamental rights and freedoms, in
        particular their right to the protection of personal data. This Regulation
        is intended to contribute to the accomplishment of an area of freedom, security
        and justice and of an economic union, to economic and social progress, to
        the strengthening and the convergence of the economies within the internal
        market, and to the well-being of natural persons.
      translations:
        sv:
          name: "Sk\xE4l 2"
          description: "Principerna och reglerna f\xF6r skyddet f\xF6r fysiska personer\
            \ vid behandling av deras personuppgifter b\xF6r, oavsett deras medborgarskap\
            \ eller hemvist, respektera deras grundl\xE4ggande r\xE4ttigheter och\
            \ friheter, s\xE4rskilt deras r\xE4tt till skydd av personuppgifter. Avsikten\
            \ med denna f\xF6rordning \xE4r att bidra till att skapa ett omr\xE5de\
            \ med frihet, s\xE4kerhet och r\xE4ttvisa och en ekonomisk union, till\
            \ ekonomiska och sociala framsteg, till f\xF6rst\xE4rkning och konvergens\
            \ av ekonomierna inom den inre marknaden samt till fysiska personers v\xE4\
            lbefinnande."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 3
      description: Directive 95/46/EC of the European Parliament and of the Council
        (4) seeks to harmonise the protection of fundamental rights and freedoms of
        natural persons in respect of processing activities and to ensure the free
        flow of personal data between Member States.
      translations:
        sv:
          name: "Sk\xE4l 3"
          description: "Europaparlamentets och r\xE5dets direktiv 95/46/EG\_(4)\_\
            syftar till att harmonisera skyddet av fysiska personers grundl\xE4ggande\
            \ r\xE4ttigheter och friheter vid behandling av personuppgifter och att\
            \ s\xE4kerst\xE4lla det fria fl\xF6det av personuppgifter mellan medlemsstaterna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 4
      description: The processing of personal data should be designed to serve mankind.
        The right to the protection of personal data is not an absolute right; it
        must be considered in relation to its function in society and be balanced
        against other fundamental rights, in accordance with the principle of proportionality.
        This Regulation respects all fundamental rights and observes the freedoms
        and principles recognised in the Charter as enshrined in the Treaties, in
        particular the respect for private and family life, home and communications,
        the protection of personal data, freedom of thought, conscience and religion,
        freedom of expression and information, freedom to conduct a business, the
        right to an effective remedy and to a fair trial, and cultural, religious
        and linguistic diversity.
      translations:
        sv:
          name: "Sk\xE4l 4"
          description: "Behandlingen av personuppgifter b\xF6r utformas s\xE5 att\
            \ den tj\xE4nar m\xE4nniskor. R\xE4tten till skydd av personuppgifter\
            \ \xE4r inte en absolut r\xE4ttighet; den m\xE5ste f\xF6rst\xE5s utifr\xE5\
            n sin uppgift i\_samh\xE4llet och v\xE4gas mot andra grundl\xE4ggande\
            \ r\xE4ttigheter i enlighet med proportionalitetsprincipen. Denna f\xF6\
            rordning respekterar alla grundl\xE4ggande r\xE4ttigheter och iakttar\
            \ de friheter och principer som erk\xE4nns i stadgan, s\xE5som de fastst\xE4\
            llts i f\xF6rdragen, s\xE4rskilt skydd f\xF6r privat- och familjeliv,\
            \ bostad och kommunikationer, skydd av personuppgifter, tankefrihet, samvetsfrihet\
            \ och religionsfrihet, yttrande- och informationsfrihet, n\xE4ringsfrihet,\
            \ r\xE4tten till ett effektivt r\xE4ttsmedel och en opartisk domstol samt\
            \ kulturell, religi\xF6s och spr\xE5klig m\xE5ngfald."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 5
      description: The economic and social integration resulting from the functioning
        of the internal market has led to a substantial increase in cross-border flows
        of personal data. The exchange of personal data between public and private
        actors, including natural persons, associations and undertakings across the
        Union has increased. National authorities in the Member States are being called
        upon by Union law to cooperate and exchange personal data so as to be able
        to perform their duties or carry out tasks on behalf of an authority in another
        Member State.
      translations:
        sv:
          name: "Sk\xE4l 5"
          description: "Den ekonomiska och sociala integration som uppst\xE5tt tack\
            \ vare den inre marknaden har lett till en betydande \xF6kning av de gr\xE4\
            ns\xF6verskridande fl\xF6dena av personuppgifter. Utbytet av personuppgifter\
            \ mellan offentliga och privata akt\xF6rer, inbegripet fysiska personer,\
            \ sammanslutningar och f\xF6retag, \xF6ver hela unionen har \xF6kat. Nationella\
            \ myndigheter i\_medlemsstaterna uppmanas i unionsr\xE4tten att samarbeta\
            \ och utbyta personuppgifter f\xF6r att vara i st\xE5nd att fullg\xF6\
            ra sina uppdrag eller utf\xF6ra arbetsuppgifter f\xF6r en myndighet som\
            \ finns i en annan medlemsstat."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 6
      description: Rapid technological developments and globalisation have brought
        new challenges for the protection of personal data. The scale of the collection
        and sharing of personal data has increased significantly. Technology allows
        both private companies and public authorities to make use of personal data
        on an unprecedented scale in order to pursue their activities. Natural persons
        increasingly make personal information available publicly and globally. Technology
        has transformed both the economy and social life, and should further facilitate
        the free flow of personal data within the Union and the transfer to third
        countries and international organisations, while ensuring a high level of
        the protection of personal data.
      translations:
        sv:
          name: "Sk\xE4l 6"
          description: "Den snabba tekniska utvecklingen och globaliseringen har skapat\
            \ nya utmaningar vad g\xE4ller skyddet av personuppgifter. Omfattningen\
            \ av insamling och delning av personuppgifter har \xF6kat avsev\xE4rt.\
            \ Tekniken g\xF6r det m\xF6jligt f\xF6r b\xE5de privata f\xF6retag och\
            \ offentliga myndigheter att i sitt arbete anv\xE4nda sig av personuppgifter\
            \ i en helt ny omfattning. Allt fler fysiska personer g\xF6r sina personliga\
            \ uppgifter allm\xE4nt tillg\xE4ngliga, v\xE4rlden \xF6ver. Tekniken har\
            \ omvandlat b\xE5de ekonomin och det sociala livet, och b\xF6r ytterligare\
            \ underl\xE4tta det fria fl\xF6det av personuppgifter inom unionen samt\
            \ \xF6verf\xF6ringar till tredjel\xE4nder och internationella organisationer,\
            \ samtidigt som en h\xF6g skyddsniv\xE5 s\xE4kerst\xE4lls f\xF6r personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-7
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 7
      description: Those developments require a strong and more coherent data protection
        framework in the Union, backed by strong enforcement, given the importance
        of creating the trust that will allow the digital economy to develop across
        the internal market. Natural persons should have control of their own personal
        data. Legal and practical certainty for natural persons, economic operators
        and public authorities should be enhanced
      translations:
        sv:
          name: "Sk\xE4l 7"
          description: "Dessa f\xF6r\xE4ndringar kr\xE4ver en stark och mer sammanh\xE4\
            ngande ram f\xF6r dataskyddet inom unionen, uppbackad av kraftfullt tillsynsarbete,\
            \ eftersom det \xE4r viktigt att skapa den tillit som beh\xF6vs f\xF6\
            r att utveckla den digitala ekonomin \xF6ver hela den inre marknaden.\
            \ Fysiska personer b\xF6r ha kontroll \xF6ver sina egna personuppgifter.\
            \ Den r\xE4ttsliga s\xE4kerheten och smidigheten f\xF6r fysiska personer,\
            \ ekonomiska operat\xF6rer och myndigheter b\xF6r st\xE4rkas."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-8
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 8
      description: Where this Regulation provides for specifications or restrictions
        of its rules by Member State law, Member States may, as far as necessary for
        coherence and for making the national provisions comprehensible to the persons
        to whom they apply, incorporate elements of this Regulation into their national
        law.
      translations:
        sv:
          name: "Sk\xE4l 8"
          description: "Om denna f\xF6rordning f\xF6reskriver f\xF6rtydliganden eller\
            \ begr\xE4nsningar av dess best\xE4mmelser genom medlemsstaternas nationella\
            \ r\xE4tt, kan medlemsstaterna, i den utstr\xE4ckning det \xE4r n\xF6\
            dv\xE4ndigt f\xF6r samst\xE4mmigheten och f\xF6r att g\xF6ra de nationella\
            \ best\xE4mmelserna begripliga f\xF6r de personer som de till\xE4mpas\
            \ p\xE5, inf\xF6rliva delar av denna f\xF6rordning i nationell r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-9
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 9
      description: The objectives and principles of Directive 95/46/EC remain sound,
        but it has not prevented fragmentation in the implementation of data protection
        across the Union, legal uncertainty or a widespread public perception that
        there are significant risks to the protection of natural persons, in particular
        with regard to online activity. Differences in the level of protection of
        the rights and freedoms of natural persons, in particular the right to the
        protection of personal data, with regard to the processing of personal data
        in the Member States may prevent the free flow of personal data throughout
        the Union. Those differences may therefore constitute an obstacle to the pursuit
        of economic activities at the level of the Union, distort competition and
        impede authorities in the discharge of their responsibilities under Union
        law. Such a difference in levels of protection is due to the existence of
        differences in the implementation and application of Directive 95/46/EC.
      translations:
        sv:
          name: "Sk\xE4l 9"
          description: "M\xE5len och principerna f\xF6r direktiv 95/46/EG \xE4r fortfarande\
            \ giltiga, men det har inte kunnat f\xF6rhindra bristande enhetlighet\
            \ i genomf\xF6randet av dataskyddet i\_olika delar av unionen, r\xE4ttsos\xE4\
            kerhet eller allm\xE4nt spridda uppfattningar om att betydande risker\
            \ kvarst\xE5r f\xF6r fysiska personer, s\xE4rskilt med avseende p\xE5\
            \ anv\xE4ndning av internet. Skillnader i niv\xE5n p\xE5 skyddet av fysiska\
            \ personers r\xE4ttigheter och friheter, s\xE4rskilt r\xE4tten till skydd\
            \ av personuppgifter, vid behandling av personuppgifter i olika medlemsstater\
            \ kan f\xF6rhindra det fria fl\xF6det av personuppgifter \xF6ver hela\
            \ unionen. Dessa skillnader kan d\xE4rf\xF6r utg\xF6ra ett hinder f\xF6\
            r att bedriva ekonomisk verksamhet p\xE5 unionsniv\xE5, de kan snedvrida\
            \ konkurrensen och hindra myndigheterna att fullg\xF6ra sina skyldigheter\
            \ enligt unionsr\xE4tten. De varierande skyddsniv\xE5erna beror p\xE5\
            \ skillnader i genomf\xF6randet och till\xE4mpningen av direktiv\_95/46/EG."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-10
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 10
      description: "In order to ensure a consistent and high level of protection of\
        \ natural persons and to remove the obstacles to flows of personal data within\
        \ the Union, the level of protection of the rights and freedoms of natural\
        \ persons with regard to the processing of such data should be equivalent\
        \ in all Member States. Consistent and homogenous application of the rules\
        \ for the protection of the fundamental rights and freedoms of natural persons\
        \ with regard to the processing of personal data should be ensured throughout\
        \ the Union. Regarding the processing of personal data for compliance with\
        \ a legal obligation, for the performance of a task carried out in the public\
        \ interest or in the exercise of official authority vested in the controller,\
        \ Member States should be allowed to maintain or introduce national provisions\
        \ to further specify the application of the rules of this Regulation. In conjunction\
        \ with the general and horizontal law on data protection implementing Directive\
        \ 95/46/EC, Member States have several sector-specific laws in areas that\
        \ need more specific provisions. This Regulation also provides a margin of\
        \ manoeuvre for Member States to specify its rules, including for the processing\
        \ of special categories of personal data (\u2018sensitive data\u2019). To\
        \ that extent, this Regulation does not exclude Member State law that sets\
        \ out the circumstances for specific processing situations, including determining\
        \ more precisely the conditions under which the processing of personal data\
        \ is lawful."
      translations:
        sv:
          name: "Sk\xE4l 10"
          description: "F\xF6r att s\xE4kra en enhetlig och h\xF6g skyddsniv\xE5 f\xF6\
            r fysiska personer och f\xF6r att undanr\xF6ja hindren f\xF6r fl\xF6dena\
            \ av personuppgifter inom unionen b\xF6r niv\xE5n p\xE5 skyddet av fysiska\
            \ personers r\xE4ttigheter och friheter vid behandling av personuppgifter\
            \ vara likv\xE4rdig i alla medlemsstater. En konsekvent och enhetlig till\xE4\
            mpning av best\xE4mmelserna om skydd av fysiska personers grundl\xE4ggande\
            \ r\xE4ttigheter och friheter vid behandling av personuppgifter b\xF6\
            r s\xE4kerst\xE4llas i hela unionen. Vad g\xE4ller behandlingen av personuppgifter\
            \ f\xF6r att fullg\xF6ra en r\xE4ttslig f\xF6rpliktelse, f\xF6r att utf\xF6\
            ra en uppgift av allm\xE4nt intresse eller som ett led i\_myndighetsut\xF6\
            vning som utf\xF6rs av den personuppgiftsansvarige, b\xF6r medlemsstaterna\
            \ till\xE5tas att beh\xE5lla eller inf\xF6ra nationella best\xE4mmelser\
            \ f\xF6r att n\xE4rmare fastst\xE4lla hur best\xE4mmelserna i denna f\xF6\
            rordning ska till\xE4mpas. J\xE4mte den allm\xE4nna och \xF6vergripande\
            \ lagstiftning om dataskydd varigenom direktiv 95/46/EG genomf\xF6rs har\
            \ medlemsstaterna flera sektorsspecifika lagar p\xE5 omr\xE5den som kr\xE4\
            ver mer specifika best\xE4mmelser. Denna f\xF6rordning ger dessutom medlemsstaterna\
            \ handlingsutrymme att specificera sina best\xE4mmelser, \xE4ven f\xF6\
            r behandlingen av s\xE4rskilda kategorier av personuppgifter (nedan kallade\_\
            k\xE4nsliga uppgifter). Denna f\xF6rordning utesluter inte att det i medlemsstaternas\
            \ nationella r\xE4tt fastst\xE4lls n\xE4rmare omst\xE4ndigheter f\xF6\
            r specifika situationer d\xE4r uppgifter behandlas, inbegripet mer exakta\
            \ villkor f\xF6r laglig behandling av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-11
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 11
      description: Effective protection of personal data throughout the Union requires
        the strengthening and setting out in detail of the rights of data subjects
        and the obligations of those who process and determine the processing of personal
        data, as well as equivalent powers for monitoring and ensuring compliance
        with the rules for the protection of personal data and equivalent sanctions
        for infringements in the Member States.
      translations:
        sv:
          name: "Sk\xE4l 11"
          description: "Ett effektivt skydd av personuppgifter \xF6ver hela unionen\
            \ f\xF6ruts\xE4tter att de registrerades r\xE4ttigheter f\xF6rst\xE4rks\
            \ och specificeras och att de personuppgiftsansvarigas och personuppgiftsbitr\xE4\
            denas skyldigheter vid behandling av personuppgifter klarg\xF6rs, samt\
            \ att det finns likv\xE4rdiga befogenheter f\xF6r \xF6vervakning och att\
            \ det s\xE4kerst\xE4lls att reglerna f\xF6r skyddet av personuppgifter\
            \ efterlevs och att sanktionerna f\xF6r \xF6vertr\xE4delser \xE4r likv\xE4\
            rdiga i medlemsstaterna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-12
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 12
      description: Article 16(2) TFEU mandates the European Parliament and the Council
        to lay down the rules relating to the protection of natural persons with regard
        to the processing of personal data and the rules relating to the free movement
        of personal data.
      translations:
        sv:
          name: "Sk\xE4l 12"
          description: "I artikel 16.2 i EUF-f\xF6rdraget bemyndigas Europaparlamentet\
            \ och r\xE5det att fastst\xE4lla best\xE4mmelser om skydd f\xF6r fysiska\
            \ personer n\xE4r det g\xE4ller behandling av personuppgifter och best\xE4\
            mmelser om den fria r\xF6rligheten f\xF6r personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-13
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 13
      description: In order to ensure a consistent level of protection for natural
        persons throughout the Union and to prevent divergences hampering the free
        movement of personal data within the internal market, a Regulation is necessary
        to provide legal certainty and transparency for economic operators, including
        micro, small and medium-sized enterprises, and to provide natural persons
        in all Member States with the same level of legally enforceable rights and
        obligations and responsibilities for controllers and processors, to ensure
        consistent monitoring of the processing of personal data, and equivalent sanctions
        in all Member States as well as effective cooperation between the supervisory
        authorities of different Member States. The proper functioning of the internal
        market requires that the free movement of personal data within the Union is
        not restricted or prohibited for reasons connected with the protection of
        natural persons with regard to the processing of personal data. To take account
        of the specific situation of micro, small and medium-sized enterprises, this
        Regulation includes a derogation for organisations with fewer than 250 employees
        with regard to record-keeping. In addition, the Union institutions and bodies,
        and Member States and their supervisory authorities, are encouraged to take
        account of the specific needs of micro, small and medium-sized enterprises
        in the application of this Regulation. The notion of micro, small and medium-sized
        enterprises should draw from Article 2 of the Annex to Commission Recommendation
        2003/361/EC (1).
      translations:
        sv:
          name: "Sk\xE4l 13"
          description: "F\xF6r att s\xE4kerst\xE4lla en enhetlig niv\xE5 f\xF6r skyddet\
            \ av fysiska personer \xF6ver hela unionen och undvika avvikelser som\
            \ hindrar den fria r\xF6rligheten av personuppgifter inom den inre marknaden\
            \ beh\xF6vs en f\xF6rordning som skapar r\xE4ttslig s\xE4kerhet och \xF6\
            ppenhet f\xF6r ekonomiska akt\xF6rer, d\xE4ribland mikrof\xF6retag samt\
            \ sm\xE5 och medelstora f\xF6retag, och som ger fysiska personer i alla\
            \ medlemsstater samma r\xE4ttsligt verkst\xE4llbara r\xE4ttigheter och\
            \ skyldigheter samt \xE5l\xE4gger personuppgiftsansvariga och personuppgiftsbitr\xE4\
            den samma ansvar, s\xE5 att \xF6vervakningen av behandling av personuppgifter\
            \ blir enhetlig, sanktionerna i\_alla medlemsstater likv\xE4rdiga och\
            \ samarbetet mellan tillsynsmyndigheterna i olika medlemsstater effektivt.\
            \ F\xF6r att den inre marknaden ska fungera v\xE4l kr\xE4vs att det fria\
            \ fl\xF6det av personuppgifter inom unionen inte begr\xE4nsas eller f\xF6\
            rbjuds av sk\xE4l som har anknytning till skydd f\xF6r fysiska personer\
            \ med avseende p\xE5 behandling av personuppgifter. F\xF6r att ta h\xE4\
            nsyn till mikrof\xF6retagens samt de sm\xE5 och medelstora f\xF6retagens\
            \ s\xE4rskilda situation inneh\xE5ller denna f\xF6rordning ett undantag\
            \ f\xF6r organisationer som syssels\xE4tter f\xE4rre\_\xE4n\_250\_personer\
            \ med avseende p\xE5 registerf\xF6ring. Dessutom uppmanas unionens institutioner\
            \ och organ samt medlemsstaterna och deras tillsynsmyndigheter att vid\
            \ till\xE4mpningen av denna f\xF6rordning ta h\xE4nsyn till mikrof\xF6\
            retagens samt de sm\xE5 och medelstora f\xF6retagens s\xE4rskilda behov.\
            \ Begreppen mikrof\xF6retag samt sm\xE5 och medelstora f\xF6retag b\xF6\
            r bygga p\xE5 artikel 2 i bilagan till kommissionens\_rekommendation 2003/361/EG\_\
            (5)."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-14
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 14
      description: The protection afforded by this Regulation should apply to natural
        persons, whatever their nationality or place of residence, in relation to
        the processing of their personal data. This Regulation does not cover the
        processing of personal data which concerns legal persons and in particular
        undertakings established as legal persons, including the name and the form
        of the legal person and the contact details of the legal person
      translations:
        sv:
          name: "Sk\xE4l 14"
          description: "Det skydd som ska tillhandah\xE5llas enligt denna f\xF6rordning\
            \ b\xF6r till\xE4mpas p\xE5 fysiska personer, oavsett medborgarskap eller\
            \ hemvist, med avseende p\xE5 behandling av deras personuppgifter. Denna\
            \ f\xF6rordning omfattar inte behandling av personuppgifter r\xF6rande\
            \ juridiska personer, s\xE4rskilt f\xF6retag som bildats som juridiska\
            \ personer, exempelvis uppgifter om namn p\xE5 och typ av juridisk person\
            \ samt kontaktuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-15
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 15
      description: In order to prevent creating a serious risk of circumvention, the
        protection of natural persons should be technologically neutral and should
        not depend on the techniques used. The protection of natural persons should
        apply to the processing of personal data by automated means, as well as to
        manual processing, if the personal data are contained or are intended to be
        contained in a filing system. Files or sets of files, as well as their cover
        pages, which are not structured according to specific criteria should not
        fall within the scope of this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 15"
          description: "F\xF6r att f\xF6rhindra att det uppst\xE5r en allvarlig risk\
            \ f\xF6r att reglerna kringg\xE5s b\xF6r skyddet f\xF6r fysiska personer\
            \ vara teknikneutralt och inte vara beroende av den teknik som anv\xE4\
            nds. Skyddet f\xF6r fysiska personer b\xF6r vara till\xE4mpligt p\xE5\
            \ b\xE5de automatiserad och manuell behandling av personuppgifter, om\
            \ personuppgifterna ing\xE5r i eller \xE4r avsedda att ing\xE5 i ett register.\
            \ Akter eller grupper av akter samt omslag till dessa, som inte \xE4r\
            \ ordnade enligt s\xE4rskilda kriterier, b\xF6r inte omfattas av denna\
            \ f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-16
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 16
      description: This Regulation does not apply to issues of protection of fundamental
        rights and freedoms or the free flow of personal data related to activities
        which fall outside the scope of Union law, such as activities concerning national
        security. This Regulation does not apply to the processing of personal data
        by the Member States when carrying out activities in relation to the common
        foreign and security policy of the Union.
      translations:
        sv:
          name: "Sk\xE4l 16"
          description: "Denna f\xF6rordning \xE4r inte till\xE4mplig p\xE5 fr\xE5\
            gor som r\xF6r skyddet av grundl\xE4ggande r\xE4ttigheter och friheter\
            \ eller det fria fl\xF6det av personuppgifter p\xE5 omr\xE5den som inte\
            \ omfattas av unionsr\xE4tten, s\xE5som verksamhet r\xF6rande nationell\
            \ s\xE4kerhet. Denna f\xF6rordning \xE4r inte till\xE4mplig p\xE5 medlemsstaternas\
            \ behandling av personuppgifter n\xE4r de agerar inom ramen f\xF6r unionens\
            \ gemensamma utrikes- och s\xE4kerhetspolitik."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-17
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 17
      description: Regulation (EC) No 45/2001 of the European Parliament and of the
        Council (2) applies to the processing of personal data by the Union institutions,
        bodies, offices and agencies. Regulation (EC) No 45/2001 and other Union legal
        acts applicable to such processing of personal data should be adapted to the
        principles and rules established in this Regulation and applied in the light
        of this Regulation. In order to provide a strong and coherent data protection
        framework in the Union, the necessary adaptations of Regulation (EC) No 45/2001
        should follow after the adoption of this Regulation, in order to allow application
        at the same time as this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 17"
          description: "Europaparlamentets och r\xE5dets f\xF6rordning (EG) nr\_45/2001\_\
            (6)\_\xE4r till\xE4mplig p\xE5 den behandling av personuppgifter som sker\
            \ i unionens institutioner, organ och byr\xE5er. F\xF6rordning (EG) nr\_\
            45/2001 och de av unionens \xF6vriga r\xE4ttsakter som \xE4r till\xE4\
            mpliga p\xE5 s\xE5dan behandling av personuppgifter b\xF6r anpassas till\
            \ principerna och best\xE4mmelserna i\_den h\xE4r f\xF6rordningen och\
            \ till\xE4mpas mot bakgrund av den h\xE4r f\xF6rordningen. F\xF6r att\
            \ tillhandah\xE5lla en stark och sammanh\xE4ngande ram f\xF6r dataskyddet\
            \ inom unionen b\xF6r n\xF6dv\xE4ndiga anpassningar av f\xF6rordning (EG)\
            \ nr\_45/2001 g\xF6ras n\xE4r den h\xE4r f\xF6rordningen har antagits,\
            \ s\xE5 att de b\xE5da f\xF6rordningarna kan till\xE4mpas samtidigt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-18
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 18
      description: This Regulation does not apply to the processing of personal data
        by a natural person in the course of a purely personal or household activity
        and thus with no connection to a professional or commercial activity. Personal
        or household activities could include correspondence and the holding of addresses,
        or social networking and online activity undertaken within the context of
        such activities. However, this Regulation applies to controllers or processors
        which provide the means for processing personal data for such personal or
        household activities.
      translations:
        sv:
          name: "Sk\xE4l 18"
          description: "Denna f\xF6rordning \xE4r inte till\xE4mplig p\xE5 fysiska\
            \ personers behandling av personuppgifter som ett led i verksamhet som\
            \ \xE4r helt och h\xE5llet privat eller har samband med personens hush\xE5\
            ll och d\xE4rmed saknar koppling till yrkes- eller aff\xE4rsm\xE4ssig\
            \ verksamhet. Privat verksamhet eller verksamhet som har samband med hush\xE5\
            llet kan omfatta korrespondens och innehav av adresser, aktivitet i sociala\
            \ n\xE4tverk och internetverksamhet i samband med s\xE5dan verksamhet.\
            \ Denna f\xF6rordning \xE4r dock till\xE4mplig p\xE5 personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den som tillhandah\xE5ller utrustning f\xF6\
            r behandling av personuppgifter f\xF6r s\xE5dan privat verksamhet eller\
            \ hush\xE5llsverksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-19
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 19
      description: The protection of natural persons with regard to the processing
        of personal data by competent authorities for the purposes of the prevention,
        investigation, detection or prosecution of criminal offences or the execution
        of criminal penalties, including the safeguarding against and the prevention
        of threats to public security and the free movement of such data, is the subject
        of a specific Union legal act. This Regulation should not, therefore, apply
        to processing activities for those purposes. However, personal data processed
        by public authorities under this Regulation should, when used for those purposes,
        be governed by a more specific Union legal act, namely Directive (EU) 2016/680
        of the European Parliament and of the Council (1). Member States may entrust
        competent authorities within the meaning of Directive (EU) 2016/680 with tasks
        which are not necessarily carried out for the purposes of the prevention,
        investigation, detection or prosecution of criminal offences or the execution
        of criminal penalties, including the safeguarding against and prevention of
        threats to public security, so that the processing of personal data for those
        other purposes, in so far as it is within the scope of Union law, falls within
        the scope of this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 19"
          description: "Skyddet f\xF6r fysiska personer n\xE4r det g\xE4ller beh\xF6\
            riga myndigheters behandling av personuppgifter i syfte att f\xF6rebygga,\
            \ f\xF6rhindra, utreda, avsl\xF6ja eller lagf\xF6ra brott eller verkst\xE4\
            lla straffr\xE4ttsliga p\xE5f\xF6ljder, inklusive att skydda mot samt\
            \ f\xF6rebygga och f\xF6rhindra hot mot den allm\xE4nna s\xE4kerheten\
            \ och det fria fl\xF6det av s\xE5dana uppgifter, s\xE4kerst\xE4lls p\xE5\
            \ unionsniv\xE5 av en s\xE4rskild unionsr\xE4ttsakt. D\xE4rf\xF6r b\xF6\
            r denna f\xF6rordning inte vara till\xE4mplig p\xE5 behandling av personuppgifter\
            \ f\xF6r dessa \xE4ndam\xE5l. Personuppgifter som myndigheter behandlar\
            \ enligt denna f\xF6rordning och som anv\xE4nds f\xF6r de \xE4ndam\xE5\
            len b\xF6r emellertid regleras genom en mer specifik unionsr\xE4ttsakt,\
            \ n\xE4mligen Europaparlamentets och r\xE5dets direktiv (EU) 2016/680\_\
            (7). Medlemsstaterna f\xE5r anf\xF6rtro beh\xF6riga myndigheter i den\
            \ mening som avses i direktiv (EU) 2016/680 uppgifter som inte n\xF6dv\xE4\
            ndigtvis utf\xF6rs f\xF6r att f\xF6rebygga, f\xF6rhindra, utreda, avsl\xF6\
            ja eller lagf\xF6ra brott eller verkst\xE4lla straffr\xE4ttsliga p\xE5\
            f\xF6ljder, inklusive att skydda mot samt f\xF6rebygga och f\xF6rhindra\
            \ hot mot den allm\xE4nna s\xE4kerheten, s\xE5 att behandlingen av personuppgifter\
            \ f\xF6r dessa andra \xE4ndam\xE5l, i den m\xE5n den omfattas av unionsr\xE4\
            tten, omfattas av till\xE4mpningsomr\xE5det f\xF6r denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:node20
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      description: With regard to the processing of personal data by those competent
        authorities for purposes falling within scope of this Regulation, Member States
        should be able to maintain or introduce more specific provisions to adapt
        the application of the rules of this Regulation. Such provisions may determine
        more precisely specific requirements for the processing of personal data by
        those competent authorities for those other purposes, taking into account
        the constitutional, organisational and administrative structure of the respective
        Member State. When the processing of personal data by private bodies falls
        within the scope of this Regulation, this Regulation should provide for the
        possibility for Member States under specific conditions to restrict by law
        certain obligations and rights when such a restriction constitutes a necessary
        and proportionate measure in a democratic society to safeguard specific important
        interests including public security and the prevention, investigation, detection
        or prosecution of criminal offences or the execution of criminal penalties,
        including the safeguarding against and the prevention of threats to public
        security. This is relevant for instance in the framework of anti-money laundering
        or the activities of forensic laboratories.
      translations:
        sv:
          description: "Vad g\xE4ller dessa beh\xF6riga myndigheters behandling av\
            \ personuppgifter f\xF6r \xE4ndam\xE5l som omfattas av till\xE4mpningsomr\xE5\
            det f\xF6r denna f\xF6rordning, b\xF6r medlemsstaterna kunna bibeh\xE5\
            lla eller inf\xF6ra mer specifika best\xE4mmelser f\xF6r att anpassa till\xE4\
            mpningen av best\xE4mmelserna i denna f\xF6rordning. I\_s\xE5dana best\xE4\
            mmelser f\xE5r det fastst\xE4llas mer specifika krav f\xF6r dessa beh\xF6\
            riga myndigheters behandling av personuppgifter f\xF6r dessa andra \xE4\
            ndam\xE5l, med beaktande av respektive medlemsstats konstitutionella,\
            \ organisatoriska och administrativa struktur. N\xE4r privata organs behandling\
            \ av personuppgifter omfattas av till\xE4mpningsomr\xE5det f\xF6r denna\
            \ f\xF6rordning, b\xF6r denna f\xF6rordning ge medlemsstaterna m\xF6jlighet\
            \ att, under s\xE4rskilda villkor, i lag begr\xE4nsa vissa skyldigheter\
            \ och r\xE4ttigheter, om en s\xE5dan begr\xE4nsning utg\xF6r en n\xF6\
            dv\xE4ndig och proportionell \xE5tg\xE4rd i ett demokratiskt samh\xE4\
            lle f\xF6r att skydda s\xE4rskilda viktiga intressen, d\xE4ribland allm\xE4\
            n s\xE4kerhet samt f\xF6rebyggande, f\xF6rhindrande, utredning, avsl\xF6\
            jande och lagf\xF6ring av brott eller verkst\xE4llande av straffr\xE4\
            ttsliga p\xE5f\xF6ljder eller skydd mot samt f\xF6rebyggande och f\xF6\
            rhindrande av hot mot den allm\xE4nna s\xE4kerheten. Detta \xE4r exempelvis\
            \ relevant i samband med bek\xE4mpning av penningtv\xE4tt eller verksamhet\
            \ vid kriminaltekniska laboratorier."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-20
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 20
      description: While this Regulation applies, inter alia, to the activities of
        courts and other judicial authorities, Union or Member State law could specify
        the processing operations and processing procedures in relation to the processing
        of personal data by courts and other judicial authorities. The competence
        of the supervisory authorities should not cover the processing of personal
        data when courts are acting in their judicial capacity, in order to safeguard
        the independence of the judiciary in the performance of its judicial tasks,
        including decision- making. It should be possible to entrust supervision of
        such data processing operations to specific bodies within the judicial system
        of the Member State, which should, in particular ensure compliance with the
        rules of this Regulation, enhance awareness among members of the judiciary
        of their obligations under this Regulation and handle complaints in relation
        to such data processing operations.
      translations:
        sv:
          name: "Sk\xE4l 20"
          description: "Eftersom denna f\xF6rordning bland annat g\xE4ller f\xF6r\
            \ verksamhet inom domstolar och andra r\xE4ttsliga myndigheter, skulle\
            \ det i unionsr\xE4tt eller medlemsstaternas nationella r\xE4tt kunna\
            \ anges vilken behandling och vilka f\xF6rfaranden f\xF6r behandling som\
            \ ber\xF6rs n\xE4r det g\xE4ller domstolars och andra r\xE4ttsliga myndigheters\
            \ behandling av personuppgifter. Tillsynsmyndigheternas beh\xF6righet\
            \ b\xF6r inte omfatta domstolars behandling av personuppgifter n\xE4r\
            \ detta sker inom ramen f\xF6r domstolarnas d\xF6mande verksamhet, i syfte\
            \ att s\xE4kerst\xE4lla domstolsv\xE4sendets oberoende n\xE4r det utf\xF6\
            r sin r\xE4ttsskipande verksamhet, inbegripet n\xE4r det fattar beslut.\
            \ Det b\xF6r vara m\xF6jligt att anf\xF6rtro tillsynen \xF6ver s\xE5dan\
            \ behandling av uppgifter till s\xE4rskilda organ inom medlemsstaternas\
            \ r\xE4ttsv\xE4sen, vilka framf\xF6r allt b\xF6r s\xE4kerst\xE4lla efterlevnaden\
            \ av best\xE4mmelserna i denna f\xF6rordning, fr\xE4mja domstolsv\xE4\
            sendets medvetenhet om sina skyldigheter enligt denna f\xF6rordning och\
            \ hantera klagom\xE5l relaterade till s\xE5dan behandling av uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-21
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 21
      description: This Regulation is without prejudice to the application of Directive
        2000/31/EC of the European Parliament and of the Council (2), in particular
        of the liability rules of intermediary service providers in Articles 12 to
        15 of that Directive. That Directive seeks to contribute to the proper functioning
        of the internal market by ensuring the free movement of information society
        services between Member States.
      translations:
        sv:
          name: "Sk\xE4l 21"
          description: "Denna f\xF6rordning p\xE5verkar inte till\xE4mpningen av Europaparlamentets\
            \ och r\xE5dets direktiv\_2000/31/EG\_(8), s\xE4rskilt best\xE4mmelserna\
            \ om tj\xE4nstelevererande mellanh\xE4nders ansvar i\_artiklarna 12\u2013\
            15 i det direktivet. Syftet med det direktivet \xE4r att bidra till att\
            \ den inre marknaden fungerar v\xE4l genom att s\xE4kerst\xE4lla fri r\xF6\
            rlighet f\xF6r informationssamh\xE4llets tj\xE4nster mellan medlemsstaterna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-22
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 22
      description: Any processing of personal data in the context of the activities
        of an establishment of a controller or a processor in the Union should be
        carried out in accordance with this Regulation, regardless of whether the
        processing itself takes place within the Union. Establishment implies the
        effective and real exercise of activity through stable arrangements. The legal
        form of such arrangements, whether through a branch or a subsidiary with a
        legal personality, is not the determining factor in that respect.
      translations:
        sv:
          name: "Sk\xE4l 22"
          description: "All behandling av personuppgifter som sker inom ramen f\xF6\
            r arbetet p\xE5 personuppgiftsansvarigas eller personuppgiftsbitr\xE4\
            dens verksamhetsst\xE4llen inom unionen b\xF6r ske i \xF6verensst\xE4\
            mmelse med denna f\xF6rordning, oavsett om behandlingen i sig \xE4ger\
            \ rum inom unionen. Verksamhetsst\xE4lle inneb\xE4r det faktiska och reella\
            \ utf\xF6randet av verksamhet med hj\xE4lp av en stabil struktur. Den\
            \ r\xE4ttsliga formen f\xF6r en s\xE5dan struktur, oavsett om det \xE4\
            r en filial eller ett dotterf\xF6retag med status som juridisk person,\
            \ b\xF6r inte vara den avg\xF6rande faktorn i detta avseende."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-23
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 23
      description: In order to ensure that natural persons are not deprived of the
        protection to which they are entitled under this Regulation, the processing
        of personal data of data subjects who are in the Union by a controller or
        a processor not established in the Union should be subject to this Regulation
        where the processing activities are related to offering goods or services
        to such data subjects irrespective of whether connected to a payment. In order
        to determine whether such a controller or processor is offering goods or services
        to data subjects who are in the Union, it should be ascertained whether it
        is apparent that the controller or processor envisages offering services to
        data subjects in one or more Member States in the Union. Whereas the mere
        accessibility of the controller's, processor's or an intermediary's website
        in the Union, of an email address or of other contact details, or the use
        of a language generally used in the third country where the controller is
        established, is insufficient to ascertain such intention, factors such as
        the use of a language or a currency generally used in one or more Member States
        with the possibility of ordering goods and services in that other language,
        or the mentioning of customers or users who are in the Union, may make it
        apparent that the controller envisages offering goods or services to data
        subjects in the Union.
      translations:
        sv:
          name: "Sk\xE4l 23"
          description: "F\xF6r att fysiska personer inte ska fr\xE5ntas det skydd\
            \ som denna f\xF6rordning ger dem b\xF6r s\xE5dan behandling av personuppgifter\
            \ om registrerade personer som befinner sig i unionen vilken utf\xF6rs\
            \ av en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de som\
            \ inte \xE4r etablerad inom unionen omfattas av denna f\xF6rordning, om\
            \ behandlingen avser utbjudande av varor eller tj\xE4nster inom unionen\
            \ till de registrerade, oavsett om detta \xE4r kopplat till en betalning.\
            \ I syfte att avg\xF6ra om en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de erbjuder varor eller tj\xE4nster till registrerade som befinner sig\
            \ i unionen b\xF6r man fastst\xE4lla om det \xE4r uppenbart att den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det avser att erbjuda tj\xE4nster till registrerade\
            \ i en eller flera av unionens medlemsstater. Medan enbart \xE5tkomlighet\
            \ till den personuppgiftsansvariges, personuppgiftsbitr\xE4dets eller\
            \ en mellanhands webbplats i unionen, till en e-postadress eller andra\
            \ kontaktuppgifter eller anv\xE4ndning av ett spr\xE5k som allm\xE4nt\
            \ anv\xE4nds i det tredjeland d\xE4r den personuppgiftsansvarige \xE4\
            r etablerad inte \xE4r tillr\xE4ckligt f\xF6r att fastst\xE4lla en s\xE5\
            dan avsikt, kan faktorer som anv\xE4ndning av ett spr\xE5k eller en valuta\
            \ som allm\xE4nt anv\xE4nds i\_en eller flera medlemsstater med m\xF6\
            jlighet att best\xE4lla varor och tj\xE4nster p\xE5 detta andra spr\xE5\
            k, eller omn\xE4mnande av kunder eller anv\xE4ndare som befinner sig i\
            \ unionen, g\xF6ra det uppenbart att den personuppgiftsansvarige avser\
            \ att erbjuda varor eller tj\xE4nster till registrerade inom unionen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-24
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 24
      description: The processing of personal data of data subjects who are in the
        Union by a controller or processor not established in the Union should also
        be subject to this Regulation when it is related to the monitoring of the
        behaviour of such data subjects in so far as their behaviour takes place within
        the Union. In order to determine whether a processing activity can be considered
        to monitor the behaviour of data subjects, it should be ascertained whether
        natural persons are tracked on the internet including potential subsequent
        use of personal data processing techniques which consist of profiling a natural
        person, particularly in order to take decisions concerning her or him or for
        analysing or predicting her or his personal preferences, behaviours and attitudes.
      translations:
        sv:
          name: "Sk\xE4l 24"
          description: "Den behandling av personuppgifter som avser registrerade som\
            \ befinner sig i unionen som utf\xF6rs av en personuppgiftsansvarig eller\
            \ ett personuppgiftsbitr\xE4de som inte \xE4r etablerad i\_unionen b\xF6\
            r ocks\xE5 omfattas av denna f\xF6rordning, om den h\xF6r samman med \xF6\
            vervakningen av de registrerade personernas beteende n\xE4r de befinner\
            \ sig i unionen. F\xF6r att avg\xF6ra huruvida en viss behandling kan\
            \ anses \xF6vervaka beteendet hos registrerade, b\xF6r det fastst\xE4\
            llas om fysiska personer sp\xE5ras p\xE5 internet, och om personuppgifterna\
            \ d\xE4refter behandlas med hj\xE4lp av teknik som profilerar fysiska\
            \ personer, i synnerhet f\xF6r att fatta beslut r\xF6rande honom eller\
            \ henne eller f\xF6r att analysera eller f\xF6ruts\xE4ga hans eller hennes\
            \ personliga preferenser, beteende och attityder."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-25
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 25
      description: Where Member State law applies by virtue of public international
        law, this Regulation should also apply to a controller not established in
        the Union, such as in a Member State's diplomatic mission or consular post.
      translations:
        sv:
          name: "Sk\xE4l 25"
          description: "Om medlemsstaternas nationella r\xE4tt \xE4r till\xE4mplig\
            \ i kraft av folkr\xE4tten, b\xF6r denna f\xF6rordning ocks\xE5 vara till\xE4\
            mplig p\xE5 personuppgiftsansvariga som inte \xE4r etablerade inom unionen,\
            \ exempelvis i en medlemsstats diplomatiska beskickning eller konsulat."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-26
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 26
      description: The principles of data protection should apply to any information
        concerning an identified or identifiable natural person. Personal data which
        have undergone pseudonymisation, which could be attributed to a natural person
        by the use of additional information should be considered to be information
        on an identifiable natural person. To determine whether a natural person is
        identifiable, account should be taken of all the means reasonably likely to
        be used, such as singling out, either by the controller or by another person
        to identify the natural person directly or indirectly. To ascertain whether
        means are reasonably likely to be used to identify the natural person, account
        should be taken of all objective factors, such as the costs of and the amount
        of time required for identification, taking into consideration the available
        technology at the time of the processing and technological developments. The
        principles of data protection should therefore not apply to anonymous information,
        namely information which does not relate to an identified or identifiable
        natural person or to personal data rendered anonymous in such a manner that
        the data subject is not or no longer identifiable. This Regulation does not
        therefore concern the processing of such anonymous information, including
        for statistical or research purposes.
      translations:
        sv:
          name: "Sk\xE4l 26"
          description: "Principerna f\xF6r dataskyddet b\xF6r g\xE4lla all information\
            \ som r\xF6r en identifierad eller identifierbar fysisk person. Personuppgifter\
            \ som har pseudonymiserats och som skulle kunna tillskrivas en fysisk\
            \ person genom att kompletterande uppgifter anv\xE4nds b\xF6r anses som\
            \ uppgifter om en identifierbar fysisk person. F\xF6r att avg\xF6ra om\
            \ en fysisk person \xE4r identifierbar b\xF6r man beakta alla hj\xE4lpmedel,\
            \ som t.ex. utgallring, som, antingen av den personuppgiftsansvarige eller\
            \ av en annan person, rimligen kan komma att anv\xE4ndas f\xF6r att direkt\
            \ eller indirekt identifiera den fysiska personen. F\xF6r att fastst\xE4\
            lla om hj\xE4lpmedel med rimlig sannolikhet kan komma att anv\xE4ndas\
            \ f\xF6r att identifiera den fysiska personen b\xF6r man beakta samtliga\
            \ objektiva faktorer, s\xE5som kostnader och tids\xE5tg\xE5ng f\xF6r identifiering,\
            \ med beaktande av s\xE5v\xE4l tillg\xE4nglig teknik vid tidpunkten f\xF6\
            r behandlingen som den tekniska utvecklingen. Principerna f\xF6r dataskyddet\
            \ b\xF6r d\xE4rf\xF6r inte g\xE4lla f\xF6r anonym information, n\xE4mligen\
            \ information som inte h\xE4nf\xF6r sig till en identifierad eller identifierbar\
            \ fysisk person, eller f\xF6r personuppgifter som anonymiserats p\xE5\
            \ ett s\xE5dant s\xE4tt att den registrerade inte eller inte l\xE4ngre\
            \ \xE4r identifierbar. Denna f\xF6rordning ber\xF6r d\xE4rf\xF6r inte\
            \ behandling av s\xE5dan anonym information, vilket inbegriper information\
            \ f\xF6r statistiska \xE4ndam\xE5l eller forsknings\xE4ndam\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-27
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 27
      description: This Regulation does not apply to the personal data of deceased
        persons. Member States may provide for rules regarding the processing of personal
        data of deceased persons.
      translations:
        sv:
          name: "Sk\xE4l 27"
          description: "Denna f\xF6rordning g\xE4ller inte behandling av personuppgifter\
            \ r\xF6rande avlidna personer. Medlemsstaterna f\xE5r fastst\xE4lla best\xE4\
            mmelser f\xF6r behandlingen av personuppgifter r\xF6rande avlidna personer."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-28
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 28
      description: "The application of pseudonymisation to personal data can reduce\
        \ the risks to the data subjects concerned and help controllers and processors\
        \ to meet their data-protection obligations. The explicit introduction of\
        \ \u2018pseudonymisation\u2019 in this Regulation is not intended to preclude\
        \ any other measures of data protection."
      translations:
        sv:
          name: "Sk\xE4l 28"
          description: "Till\xE4mpningen av pseudonymisering av personuppgifter kan\
            \ minska riskerna f\xF6r de registrerade som ber\xF6rs och hj\xE4lpa personuppgiftsansvariga\
            \ och personuppgiftsbitr\xE4den att fullg\xF6ra sina skyldigheter i fr\xE5\
            ga om dataskydd. Ett uttryckligt inf\xF6rande av\_pseudonymisering\_i\
            \ denna f\xF6rordning \xE4r inte avsett att utesluta andra \xE5tg\xE4\
            rder f\xF6r dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-29
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 29
      description: In order to create incentives to apply pseudonymisation when processing
        personal data, measures of pseudonymisation should, whilst allowing general
        analysis, be possible within the same controller when that controller has
        taken technical and organisational measures necessary to ensure, for the processing
        concerned, that this Regulation is implemented, and that additional information
        for attributing the personal data to a specific data subject is kept separately.
        The controller processing the personal data should indicate the authorised
        persons within the same controller.
      translations:
        sv:
          name: "Sk\xE4l 29"
          description: "F\xF6r att skapa incitament f\xF6r till\xE4mpning av pseudonymisering\
            \ vid behandling av personuppgifter b\xF6r \xE5tg\xE4rder f\xF6r pseudonymisering\
            \ som samtidigt medger en allm\xE4n analys vara m\xF6jliga inom samma\
            \ personuppgiftsansvarigs verksamhet, n\xE4r den personuppgiftsansvarige\
            \ har vidtagit de tekniska och organisatoriska \xE5tg\xE4rder som \xE4\
            r n\xF6dv\xE4ndiga f\xF6r att se till att denna f\xF6rordning genomf\xF6\
            rs f\xF6r ber\xF6rd uppgiftsbehandling och att kompletterande uppgifter\
            \ f\xF6r tillskrivning av personuppgifterna till en specifik registrerad\
            \ person f\xF6rvaras separat. Den personuppgiftsansvarige som behandlar\
            \ personuppgifterna b\xF6r ange beh\xF6riga personer inom samma personuppgiftsansvarigs\
            \ verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-30
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 30
      description: Natural persons may be associated with online identifiers provided
        by their devices, applications, tools and protocols, such as internet protocol
        addresses, cookie identifiers or other identifiers such as radio frequency
        identification tags. This may leave traces which, in particular when combined
        with unique identifiers and other information received by the servers, may
        be used to create profiles of the natural persons and identify them.
      translations:
        sv:
          name: "Sk\xE4l 30"
          description: "Fysiska personer kan knytas till n\xE4tidentifierare som l\xE4\
            mnas av deras utrustning, applikationer, verktyg och protokoll, t.ex.\
            \ ip-adresser, kakor eller andra identifierare, som radiofrekvensetiketter.\
            \ Detta kan efterl\xE4mna sp\xE5r som, s\xE4rskilt i kombination med unika\
            \ identifierare och andra uppgifter som tas emot av servrarna, kan anv\xE4\
            ndas f\xF6r att skapa profiler f\xF6r fysiska personer och identifiera\
            \ dem."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-31
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 31
      description: Public authorities to which personal data are disclosed in accordance
        with a legal obligation for the exercise of their official mission, such as
        tax and customs authorities, financial investigation units, independent administrative
        authorities, or financial market authorities responsible for the regulation
        and supervision of securities markets should not be regarded as recipients
        if they receive personal data which are necessary to carry out a particular
        inquiry in the general interest, in accordance with Union or Member State
        law. The requests for disclosure sent by the public authorities should always
        be in writing, reasoned and occasional and should not concern the entirety
        of a filing system or lead to the interconnection of filing systems. The processing
        of personal data by those public authorities should comply with the applicable
        data-protection rules according to the purposes of the processing.
      translations:
        sv:
          name: "Sk\xE4l 31"
          description: "Offentliga myndigheter som f\xF6r sin myndighetsut\xF6vning\
            \ mottar personuppgifter i enlighet med en r\xE4ttslig f\xF6rpliktelse,\
            \ t.ex. skatte- och tullmyndigheter, finansutredningsgrupper, oberoende\
            \ administrativa myndigheter eller finansmarknadsmyndigheter med ansvar\
            \ f\xF6r reglering och \xF6vervakning av v\xE4rdepappersmarknader, b\xF6\
            r inte betraktas som mottagare om de tar emot personuppgifter som \xE4\
            r n\xF6dv\xE4ndiga f\xF6r utf\xF6randet av en s\xE4rskild utredning av\
            \ allm\xE4nt intresse, i\_enlighet med unionsr\xE4tten eller medlemstaternas\
            \ nationella r\xE4tt. Offentliga myndigheters beg\xE4randen om att uppgifter\
            \ ska l\xE4mnas ut ska alltid vara skriftliga och motiverade, l\xE4ggas\
            \ fram i enskilda fall och inte g\xE4lla hela register eller leda till\
            \ att register kopplas samman. Dessa offentliga myndigheters behandling\
            \ av personuppgifter b\xF6r ske i \xF6verensst\xE4mmelse med de best\xE4\
            mmelser f\xF6r dataskydd som \xE4r till\xE4mpliga p\xE5 behandlingens\
            \ \xE4ndam\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-32
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 32
      description: Consent should be given by a clear affirmative act establishing
        a freely given, specific, informed and unambiguous indication of the data
        subject's agreement to the processing of personal data relating to him or
        her, such as by a written statement, including by electronic means, or an
        oral statement. This could include ticking a box when visiting an internet
        website, choosing technical settings for information society services or another
        statement or conduct which clearly indicates in this context the data subject's
        acceptance of the proposed processing of his or her personal data. Silence,
        pre-ticked boxes or inactivity should not therefore constitute consent. Consent
        should cover all processing activities carried out for the same purpose or
        purposes. When the processing has multiple purposes, consent should be given
        for all of them. If the data subject's consent is to be given following a
        request by electronic means, the request must be clear, concise and not unnecessarily
        disruptive to the use of the service for which it is provided.
      translations:
        sv:
          name: "Sk\xE4l 32"
          description: "Samtycke b\xF6r l\xE4mnas genom en entydig bekr\xE4ftande\
            \ handling som inneb\xE4r ett frivilligt, specifikt, informerat och otvetydigt\
            \ medgivande fr\xE5n den registrerades sida om att denne godk\xE4nner\
            \ behandling av personuppgifter r\xF6rande honom eller henne, som t.ex.\
            \ genom en skriftlig, inklusive elektronisk, eller muntlig f\xF6rklaring.\
            \ Detta kan inbegripa att en ruta kryssas i vid bes\xF6k p\xE5 en internetsida,\
            \ genom val av inst\xE4llningsalternativ f\xF6r tj\xE4nster p\xE5 informationssamh\xE4\
            llets omr\xE5de eller genom n\xE5gon annan f\xF6rklaring eller n\xE5got\
            \ annat beteende som i sammanhanget tydligt visar att den registrerade\
            \ godtar den avsedda behandlingen av sina personuppgifter. Tystnad, p\xE5\
            \ f\xF6rhand ikryssade rutor eller inaktivitet b\xF6r d\xE4rf\xF6r inte\
            \ utg\xF6ra samtycke. Samtycket b\xF6r g\xE4lla all behandling som utf\xF6\
            rs f\xF6r samma \xE4ndam\xE5l. Om behandlingen tj\xE4nar flera olika syften,\
            \ b\xF6r samtycke ges f\xF6r samtliga syften. Om den registrerade ska\
            \ l\xE4mna sitt samtycke efter en elektronisk beg\xE4ran, m\xE5ste denna\
            \ vara tydlig och koncis och f\xE5r inte on\xF6digtvis st\xF6ra anv\xE4\
            ndningen av den tj\xE4nst som den avser."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-33
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 33
      description: It is often not possible to fully identify the purpose of personal
        data processing for scientific research purposes at the time of data collection.
        Therefore, data subjects should be allowed to give their consent to certain
        areas of scientific research when in keeping with recognised ethical standards
        for scientific research. Data subjects should have the opportunity to give
        their consent only to certain areas of research or parts of research projects
        to the extent allowed by the intended purpose.
      translations:
        sv:
          name: "Sk\xE4l 33"
          description: "Det \xE4r ofta inte m\xF6jligt att fullt ut identifiera syftet\
            \ med en behandling av personuppgifter f\xF6r vetenskapliga forsknings\xE4\
            ndam\xE5l i samband med insamlingen av uppgifter. D\xE4rf\xF6r b\xF6r\
            \ registrerade kunna ge sitt samtycke till vissa omr\xE5den f\xF6r vetenskaplig\
            \ forskning, n\xE4r vedertagna etiska standarder f\xF6r vetenskaplig forskning\
            \ iakttas. Registrerade b\xF6r ha m\xF6jlighet att endast l\xE4mna sitt\
            \ samtycke till vissa forskningsomr\xE5den eller delar av forskningsprojekt\
            \ i den utstr\xE4ckning det avsedda syftet medger detta."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-34
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 34
      description: Genetic data should be defined as personal data relating to the
        inherited or acquired genetic characteristics of a natural person which result
        from the analysis of a biological sample from the natural person in question,
        in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid
        (RNA) analysis, or from the analysis of another element enabling equivalent
        information to be obtained.
      translations:
        sv:
          name: "Sk\xE4l 34"
          description: "Genetiska uppgifter b\xF6r definieras som personuppgifter\
            \ som r\xF6r en fysisk persons ned\xE4rvda eller f\xF6rv\xE4rvade genetiska\
            \ k\xE4nnetecken, vilka framg\xE5r av en analys av ett biologiskt prov\
            \ fr\xE5n den fysiska personen i fr\xE5ga, framf\xF6r allt kromosom-,\
            \ DNA- eller RNA-analys eller av en annan form av analys som g\xF6r det\
            \ m\xF6jligt att inh\xE4mta motsvarande information."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-35
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 35
      description: Personal data concerning health should include all data pertaining
        to the health status of a data subject which reveal information relating to
        the past, current or future physical or mental health status of the data subject.
        This includes information about the natural person collected in the course
        of the registration for, or the provision of, health care services as referred
        to in Directive 2011/24/EU of the European Parliament and of the Council (1)
        to that natural person; a number, symbol or particular assigned to a natural
        person to uniquely identify the natural person for health purposes; information
        derived from the testing or examination of a body part or bodily substance,
        including from genetic data and biological samples; and any information on,
        for example, a disease, disability, disease risk, medical history, clinical
        treatment or the physiological or biomedical state of the data subject independent
        of its source, for example from a physician or other health professional,
        a hospital, a medical device or an in vitro diagnostic test.
      translations:
        sv:
          name: "Sk\xE4l 35"
          description: "Personuppgifter om h\xE4lsa b\xF6r innefatta alla de uppgifter\
            \ som h\xE4nf\xF6r sig till en registrerad persons h\xE4lsotillst\xE5\
            nd som ger information om den registrerades tidigare, nuvarande eller\
            \ framtida fysiska eller psykiska h\xE4lsotillst\xE5nd. Detta inbegriper\
            \ uppgifter om den fysiska personen som insamlats i samband med registrering\
            \ f\xF6r eller tillhandah\xE5llande av h\xE4lso- och sjukv\xE5rdstj\xE4\
            nster till den fysiska personen enligt Europaparlamentets och r\xE5dets\
            \ direktiv 2011/24/EU\_(9), ett nummer, en symbol eller ett k\xE4nnetecken\
            \ som den fysiska personen tilldelats f\xF6r att identifiera denne f\xF6\
            r h\xE4lso- och sjukv\xE5rds\xE4ndam\xE5l, uppgifter som h\xE4rr\xF6r\
            \ fr\xE5n tester eller unders\xF6kning av en kroppsdel eller kroppssubstans,\
            \ d\xE4ribland genetiska uppgifter och biologiska prov, och andra uppgifter\
            \ om exempelvis sjukdom, funktionshinder, sjukdomsrisk, sjukdomshistoria,\
            \ klinisk behandling eller den registrerades fysiologiska eller biomedicinska\
            \ tillst\xE5nd, oberoende av k\xE4llan, exempelvis fr\xE5n en l\xE4kare\
            \ eller fr\xE5n annan sjukv\xE5rdspersonal, ett sjukhus, en medicinteknisk\
            \ produkt eller ett diagnostiskt in vitro-test."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-36
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 36
      description: The main establishment of a controller in the Union should be the
        place of its central administration in the Union, unless the decisions on
        the purposes and means of the processing of personal data are taken in another
        establishment of the controller in the Union, in which case that other establishment
        should be considered to be the main establishment. The main establishment
        of a controller in the Union should be determined according to objective criteria
        and should imply the effective and real exercise of management activities
        determining the main decisions as to the purposes and means of processing
        through stable arrangements. That criterion should not depend on whether the
        processing of personal data is carried out at that location. The presence
        and use of technical means and technologies for processing personal data or
        processing activities do not, in themselves, constitute a main establishment
        and are therefore not determining criteria for a main establishment. The main
        establishment of the processor should be the place of its central administration
        in the Union or, if it has no central administration in the Union, the place
        where the main processing activities take place in the Union. In cases involving
        both the controller and the processor, the competent lead supervisory authority
        should remain the supervisory authority of the Member State where the controller
        has its main establishment, but the supervisory authority of the processor
        should be considered to be a supervisory authority concerned and that supervisory
        authority should participate in the cooperation procedure provided for by
        this Regulation. In any case, the supervisory authorities of the Member State
        or Member States where the processor has one or more establishments should
        not be considered to be supervisory authorities concerned where the draft
        decision concerns only the controller. Where the processing is carried out
        by a group of undertakings, the main establishment of the controlling undertaking
        should be considered to be the main establishment of the group of undertakings,
        except where the purposes and means of processing are determined by another
        undertaking.
      translations:
        sv:
          name: "Sk\xE4l 36"
          description: "Den personuppgiftsansvariges huvudsakliga verksamhetsst\xE4\
            lle i unionen b\xF6r vara den plats i unionen d\xE4r den personuppgiftsansvarige\
            \ har sin centrala f\xF6rvaltning, s\xE5vida inte beslut om \xE4ndam\xE5\
            len och medlen f\xF6r behandling av personuppgifter fattas vid ett annat\
            \ av den personuppgiftsansvariges verksamhetsst\xE4llen i unionen; i s\xE5\
            dant fall b\xF6r det andra verksamhetsst\xE4llet anses vara det huvudsakliga\
            \ verksamhetsst\xE4llet. En personuppgiftsansvarigs huvudsakliga verksamhetsst\xE4\
            lle inom unionen b\xF6r avg\xF6ras med beaktande av objektiva kriterier\
            \ och b\xF6r inbegripa den faktiska och reella ledning som fattar de huvudsakliga\
            \ besluten vad avser \xE4ndam\xE5l och medel f\xF6r behandlingen med hj\xE4\
            lp av en stabil struktur. Detta kriterium b\xF6r inte vara avh\xE4ngigt\
            \ av om behandlingen av personuppgifter utf\xF6rs p\xE5 detta st\xE4lle.\
            \ Att tekniska medel och teknik f\xF6r behandling av personuppgifter eller\
            \ behandlingsverksamhet finns och anv\xE4nds visar i sig inte att det\
            \ r\xF6r sig om ett huvudsakligt verksamhetsst\xE4lle och utg\xF6r d\xE4\
            rf\xF6r inte avg\xF6rande kriterier f\xF6r ett huvudsakligt verksamhetsst\xE4\
            lle. Personuppgiftsbitr\xE4dets huvudsakliga verksamhetsst\xE4lle b\xF6\
            r vara den plats i unionen d\xE4r denne har sin centrala f\xF6rvaltning\
            \ eller, om denne inte har n\xE5gon central f\xF6rvaltning inom unionen,\
            \ den plats inom unionen d\xE4r den huvudsakliga behandlingen sker. I\
            \ fall som omfattar b\xE5de en personuppgiftsansvarig och ett personuppgiftsbitr\xE4\
            de b\xF6r den beh\xF6riga ansvariga tillsynsmyndigheten fortfarande vara\
            \ tillsynsmyndigheten i den medlemsstat d\xE4r den personuppgiftsansvarige\
            \ har sitt huvudsakliga verksamhetsst\xE4lle, men den tillsynsmyndighet\
            \ som g\xE4ller f\xF6r personuppgiftsbitr\xE4det b\xF6r betraktas som\
            \ en ber\xF6rd tillsynsmyndighet och den tillsynsmyndigheten b\xF6r delta\
            \ i det samarbetsf\xF6rfarande som f\xF6reskrivs i denna f\xF6rordning.\
            \ Om utkastet till beslut endast g\xE4ller den personuppgiftsansvarige,\
            \ b\xF6r tillsynsmyndigheterna i den eller de medlemsstater d\xE4r personuppgiftsbitr\xE4\
            det har ett eller flera verksamhetsst\xE4llen inte under n\xE5gra omst\xE4\
            ndigheter betraktas som ber\xF6rda tillsynsmyndigheter. Om behandlingen\
            \ utf\xF6rs av en koncern b\xF6r det kontrollerande f\xF6retagets huvudsakliga\
            \ verksamhetsst\xE4lle betraktas som koncernens huvudsakliga verksamhetsst\xE4\
            lle, utom d\xE5 behandlingens \xE4ndam\xE5l och de medel med vilka den\
            \ utf\xF6rs fastst\xE4lls av ett annat f\xF6retag."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-37
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 37
      description: A group of undertakings should cover a controlling undertaking
        and its controlled undertakings, whereby the controlling undertaking should
        be the undertaking which can exert a dominant influence over the other undertakings
        by virtue, for example, of ownership, financial participation or the rules
        which govern it or the power to have personal data protection rules implemented.
        An undertaking which controls the processing of personal data in undertakings
        affiliated to it should be regarded, together with those undertakings, as
        a group of undertakings.
      translations:
        sv:
          name: "Sk\xE4l 37"
          description: "En koncern b\xF6r innefatta ett kontrollerande f\xF6retag\
            \ och de f\xF6retag som detta f\xF6retag kontrollerar (kontrollerade f\xF6\
            retag), varvid det kontrollerande f\xF6retaget b\xF6r vara det f\xF6retag\
            \ som kan ut\xF6va ett dominerande inflytande p\xE5 de \xF6vriga f\xF6\
            retagen i kraft av exempelvis \xE4garskap, finansiellt deltagande eller\
            \ de best\xE4mmelser som det regleras av eller befogenheten att inf\xF6\
            ra regler som r\xF6r personuppgiftsskyddet. Ett f\xF6retag med kontroll\
            \ \xF6ver behandlingen av personuppgifter vid f\xF6retag som \xE4r underst\xE4\
            llda detta f\xF6retag b\xF6r, tillsammans med dessa f\xF6retag, anses\
            \ utg\xF6ra en koncern."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-38
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 38
      description: Children merit specific protection with regard to their personal
        data, as they may be less aware of the risks, consequences and safeguards
        concerned and their rights in relation to the processing of personal data.
        Such specific protection should, in particular, apply to the use of personal
        data of children for the purposes of marketing or creating personality or
        user profiles and the collection of personal data with regard to children
        when using services offered directly to a child. The consent of the holder
        of parental responsibility should not be necessary in the context of preventive
        or counselling services offered directly to a child.
      translations:
        sv:
          name: "Sk\xE4l 38"
          description: "Barns personuppgifter f\xF6rtj\xE4nar s\xE4rskilt skydd, eftersom\
            \ barn kan vara mindre medvetna om ber\xF6rda risker, f\xF6ljder och skydds\xE5\
            tg\xE4rder samt om sina r\xE4ttigheter n\xE4r det g\xE4ller behandling\
            \ av personuppgifter. S\xE5dant s\xE4rskilt skydd b\xF6r i synnerhet g\xE4\
            lla anv\xE4ndningen av barns personuppgifter i marknadsf\xF6ringssyfte\
            \ eller f\xF6r att skapa personlighets- eller anv\xE4ndarprofiler samt\
            \ insamling av personuppgifter med avseende p\xE5 barn n\xE4r tj\xE4nster\
            \ som erbjuds direkt till barn utnyttjas. Samtycke fr\xE5n den person\
            \ som har f\xF6r\xE4ldraansvar \xF6ver ett barn b\xF6r inte kr\xE4vas\
            \ f\xF6r f\xF6rebyggande eller r\xE5dgivande tj\xE4nster som erbjuds direkt\
            \ till barn."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-39
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 39
      description: Any processing of personal data should be lawful and fair. It should
        be transparent to natural persons that personal data concerning them are collected,
        used, consulted or otherwise processed and to what extent the personal data
        are or will be processed. The principle of transparency requires that any
        information and communication relating to the processing of those personal
        data be easily accessible and easy to understand, and that clear and plain
        language be used. That principle concerns, in particular, information to the
        data subjects on the identity of the controller and the purposes of the processing
        and further information to ensure fair and transparent processing in respect
        of the natural persons concerned and their right to obtain confirmation and
        communication of personal data concerning them which are being processed.
        Natural persons should be made aware of risks, rules, safeguards and rights
        in relation to the processing of personal data and how to exercise their rights
        in relation to such processing. In particular, the specific purposes for which
        personal data are processed should be explicit and legitimate and determined
        at the time of the collection of the personal data. The personal data should
        be adequate, relevant and limited to what is necessary for the purposes for
        which they are processed. This requires, in particular, ensuring that the
        period for which the personal data are stored is limited to a strict minimum.
        Personal data should be processed only if the purpose of the processing could
        not reasonably be fulfilled by other means. In order to ensure that the personal
        data are not kept longer than necessary, time limits should be established
        by the controller for erasure or for a periodic review. Every reasonable step
        should be taken to ensure that personal data which are inaccurate are rectified
        or deleted. Personal data should be processed in a manner that ensures appropriate
        security and confidentiality of the personal data, including for preventing
        unauthorised access to or use of personal data and the equipment used for
        the processing.
      translations:
        sv:
          name: "Sk\xE4l 39"
          description: "Varje behandling av personuppgifter m\xE5ste vara laglig och\
            \ r\xE4ttvis. Det b\xF6r vara klart och tydligt f\xF6r fysiska personer\
            \ hur personuppgifter som r\xF6r dem insamlas, anv\xE4nds, konsulteras\
            \ eller p\xE5 annat s\xE4tt behandlas samt i vilken utstr\xE4ckning personuppgifterna\
            \ behandlas eller kommer att behandlas. \xD6ppenhetsprincipen kr\xE4ver\
            \ att all information och kommunikation i samband med behandlingen av\
            \ dessa personuppgifter \xE4r l\xE4ttillg\xE4nglig och l\xE4ttbegriplig\
            \ samt att ett klart och tydligt spr\xE5k anv\xE4nds. Den principen g\xE4\
            ller framf\xF6r allt informationen till registrerade om den personuppgiftsansvariges\
            \ identitet och syftet med behandlingen samt ytterligare information f\xF6\
            r att s\xF6rja f\xF6r en r\xE4ttvis och \xF6ppen behandling f\xF6r ber\xF6\
            rda fysiska personer och deras r\xE4tt att erh\xE5lla bekr\xE4ftelse p\xE5\
            \ och meddelande om vilka personuppgifter r\xF6rande dem som behandlas.\
            \ Fysiska personer b\xF6r g\xF6ras medvetna om risker, regler, skydds\xE5\
            tg\xE4rder och r\xE4ttigheter i samband med behandlingen av personuppgifter\
            \ och om hur de kan ut\xF6va sina r\xE4ttigheter med avseende p\xE5 behandlingen.\
            \ De specifika \xE4ndam\xE5l som personuppgifterna behandlas f\xF6r b\xF6\
            r vara tydliga och legitima och ha best\xE4mts vid den tidpunkt d\xE5\
            \ personuppgifterna samlades in. Personuppgifterna b\xF6r vara adekvata,\
            \ relevanta och begr\xE4nsade till vad som \xE4r n\xF6dv\xE4ndigt f\xF6\
            r de \xE4ndam\xE5l som de behandlas f\xF6r. Detta kr\xE4ver i synnerhet\
            \ att det tillses att den period under vilken personuppgifterna lagras\
            \ \xE4r begr\xE4nsad till ett strikt minimum. Personuppgifter b\xF6r endast\
            \ behandlas om syftet med behandlingen inte rimligen kan uppn\xE5s genom\
            \ andra medel. F\xF6r att s\xE4kerst\xE4lla att personuppgifter inte sparas\
            \ l\xE4ngre \xE4n n\xF6dv\xE4ndigt b\xF6r den personuppgiftsansvarige\
            \ inf\xF6ra tidsfrister f\xF6r radering eller f\xF6r regelbunden kontroll.\
            \ Alla rimliga \xE5tg\xE4rder b\xF6r vidtas f\xF6r att r\xE4tta eller\
            \ radera felaktiga uppgifter. Personuppgifter b\xF6r behandlas p\xE5 ett\
            \ s\xE4tt som s\xE4kerst\xE4ller l\xE4mplig s\xE4kerhet och konfidentialitet\
            \ f\xF6r personuppgifterna samt f\xF6rhindrar obeh\xF6rigt tilltr\xE4\
            de till och obeh\xF6rig anv\xE4ndning av personuppgifter och den utrustning\
            \ som anv\xE4nds f\xF6r behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-40
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 40
      description: In order for processing to be lawful, personal data should be processed
        on the basis of the consent of the data subject concerned or some other legitimate
        basis, laid down by law, either in this Regulation or in other Union or Member
        State law as referred to in this Regulation, including the necessity for compliance
        with the legal obligation to which the controller is subject or the necessity
        for the performance of a contract to which the data subject is party or in
        order to take steps at the request of the data subject prior to entering into
        a contract.
      translations:
        sv:
          name: "Sk\xE4l 40"
          description: "F\xF6r att behandling ska vara laglig b\xF6r personuppgifterna\
            \ behandlas efter samtycke fr\xE5n den ber\xF6rda registrerade eller p\xE5\
            \ n\xE5gon annan legitim grund som fastst\xE4llts i lag, antingen i\_\
            denna f\xF6rordning eller i annan unionsr\xE4tt eller medlemsstaternas\
            \ nationella r\xE4tt enligt denna f\xF6rordning, vilket inbegriper att\
            \ de r\xE4ttsliga skyldigheter som \xE5ligger den personuppgiftsansvarige\
            \ m\xE5ste fullg\xF6ras eller att ett avtal i vilket den registrerade\
            \ \xE4r part m\xE5ste genomf\xF6ras eller att \xE5tg\xE4rder p\xE5 beg\xE4\
            ran av den registrerade m\xE5ste vidtas innan avtalet ing\xE5s."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-41
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 41
      description: "Where this Regulation refers to a legal basis or a legislative\
        \ measure, this does not necessarily require a legislative act adopted by\
        \ a parliament, without prejudice to requirements pursuant to the constitutional\
        \ order of the Member State concerned. However, such a legal basis or legislative\
        \ measure should be clear and precise and its application should be foreseeable\
        \ to persons subject to it, in accordance with the case-law of the Court of\
        \ Justice of the European Union (the \u2018Court of Justice\u2019) and the\
        \ European Court of Human Rights."
      translations:
        sv:
          name: "Sk\xE4l 41"
          description: "N\xE4r det i denna f\xF6rordning h\xE4nvisas till en r\xE4\
            ttslig grund eller lagstiftnings\xE5tg\xE4rd, inneb\xE4r detta inte n\xF6\
            dv\xE4ndigtvis en lagstiftningsakt antagen av ett parlament, utan att\
            \ detta p\xE5verkar krav som uppst\xE4lls i den konstitutionella ordningen\
            \ i den ber\xF6rda medlemsstaten. En s\xE5dan r\xE4ttslig grund eller\
            \ lagstiftnings\xE5tg\xE4rd b\xF6r dock vara tydlig och precis och dess\
            \ till\xE4mpning b\xF6r vara f\xF6ruts\xE4gbar f\xF6r personer som omfattas\
            \ av den, i enlighet med r\xE4ttspraxis vid Europeiska unionens domstol\
            \ (nedan kallad\_domstolen) och Europeiska domstolen f\xF6r de m\xE4nskliga\
            \ r\xE4ttigheterna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-42
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 42
      description: Where processing is based on the data subject's consent, the controller
        should be able to demonstrate that the data subject has given consent to the
        processing operation. In particular in the context of a written declaration
        on another matter, safeguards should ensure that the data subject is aware
        of the fact that and the extent to which consent is given. In accordance with
        Council Directive 93/13/EEC (1) a declaration of consent pre- formulated by
        the controller should be provided in an intelligible and easily accessible
        form, using clear and plain language and it should not contain unfair terms.
        For consent to be informed, the data subject should be aware at least of the
        identity of the controller and the purposes of the processing for which the
        personal data are intended. Consent should not be regarded as freely given
        if the data subject has no genuine or free choice or is unable to refuse or
        withdraw consent without detriment.
      translations:
        sv:
          name: "Sk\xE4l 42"
          description: "N\xE4r behandling sker efter samtycke fr\xE5n registrerade,\
            \ b\xF6r personuppgiftsansvariga kunna visa att de registrerade har l\xE4\
            mnat sitt samtycke till behandlingen. I synnerhet vid skriftliga f\xF6\
            rklaringar som r\xF6r andra fr\xE5gor b\xF6r det finnas skydds\xE5tg\xE4\
            rder som s\xE4kerst\xE4ller att de registrerade \xE4r medvetna om att\
            \ samtycke ges och om hur l\xE5ngt samtycket str\xE4cker sig. I\_enlighet\
            \ med r\xE5dets direktiv 93/13/EEG\_(10)\_b\xF6r en f\xF6rklaring om samtycke\
            \ som den personuppgiftsansvarige i f\xF6rv\xE4g formulerat tillhandah\xE5\
            llas i en begriplig och l\xE4tt tillg\xE4nglig form, med anv\xE4ndning\
            \ av ett klart och tydligt spr\xE5k och utan osk\xE4liga villkor. F\xF6\
            r att samtycket ska vara informerat b\xF6r den registrerade k\xE4nna till\
            \ \xE5tminstone den personuppgiftsansvariges identitet och syftet med\
            \ den behandling f\xF6r vilken personuppgifterna \xE4r avsedda. Samtycke\
            \ b\xF6r inte betraktas som frivilligt om den registrerade inte har n\xE5\
            gon genuin eller fri valm\xF6jlighet eller inte utan problem kan v\xE4\
            gra eller ta tillbaka sitt samtycke."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-43
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 43
      description: In order to ensure that consent is freely given, consent should
        not provide a valid legal ground for the processing of personal data in a
        specific case where there is a clear imbalance between the data subject and
        the controller, in particular where the controller is a public authority and
        it is therefore unlikely that consent was freely given in all the circumstances
        of that specific situation. Consent is presumed not to be freely given if
        it does not allow separate consent to be given to different personal data
        processing operations despite it being appropriate in the individual case,
        or if the performance of a contract, including the provision of a service,
        is dependent on the consent despite such consent not being necessary for such
        performance.
      translations:
        sv:
          name: "Sk\xE4l 43"
          description: "F\xF6r att s\xE4kerst\xE4lla att samtycket l\xE4mnas frivilligt\
            \ b\xF6r det inte utg\xF6ra giltig r\xE4ttslig grund f\xF6r behandling\
            \ av personuppgifter i ett s\xE4rskilt fall d\xE4r det r\xE5der betydande\
            \ oj\xE4mlikhet mellan den registrerade och den personuppgiftsansvarige,\
            \ s\xE4rskilt om den personuppgiftsansvarige \xE4r en offentlig myndighet\
            \ och det d\xE4rf\xF6r \xE4r osannolikt att samtycket har l\xE4mnats frivilligt\
            \ n\xE4r det g\xE4ller alla f\xF6rh\xE5llanden som denna s\xE4rskilda\
            \ situation omfattar. Samtycke antas inte vara frivilligt om det inte\
            \ medger att separata samtycken l\xE4mnas f\xF6r olika behandlingar av\
            \ personuppgifter, trots att detta \xE4r l\xE4mpligt i det enskilda fallet,\
            \ eller om genomf\xF6randet av ett avtal \u2013 inbegripet tillhandah\xE5\
            llandet av en tj\xE4nst \u2013 \xE4r avh\xE4ngigt av samtycket, trots\
            \ att samtycket inte \xE4r n\xF6dv\xE4ndigt f\xF6r ett s\xE5dant genomf\xF6\
            rande."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-44
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 44
      description: Processing should be lawful where it is necessary in the context
        of a contract or the intention to enter into a contract.
      translations:
        sv:
          name: "Sk\xE4l 44"
          description: "Behandling b\xF6r vara laglig n\xE4r den \xE4r n\xF6dv\xE4\
            ndig i samband med avtal eller n\xE4r det finns en avsikt att ing\xE5\
            \ ett avtal."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-45
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 45
      description: Where processing is carried out in accordance with a legal obligation
        to which the controller is subject or where processing is necessary for the
        performance of a task carried out in the public interest or in the exercise
        of official authority, the processing should have a basis in Union or Member
        State law. This Regulation does not require a specific law for each individual
        processing. A law as a basis for several processing operations based on a
        legal obligation to which the controller is subject or where processing is
        necessary for the performance of a task carried out in the public interest
        or in the exercise of an official authority may be sufficient. It should also
        be for Union or Member State law to determine the purpose of processing. Furthermore,
        that law could specify the general conditions of this Regulation governing
        the lawfulness of personal data processing, establish specifications for determining
        the controller, the type of personal data which are subject to the processing,
        the data subjects concerned, the entities to which the personal data may be
        disclosed, the purpose limitations, the storage period and other measures
        to ensure lawful and fair processing. It should also be for Union or Member
        State law to determine whether the controller performing a task carried out
        in the public interest or in the exercise of official authority should be
        a public authority or another natural or legal person governed by public law,
        or, where it is in the public interest to do so, including for health purposes
        such as public health and social protection and the management of health care
        services, by private law, such as a professional association.
      translations:
        sv:
          name: "Sk\xE4l 45"
          description: "Behandling som grundar sig p\xE5 en r\xE4ttslig f\xF6rpliktelse\
            \ som \xE5vilar den personuppgiftsansvarige eller behandling som kr\xE4\
            vs f\xF6r att utf\xF6ra en uppgift av allm\xE4nt intresse eller som ett\
            \ led i myndighetsut\xF6vning, b\xF6r ha en grund i unionsr\xE4tten eller\
            \ i en medlemsstats nationella r\xE4tt. Denna f\xF6rordning medf\xF6r\
            \ inte n\xE5got krav p\xE5 en s\xE4rskild lag f\xF6r varje enskild behandling.\
            \ Det kan r\xE4cka med en lag som grund f\xF6r flera behandlingar som\
            \ bygger p\xE5 en r\xE4ttslig f\xF6rpliktelse som \xE5vilar den personuppgiftsansvarige\
            \ eller om behandlingen kr\xE4vs f\xF6r att utf\xF6ra en uppgift av allm\xE4\
            nt intresse eller som ett led i\_myndighetsut\xF6vning. Behandlingens\
            \ syfte b\xF6r ocks\xE5 fastst\xE4llas i unionsr\xE4tten eller i\_medlemsstaternas\
            \ nationella r\xE4tt. D\xE4rtill skulle man genom denna grund kunna ange\
            \ denna f\xF6rordnings allm\xE4nna villkor f\xF6r laglig personuppgiftsbehandling\
            \ och precisera kraven f\xF6r att fastst\xE4lla vem den personuppgiftsansvarige\
            \ \xE4r, vilken typ av personuppgifter som ska behandlas, vilka registrerade\
            \ som ber\xF6rs, de enheter till vilka personuppgifterna f\xE5r l\xE4\
            mnas ut, \xE4ndam\xE5lsbegr\xE4nsningar, lagringstid samt andra \xE5tg\xE4\
            rder f\xF6r att tillf\xF6rs\xE4kra en laglig och r\xE4ttvis behandling.\
            \ Unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt b\xF6r ocks\xE5\
            \ reglera fr\xE5gan huruvida en personuppgiftsansvarig som utf\xF6r en\
            \ uppgift av allm\xE4nt intresse eller som ett led i myndighetsut\xF6\
            vning ska vara en offentlig myndighet eller n\xE5gon annan fysisk eller\
            \ juridisk person som omfattas av offentligr\xE4ttslig lagstiftning eller,\
            \ om detta motiveras av allm\xE4nintresset, vilket inbegriper h\xE4lso-\
            \ och sjukv\xE5rds\xE4ndam\xE5l, s\xE5som folkh\xE4lsa och socialt skydd\
            \ och f\xF6rvaltning av h\xE4lso- och sjukv\xE5rdstj\xE4nster, av civilr\xE4\
            ttslig lagstiftning, exempelvis en yrkesorganisation."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-46
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 46
      description: The processing of personal data should also be regarded to be lawful
        where it is necessary to protect an interest which is essential for the life
        of the data subject or that of another natural person. Processing of personal
        data based on the vital interest of another natural person should in principle
        take place only where the processing cannot be manifestly based on another
        legal basis. Some types of processing may serve both important grounds of
        public interest and the vital interests of the data subject as for instance
        when processing is necessary for humanitarian purposes, including for monitoring
        epidemics and their spread or in situations of humanitarian emergencies, in
        particular in situations of natural and man-made disasters.
      translations:
        sv:
          name: "Sk\xE4l 46"
          description: "Behandling av personuppgifter b\xF6r \xE4ven anses laglig\
            \ n\xE4r den \xE4r n\xF6dv\xE4ndig f\xF6r att skydda ett intresse som\
            \ \xE4r av avg\xF6rande betydelse f\xF6r den registrerades eller en annan\
            \ fysisk persons liv. Behandling av personuppgifter p\xE5 grundval av\
            \ en annan fysisk persons grundl\xE4ggande intressen b\xF6r i princip\
            \ endast \xE4ga rum om behandlingen inte uppenbart kan ha en annan r\xE4\
            ttslig grund. Vissa typer av behandling kan tj\xE4na b\xE5de viktiga allm\xE4\
            nintressen och intressen som \xE4r av grundl\xE4ggande betydelse f\xF6\
            r den registrerade, till exempel n\xE4r behandlingen \xE4r n\xF6dv\xE4\
            ndig av humanit\xE4ra sk\xE4l, bland annat f\xF6r att \xF6vervaka epidemier\
            \ och deras spridning eller i humanit\xE4ra n\xF6dsituationer, s\xE4rskilt\
            \ vid naturkatastrofer eller katastrofer orsakade av m\xE4nniskan."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-47
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 47
      description: The legitimate interests of a controller, including those of a
        controller to which the personal data may be disclosed, or of a third party,
        may provide a legal basis for processing, provided that the interests or the
        fundamental rights and freedoms of the data subject are not overriding, taking
        into consideration the reasonable expectations of data subjects based on their
        relationship with the controller. Such legitimate interest could exist for
        example where there is a relevant and appropriate relationship between the
        data subject and the controller in situations such as where the data subject
        is a client or in the service of the controller. At any rate the existence
        of a legitimate interest would need careful assessment including whether a
        data subject can reasonably expect at the time and in the context of the collection
        of the personal data that processing for that purpose may take place. The
        interests and fundamental rights of the data subject could in particular override
        the interest of the data controller where personal data are processed in circumstances
        where data subjects do not reasonably expect further processing. Given that
        it is for the legislator to provide by law for the legal basis for public
        authorities to process personal data, that legal basis should not apply to
        the processing by public authorities in the performance of their tasks. The
        processing of personal data strictly necessary for the purposes of preventing
        fraud also constitutes a legitimate interest of the data controller concerned.
        The processing of personal data for direct marketing purposes may be regarded
        as carried out for a legitimate interest.
      translations:
        sv:
          name: "Sk\xE4l 47"
          description: "En personuppgiftsansvarigs ber\xE4ttigade intressen, inklusive\
            \ intressena f\xF6r en personuppgiftsansvarig till vilken personuppgifter\
            \ f\xE5r l\xE4mnas ut, eller f\xF6r en tredje part, kan utg\xF6ra r\xE4\
            ttslig grund f\xF6r behandling, p\xE5 villkor att de registrerades intressen\
            \ eller grundl\xE4ggande r\xE4ttigheter och friheter inte v\xE4ger tyngre,\
            \ med beaktande av de registrerades rimliga f\xF6rv\xE4ntningar till f\xF6\
            ljd av f\xF6rh\xE5llandet till den personuppgiftsansvarige. Ett s\xE5\
            dant ber\xE4ttigat intresse kan till exempel finnas n\xE4r det f\xF6religger\
            \ ett relevant och l\xE4mpligt f\xF6rh\xE5llande mellan den registrerade\
            \ och den personuppgiftsansvarige i s\xE5dana situationer som att den\
            \ registrerade \xE4r kund hos eller arbetar f\xF6r den personuppgiftsansvarige.\
            \ Ett ber\xE4ttigat intresse kr\xE4ver under alla omst\xE4ndigheter en\
            \ noggrann bed\xF6mning, som inbegriper huruvida den registrerade vid\
            \ tidpunkten f\xF6r inh\xE4mtandet av personuppgifter och i samband med\
            \ detta rimligen kan f\xF6rv\xE4nta sig att en uppgiftsbehandling f\xF6\
            r detta \xE4ndam\xE5l kan komma att ske. Den registrerades intressen och\
            \ grundl\xE4ggande r\xE4ttigheter skulle i synnerhet kunna v\xE4ga tyngre\
            \ \xE4n den personuppgiftsansvariges intressen, om personuppgifter behandlas\
            \ under omst\xE4ndigheter d\xE4r den registrerade inte rimligen kan f\xF6\
            rv\xE4nta sig n\xE5gon ytterligare behandling. Med tanke p\xE5 att det\
            \ \xE4r lagstiftarens sak att genom lagstiftning tillhandah\xE5lla den\
            \ r\xE4ttsliga grunden f\xF6r de offentliga myndigheternas behandling\
            \ av personuppgifter, b\xF6r den r\xE4ttsliga grunden inte g\xE4lla den\
            \ behandling de utf\xF6r som ett led i fullg\xF6randet av sina uppgifter.\
            \ S\xE5dan behandling av personuppgifter som \xE4r absolut n\xF6dv\xE4\
            ndig f\xF6r att f\xF6rhindra bedr\xE4gerier utg\xF6r ocks\xE5 ett ber\xE4\
            ttigat intresse f\xF6r ber\xF6rd personuppgiftsansvarig. Behandling av\
            \ personuppgifter f\xF6r direktmarknadsf\xF6ring kan betraktas som ett\
            \ ber\xE4ttigat intresse."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-48
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 48
      description: Controllers that are part of a group of undertakings or institutions
        affiliated to a central body may have a legitimate interest in transmitting
        personal data within the group of undertakings for internal administrative
        purposes, including the processing of clients' or employees' personal data.
        The general principles for the transfer of personal data, within a group of
        undertakings, to an undertaking located in a third country remain unaffected.
      translations:
        sv:
          name: "Sk\xE4l 48"
          description: "Personuppgiftsansvariga som ing\xE5r i en koncern eller institutioner\
            \ som \xE4r underst\xE4llda ett centralt organ kan ha ett ber\xE4ttigat\
            \ intresse att \xF6verf\xF6ra personuppgifter inom koncernen f\xF6r interna\
            \ administrativa \xE4ndam\xE5l, bland annat f\xF6r behandling av kunders\
            \ eller anst\xE4lldas personuppgifter. De allm\xE4nna principerna f\xF6\
            r \xF6verf\xF6ring av personuppgifter, inom en koncern, till f\xF6retag\
            \ i tredjeland p\xE5verkas inte."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-49
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 49
      description: "The processing of personal data to the extent strictly necessary\
        \ and proportionate for the purposes of ensuring network and information security,\
        \ i.e. the ability of a network or an information system to resist, at a given\
        \ level of confidence, accidental events or unlawful or malicious actions\
        \ that compromise the availability, authenticity, integrity and confidentiality\
        \ of stored or transmitted personal data, and the security of the related\
        \ services offered by, or accessible via, those networks and systems, by public\
        \ authorities, by computer emergency response teams (CERTs), computer security\
        \ incident response teams (CSIRTs), by providers of electronic communications\
        \ networks and services and by providers of security technologies and services,\
        \ constitutes a legitimate interest of the data controller concerned. This\
        \ could, for example, include preventing unauthorised access to electronic\
        \ communications networks and malicious code distribution and stopping \u2018\
        denial of service\u2019 attacks and damage to computer and electronic communication\
        \ systems."
      translations:
        sv:
          name: "Sk\xE4l 49"
          description: "Behandling av personuppgifter utg\xF6r ett ber\xE4ttigat intresse\
            \ f\xF6r ber\xF6rd personuppgiftsansvarig i den m\xE5n den \xE4r absolut\
            \ n\xF6dv\xE4ndig och proportionell f\xF6r att s\xE4kerst\xE4lla n\xE4\
            t- och informationss\xE4kerhet, dvs. f\xF6rm\xE5gan hos ett n\xE4t eller\
            \ ett informationssystem att vid en viss tillf\xF6rlitlighetsniv\xE5 t\xE5\
            la olycksh\xE4ndelser, olagliga handlingar eller illvilligt upptr\xE4\
            dande som \xE4ventyrar tillg\xE4ngligheten, autenticiteten, integriteten\
            \ och konfidentialiteten hos lagrade eller \xF6verf\xF6rda personuppgifter\
            \ och s\xE4kerheten hos besl\xE4ktade tj\xE4nster som tillhandah\xE5lls\
            \ av \u2013 eller \xE4r tillg\xE4ngliga via \u2013 dessa n\xE4t och system,\
            \ av myndigheter, incidenthanteringsorganisationer (Cert), enheter f\xF6\
            r hantering av datas\xE4kerhetsincidenter, tillhandah\xE5llare av elektroniska\
            \ kommunikationsn\xE4t och kommunikationstj\xE4nster och tillhandah\xE5\
            llare av s\xE4kerhetsteknik och s\xE4kerhetstj\xE4nster. Detta skulle\
            \ t.ex. kunna innefatta att f\xF6rhindra obeh\xF6rigt tilltr\xE4de till\
            \ elektroniska kommunikationsn\xE4t och felaktig kodf\xF6rdelning och\
            \ att s\xE4tta stopp f\xF6r \xF6verbelastningsattacker och skador p\xE5\
            \ datasystem och elektroniska kommunikationssystem."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-50
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 50
      description: 'The processing of personal data for purposes other than those
        for which the personal data were initially collected should be allowed only
        where the processing is compatible with the purposes for which the personal
        data were initially collected. In such a case, no legal basis separate from
        that which allowed the collection of the personal data is required. If the
        processing is necessary for the performance of a task carried out in the public
        interest or in the exercise of official authority vested in the controller,
        Union or Member State law may determine and specify the tasks and purposes
        for which the further processing should be regarded as compatible and lawful.
        Further processing for archiving purposes in the public interest, scientific
        or historical research purposes or statistical purposes should be considered
        to be compatible lawful processing operations. The legal basis provided by
        Union or Member State law for the processing of personal data may also provide
        a legal basis for further processing. In order to ascertain whether a purpose
        of further processing is compatible with the purpose for which the personal
        data are initially collected, the controller, after having met all the requirements
        for the lawfulness of the original processing, should take into account, inter
        alia: any link between those purposes and the purposes of the intended further
        processing; the context in which the personal data have been collected, in
        particular the reasonable expectations of data subjects based on their relationship
        with the controller as to their further use; the nature of the personal data;
        the consequences of the intended further processing for data subjects; and
        the existence of appropriate safeguards in both the original and intended
        further processing operations.'
      translations:
        sv:
          name: "Sk\xE4l 50"
          description: "Behandling av personuppgifter f\xF6r andra \xE4ndam\xE5l \xE4\
            n de f\xF6r vilka de ursprungligen samlades in b\xF6r endast vara till\xE5\
            ten, n\xE4r detta \xE4r f\xF6renligt med de \xE4ndam\xE5l f\xF6r vilka\
            \ personuppgifterna ursprungligen samlades in. I dessa fall kr\xE4vs det\
            \ inte n\xE5gon annan separat r\xE4ttslig grund \xE4n den med st\xF6d\
            \ av vilken insamlingen av personuppgifter medgavs. Om behandlingen \xE4\
            r n\xF6dv\xE4ndig f\xF6r att fullg\xF6ra en uppgift av allm\xE4nt intresse\
            \ eller som ett led i myndighetsut\xF6vning som den personuppgiftsansvarige\
            \ har f\xE5tt i uppgift att utf\xF6ra, kan unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt fastst\xE4lla och n\xE4rmare ange f\xF6r vilka uppgifter\
            \ och syften ytterligare behandling b\xF6r betraktas som f\xF6renlig och\
            \ laglig. Ytterligare behandling f\xF6r arkiv\xE4ndam\xE5l av allm\xE4\
            nt intresse, vetenskapliga eller historiska forsknings\xE4ndam\xE5l eller\
            \ statistiska \xE4ndam\xE5l b\xF6r betraktas som f\xF6renlig och laglig\
            \ behandling av uppgifter. Den r\xE4ttsliga grund f\xF6r behandling av\
            \ personuppgifter som \xE5terfinns i unionsr\xE4tten eller i medlemsstaternas\
            \ nationella r\xE4tt kan ocks\xE5 utg\xF6ra en r\xE4ttslig grund f\xF6\
            r ytterligare behandling. F\xF6r att fastst\xE4lla om ett \xE4ndam\xE5\
            l med den ytterligare behandlingen \xE4r f\xF6renligt med det \xE4ndam\xE5\
            l f\xF6r vilket personuppgifterna ursprungligen insamlades b\xF6r den\
            \ personuppgiftsansvarige, efter att ha uppfyllt alla krav vad betr\xE4\
            ffar den ursprungliga behandlingens lagenlighet, bland annat beakta alla\
            \ kopplingar mellan dessa \xE4ndam\xE5l och \xE4ndam\xE5len med den avsedda\
            \ ytterligare behandlingen, det sammanhang inom vilket personuppgifterna\
            \ insamlats, s\xE4rskilt de registrerades rimliga f\xF6rv\xE4ntningar\
            \ till f\xF6ljd av f\xF6rh\xE5llandet till den personuppgiftsansvarige\
            \ i fr\xE5ga om den art, den planerade ytterligare behandlingens konsekvenser\
            \ f\xF6r de registrerade samt f\xF6rekomsten av l\xE4mpliga skydds\xE5\
            tg\xE4rder f\xF6r b\xE5de den ursprungliga och den planerade ytterligare\
            \ behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:node52
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      description: Where the data subject has given consent or the processing is based
        on Union or Member State law which constitutes a necessary and proportionate
        measure in a democratic society to safeguard, in particular, important objectives
        of general public interest, the controller should be allowed to further process
        the personal data irrespective of the compatibility of the purposes. In any
        case, the application of the principles set out in this Regulation and in
        particular the information of the data subject on those other purposes and
        on his or her rights including the right to object, should be ensured. Indicating
        possible criminal acts or threats to public security by the controller and
        transmitting the relevant personal data in individual cases or in several
        cases relating to the same criminal act or threats to public security to a
        competent authority should be regarded as being in the legitimate interest
        pursued by the controller. However, such transmission in the legitimate interest
        of the controller or further processing of personal data should be prohibited
        if the processing is not compatible with a legal, professional or other binding
        obligation of secrecy.
      translations:
        sv:
          description: "Om den registrerade har gett sitt medgivande eller behandlingen\
            \ grundar sig p\xE5 unionsr\xE4tten eller p\xE5 medlemsstaternas nationella\
            \ r\xE4tt som utg\xF6r en n\xF6dv\xE4ndig och proportionell \xE5tg\xE4\
            rd i ett demokratiskt samh\xE4lle i syfte att s\xE4kerst\xE4lla i synnerhet\
            \ viktiga m\xE5l av allm\xE4nt intresse, b\xF6r den personuppgiftsansvarige\
            \ till\xE5tas att behandla personuppgifterna ytterligare, oavsett om detta\
            \ \xE4r f\xF6renligt med \xE4ndam\xE5len eller inte. Under alla omst\xE4\
            ndigheter b\xF6r till\xE4mpningen av principerna i denna f\xF6rordning,\
            \ s\xE4rskilt informationen till den registrerade om dessa andra \xE4\
            ndam\xE5l och om dennes r\xE4ttigheter, inbegripet r\xE4tten att g\xF6\
            ra inv\xE4ndningar, s\xE4kerst\xE4llas. Om den personuppgiftsansvarige\
            \ anm\xE4ler m\xF6jliga brott eller hot mot den allm\xE4nna s\xE4kerheten\
            \ och i enskilda fall eller i flera fall som r\xF6r samma brott eller\
            \ hot mot den allm\xE4nna s\xE4kerheten \xF6verf\xF6r dessa personuppgifter\
            \ till en beh\xF6rig myndighet, ska detta betraktas som att den personuppgiftsansvarige\
            \ agerar i ett ber\xE4ttigat intresse. S\xE5dan \xF6verf\xF6ring i den\
            \ personuppgiftsansvariges ber\xE4ttigade intresse eller ytterligare behandling\
            \ av personuppgifter b\xF6r emellertid vara f\xF6rbjuden, om behandlingen\
            \ inte \xE4r f\xF6renlig med lagstadgad eller yrkesm\xE4ssig tystnadsplikt\
            \ eller annan bindande tystnadsplikt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-51
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 51
      description: "Personal data which are, by their nature, particularly sensitive\
        \ in relation to fundamental rights and freedoms merit specific protection\
        \ as the context of their processing could create significant risks to the\
        \ fundamental rights and freedoms. Those personal data should include personal\
        \ data revealing racial or ethnic origin, whereby the use of the term \u2018\
        racial origin\u2019 in this Regulation does not imply an acceptance by the\
        \ Union of theories which attempt to determine the existence of separate human\
        \ races. The processing of photographs should not systematically be considered\
        \ to be processing of special categories of personal data as they are covered\
        \ by the definition of biometric data only when processed through a specific\
        \ technical means allowing the unique identification or authentication of\
        \ a natural person. Such personal data should not be processed, unless processing\
        \ is allowed in specific cases set out in this Regulation, taking into account\
        \ that Member States law may lay down specific provisions on data protection\
        \ in order to adapt the application of the rules of this Regulation for compliance\
        \ with a legal obligation or for the performance of a task carried out in\
        \ the public interest or in the exercise of official authority vested in the\
        \ controller. In addition to the specific requirements for such processing,\
        \ the general principles and other rules of this Regulation should apply,\
        \ in particular as regards the conditions for lawful processing. Derogations\
        \ from the general prohibition for processing such special categories of personal\
        \ data should be explicitly provided, inter alia, where the data subject gives\
        \ his or her explicit consent or in respect of specific needs in particular\
        \ where the processing is carried out in the course of legitimate activities\
        \ by certain associations or foundations the purpose of which is to permit\
        \ the exercise of fundamental freedoms."
      translations:
        sv:
          name: "Sk\xE4l 51"
          description: "Personuppgifter som till sin natur \xE4r s\xE4rskilt k\xE4\
            nsliga med h\xE4nsyn till grundl\xE4ggande r\xE4ttigheterna och friheter\
            \ b\xF6r \xE5tnjuta s\xE4rskilt skydd, eftersom behandling av s\xE5dana\
            \ uppgifter kan inneb\xE4ra betydande risker f\xF6r de grundl\xE4ggande\
            \ r\xE4ttigheterna och friheterna. Dessa personuppgifter b\xF6r \xE4ven\
            \ inbegripa personuppgifter som avsl\xF6jar ras eller etniskt ursprung,\
            \ varvid anv\xE4ndningen av termen\_ras\_i denna f\xF6rordning inte inneb\xE4\
            r att unionen godtar teorier som s\xF6ker fastst\xE4lla f\xF6rekomsten\
            \ av skilda m\xE4nniskoraser. Behandling av foton b\xF6r inte systematiskt\
            \ anses utg\xF6ra behandling av s\xE4rskilda kategorier av personuppgifter,\
            \ eftersom foton endast definieras som biometriska uppgifter n\xE4r de\
            \ behandlas med s\xE4rskild teknik som m\xF6jligg\xF6r identifiering eller\
            \ autentisering av en fysisk person. S\xE5dana personuppgifter b\xF6r\
            \ inte behandlas, s\xE5vida inte behandling medges i\_s\xE4rskilda fall\
            \ som fastst\xE4lls i denna f\xF6rordning, med beaktande av att det i\_\
            medlemsstaternas lagstiftning f\xE5r inf\xF6ras s\xE4rskilda best\xE4\
            mmelser om dataskydd f\xF6r att anpassa till\xE4mpningen av best\xE4mmelserna\
            \ i denna f\xF6rordning i syfte att fullg\xF6ra en r\xE4ttslig skyldighet\
            \ eller en uppgift av allm\xE4nt intresse eller som ett led i\_myndighetsut\xF6\
            vning som den personuppgiftsansvarige har f\xE5tt i uppgift att utf\xF6\
            ra. Ut\xF6ver de s\xE4rskilda kraven f\xF6r s\xE5dan behandling, b\xF6\
            r de allm\xE4nna principerna och andra best\xE4mmelser i denna f\xF6rordning\
            \ till\xE4mpas, s\xE4rskilt n\xE4r det g\xE4ller villkoren f\xF6r laglig\
            \ behandling. Undantag fr\xE5n det allm\xE4nna f\xF6rbudet att behandla\
            \ s\xE5dana s\xE4rskilda kategorier av personuppgifter b\xF6r uttryckligen\
            \ fastst\xE4llas, bland annat om den registrerade l\xE4mnar sitt uttryckliga\
            \ samtycke eller f\xF6r att tillgodose specifika behov, i synnerhet n\xE4\
            r behandlingen utf\xF6rs inom ramen f\xF6r legitima verksamheter som bedrivs\
            \ av vissa sammanslutningar eller stiftelser i syfte att g\xF6ra det m\xF6\
            jligt att ut\xF6va grundl\xE4ggande friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-52
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 52
      description: Derogating from the prohibition on processing special categories
        of personal data should also be allowed when provided for in Union or Member
        State law and subject to suitable safeguards, so as to protect personal data
        and other fundamental rights, where it is in the public interest to do so,
        in particular processing personal data in the field of employment law, social
        protection law including pensions and for health security, monitoring and
        alert purposes, the prevention or control of communicable diseases and other
        serious threats to health. Such a derogation may be made for health purposes,
        including public health and the management of health-care services, especially
        in order to ensure the quality and cost-effectiveness of the procedures used
        for settling claims for benefits and services in the health insurance system,
        or for archiving purposes in the public interest, scientific or historical
        research purposes or statistical purposes. A derogation should also allow
        the processing of such personal data where necessary for the establishment,
        exercise or defence of legal claims, whether in court proceedings or in an
        administrative or out-of-court procedure.
      translations:
        sv:
          name: "Sk\xE4l 52"
          description: "Undantag fr\xE5n f\xF6rbudet att behandla s\xE4rskilda kategorier\
            \ av personuppgifter b\xF6r \xE4ven till\xE5tas om de f\xF6reskrivs i\
            \ unionsr\xE4tten eller i medlemsstaternas nationella r\xE4tt och underkastas\
            \ l\xE4mpliga skydds\xE5tg\xE4rder f\xF6r att skydda personuppgifter och\
            \ \xF6vriga grundl\xE4ggande r\xE4ttigheter, n\xE4r allm\xE4nintresset\
            \ motiverar detta, i synnerhet i fr\xE5ga om behandling av personuppgifter\
            \ inom ramen f\xF6r arbetsr\xE4tt och sociallagstiftning, d\xE4ribland\
            \ pensioner, och f\xF6r h\xE4lsos\xE4kerhets\xE4ndam\xE5l, \xF6vervaknings-\
            \ och varningssyften, f\xF6rebyggande eller kontroll av smittsamma sjukdomar\
            \ och andra allvarliga hot mot h\xE4lsan. Detta undantag f\xE5r g\xF6\
            ras f\xF6r h\xE4lso\xE4ndam\xE5l, inbegripet folkh\xE4lsa och f\xF6rvaltningen\
            \ av h\xE4lso- och sjukv\xE5rdstj\xE4nster, s\xE4rskilt f\xF6r att s\xE4\
            kerst\xE4lla kvalitet och kostnadseffektivitet i de f\xF6rfaranden som\
            \ anv\xE4nds vid pr\xF6vningen av ans\xF6kningar om f\xF6rm\xE5ner och\
            \ tj\xE4nster inom sjukf\xF6rs\xE4kringssystemet, eller f\xF6r arkiv\xE4\
            ndam\xE5l av allm\xE4nt intresse, vetenskapliga eller historiska forsknings\xE4\
            ndam\xE5l eller statistiska \xE4ndam\xE5l. Genom undantag b\xF6r man \xE4\
            ven till\xE5ta behandling av s\xE5dana personuppgifter d\xE4r s\xE5 kr\xE4\
            vs f\xF6r fastst\xE4llande, ut\xF6vande eller f\xF6rsvar av r\xE4ttsliga\
            \ anspr\xE5k, oavsett om detta sker inom ett domstolsf\xF6rfarande eller\
            \ inom ett administrativt eller ett utomr\xE4ttsligt f\xF6rfarande."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-53
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 53
      description: Special categories of personal data which merit higher protection
        should be processed for health-related purposes only where necessary to achieve
        those purposes for the benefit of natural persons and society as a whole,
        in particular in the context of the management of health or social care services
        and systems, including processing by the management and central national health
        authorities of such data for the purpose of quality control, management information
        and the general national and local supervision of the health or social care
        system, and ensuring continuity of health or social care and cross-border
        healthcare or health security, monitoring and alert purposes, or for archiving
        purposes in the public interest, scientific or historical research purposes
        or statistical purposes, based on Union or Member State law which has to meet
        an objective of public interest, as well as for studies conducted in the public
        interest in the area of public health. Therefore, this Regulation should provide
        for harmonised conditions for the processing of special categories of personal
        data concerning health, in respect of specific needs, in particular where
        the processing of such data is carried out for certain health-related purposes
        by persons subject to a legal obligation of professional secrecy. Union or
        Member State law should provide for specific and suitable measures so as to
        protect the fundamental rights and the personal data of natural persons. Member
        States should be allowed to maintain or introduce further conditions, including
        limitations, with regard to the processing of genetic data, biometric data
        or data concerning health. However, this should not hamper the free flow of
        personal data within the Union when those conditions apply to cross-border
        processing of such data.
      translations:
        sv:
          name: "Sk\xE4l 53"
          description: "S\xE4rskilda kategorier av personuppgifter som f\xF6rtj\xE4\
            nar ett mer omfattande skydd b\xF6r endast behandlas i h\xE4lsorelaterade\
            \ syften om detta kr\xE4vs f\xF6r att uppn\xE5 dessa syften och gagnar\
            \ fysiska personer och samh\xE4llet i stort, s\xE4rskilt inom ramen f\xF6\
            r f\xF6rvaltningen av tj\xE4nster f\xF6r h\xE4lso- och sjukv\xE5rd och\
            \ social omsorg och deras system, inbegripet behandling som utf\xF6rs\
            \ av f\xF6rvaltningen och centrala nationella h\xE4lsov\xE5rdsmyndigheter\
            \ av s\xE5dana uppgifter f\xF6r syften som h\xF6r samman med kvalitetskontroll,\
            \ information om f\xF6rvaltningen samt allm\xE4n nationell och lokal tillsyn\
            \ \xF6ver h\xE4lso- och sjukv\xE5rdssystemet och systemet f\xF6r social\
            \ omsorg och s\xE4kerst\xE4llande av kontinuitet inom h\xE4lso- och sjukv\xE5\
            rd och social omsorg samt gr\xE4ns\xF6verskridande h\xE4lso- och sjukv\xE5\
            rd eller h\xE4lsos\xE4kerhet, syften som h\xF6r samman med \xF6vervakning\
            \ samt varningssyften eller f\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse,\
            \ vetenskapliga eller historiska forsknings\xE4ndam\xE5l eller statistiska\
            \ \xE4ndam\xE5l som baseras p\xE5 unionsr\xE4tten eller p\xE5 medlemsstaternas\
            \ nationella r\xE4tt, vilka m\xE5ste ha ett syfte av allm\xE4nt intresse,\
            \ samt studier som genomf\xF6rs av allm\xE4nt intresse p\xE5 folkh\xE4\
            lsoomr\xE5det. Denna f\xF6rordning b\xF6r d\xE4rf\xF6r inneh\xE5lla harmoniserade\
            \ villkor f\xF6r behandling av s\xE4rskilda kategorier av personuppgifter\
            \ om h\xE4lsa, vad g\xE4ller s\xE4rskilda behov, i synnerhet n\xE4r behandlingen\
            \ av uppgifterna utf\xF6rs f\xF6r vissa h\xE4lsorelaterade syften av personer\
            \ som enligt lag \xE4r underkastade yrkesm\xE4ssig tystnadsplikt. Unionsr\xE4\
            tten eller medlemsstaternas nationella r\xE4tt b\xF6r f\xF6reskriva s\xE4\
            rskilda och l\xE4mpliga \xE5tg\xE4rder som skyddar fysiska personers grundl\xE4\
            ggande r\xE4ttigheter och personuppgifter. Medlemsstaterna b\xF6r f\xE5\
            \ beh\xE5lla eller inf\xF6ra ytterligare villkor, \xE4ven begr\xE4nsningar,\
            \ f\xF6r behandlingen av genetiska eller biometriska uppgifter eller uppgifter\
            \ om h\xE4lsa. Detta b\xF6r emellertid inte hindra det fria fl\xF6det\
            \ av personuppgifter inom unionen, n\xE4r villkoren till\xE4mpas p\xE5\
            \ gr\xE4ns\xF6verskridande behandling av s\xE5dana uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-54
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 54
      description: "The processing of special categories of personal data may be necessary\
        \ for reasons of public interest in the areas of public health without consent\
        \ of the data subject. Such processing should be subject to suitable and specific\
        \ measures so as to protect the rights and freedoms of natural persons. In\
        \ that context, \u2018public health\u2019 should be interpreted as defined\
        \ in Regulation (EC) No 1338/2008 of the European Parliament and of the Council\
        \ (1), namely all elements related to health, namely health status, including\
        \ morbidity and disability, the determinants having an effect on that health\
        \ status, health care needs, resources allocated to health care, the provision\
        \ of, and universal access to, health care as well as health care expenditure\
        \ and financing, and the causes of mortality. Such processing of data concerning\
        \ health for reasons of public interest should not result in personal data\
        \ being processed for other purposes by third parties such as employers or\
        \ insurance and banking companies."
      translations:
        sv:
          name: "Sk\xE4l 54"
          description: "P\xE5 folkh\xE4lsoomr\xE5det kan det bli n\xF6dv\xE4ndigt\
            \ att med h\xE4nsyn till ett allm\xE4nt intresse behandla s\xE4rskilda\
            \ kategorier av personuppgifter utan att den registrerades samtycke inh\xE4\
            mtas. S\xE5dan behandling b\xF6r f\xF6ruts\xE4tta l\xE4mpliga och s\xE4\
            rskilda \xE5tg\xE4rder f\xF6r att skydda fysiska personers r\xE4ttigheter\
            \ och friheter. I detta sammanhang b\xF6r\_folkh\xE4lsa\_tolkas enligt\
            \ definitionen i\_Europaparlamentets och r\xE5dets f\xF6rordning (EG)\
            \ nr\_1338/2008\_(11), n\xE4mligen alla aspekter som r\xF6r h\xE4lsosituationen,\
            \ dvs. allm\xE4nhetens h\xE4lsotillst\xE5nd, inbegripet sjuklighet och\
            \ funktionshinder, h\xE4lsans best\xE4mningsfaktorer, h\xE4lso- och sjukv\xE5\
            rdsbehov, resurser inom h\xE4lso- och sjukv\xE5rden, tillhandah\xE5llande\
            \ av och allm\xE4n tillg\xE5ng till h\xE4lso- och sjukv\xE5rd, utgifter\
            \ f\xF6r och finansiering av h\xE4lso- och sjukv\xE5rden samt d\xF6dsorsaker.\
            \ S\xE5dan behandling av uppgifter om h\xE4lsa av allm\xE4nt intresse\
            \ b\xF6r inte inneb\xE4ra att personuppgifter behandlas f\xF6r andra \xE4\
            ndam\xE5l av tredje part, exempelvis arbetsgivare eller f\xF6rs\xE4krings-\
            \ och bankf\xF6retag."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-55
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 55
      description: Moreover, the processing of personal data by official authorities
        for the purpose of achieving the aims, laid down by constitutional law or
        by international public law, of officially recognised religious associations,
        is carried out on grounds of public interest.
      translations:
        sv:
          name: "Sk\xE4l 55"
          description: "Myndigheters behandling av personuppgifter p\xE5 officiellt\
            \ erk\xE4nda religi\xF6sa sammanslutningars v\xE4gnar i syften som fastst\xE4\
            lls i grundlag eller i folkr\xE4tten anses ocks\xE5 grunda sig p\xE5 ett\
            \ allm\xE4nt intresse."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-56
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 56
      description: Where in the course of electoral activities, the operation of the
        democratic system in a Member State requires that political parties compile
        personal data on people's political opinions, the processing of such data
        may be permitted for reasons of public interest, provided that appropriate
        safeguards are established.
      translations:
        sv:
          name: "Sk\xE4l 56"
          description: "Om det f\xF6r att det demokratiska systemet ska fungera i\
            \ samband med allm\xE4nna val \xE4r n\xF6dv\xE4ndigt att politiska partier\
            \ i vissa medlemsstater samlar in personuppgifter om fysiska personers\
            \ politiska uppfattningar, f\xE5r behandling av s\xE5dana uppgifter till\xE5\
            tas med h\xE4nsyn till ett allm\xE4nt intresse, p\xE5 villkor att l\xE4\
            mpliga skydds\xE5tg\xE4rder fastst\xE4lls."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-57
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 57
      description: If the personal data processed by a controller do not permit the
        controller to identify a natural person, the data controller should not be
        obliged to acquire additional information in order to identify the data subject
        for the sole purpose of complying with any provision of this Regulation. However,
        the controller should not refuse to take additional information provided by
        the data subject in order to support the exercise of his or her rights. Identification
        should include the digital identification of a data subject, for example through
        authentication mechanism such as the same credentials, used by the data subject
        to log-in to the on-line service offered by the data controller.
      translations:
        sv:
          name: "Sk\xE4l 57"
          description: "Om de personuppgifter som behandlas av en personuppgiftsansvarig\
            \ inte g\xF6r det m\xF6jligt f\xF6r denne att identifiera en fysisk person,\
            \ b\xF6r den personuppgiftsansvarige inte vara tvungen att skaffa ytterligare\
            \ information f\xF6r att kunna identifiera den registrerade, om \xE4ndam\xE5\
            let endast \xE4r att f\xF6lja n\xE5gon av best\xE4mmelserna i denna f\xF6\
            rordning. Den personuppgiftsansvarige b\xF6r dock inte v\xE4gra att ta\
            \ emot kompletterande uppgifter som den registrerade l\xE4mnat som st\xF6\
            d f\xF6r ut\xF6vandet av sina r\xE4ttigheter. Identifiering b\xF6r omfatta\
            \ digital identifiering av en registrerad, till exempel genom en autentiseringsmekanism,\
            \ exempelvis samma identifieringsinformation som anv\xE4nds av den registrerade\
            \ f\xF6r att logga in p\xE5 den n\xE4ttj\xE4nst som tillhandah\xE5lls\
            \ av den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-58
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 58
      description: The principle of transparency requires that any information addressed
        to the public or to the data subject be concise, easily accessible and easy
        to understand, and that clear and plain language and, additionally, where
        appropriate, visualisation be used. Such information could be provided in
        electronic form, for example, when addressed to the public, through a website.
        This is of particular relevance in situations where the proliferation of actors
        and the technological complexity of practice make it difficult for the data
        subject to know and understand whether, by whom and for what purpose personal
        data relating to him or her are being collected, such as in the case of online
        advertising. Given that children merit specific protection, any information
        and communication, where processing is addressed to a child, should be in
        such a clear and plain language that the child can easily understand.
      translations:
        sv:
          name: "Sk\xE4l 58"
          description: "\xD6ppenhetsprincipen kr\xE4ver att all information som riktar\
            \ sig till allm\xE4nheten eller till registrerade \xE4r kortfattad, l\xE4\
            tt\xE5tkomlig och l\xE4ttbegriplig samt utformad p\xE5 ett tydligt och\
            \ enkelt spr\xE5k samt att man vid behov anv\xE4nder visualisering. Denna\
            \ information kan ges elektroniskt, exempelvis p\xE5 en webbplats, n\xE4\
            r den riktas till allm\xE4nheten. Detta \xE4r s\xE4rskilt relevant i situationer\
            \ d\xE4r m\xE4ngden olika akt\xF6rer och den tekniska komplexiteten g\xF6\
            r det sv\xE5rt f\xF6r den registrerade att veta och f\xF6rst\xE5 om personuppgifter\
            \ som r\xF6r honom eller henne samlas in, vem som g\xF6r det och f\xF6\
            r vilket syfte, exempelvis i fr\xE5ga om reklam p\xE5 n\xE4tet. Eftersom\
            \ barn f\xF6rtj\xE4nar s\xE4rskilt skydd, b\xF6r all information och kommunikation\
            \ som riktar sig till barn utformas p\xE5 ett tydligt och enkelt spr\xE5\
            k som barnet l\xE4tt kan f\xF6rst\xE5."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-59
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 59
      description: Modalities should be provided for facilitating the exercise of
        the data subject's rights under this Regulation, including mechanisms to request
        and, if applicable, obtain, free of charge, in particular, access to and rectification
        or erasure of personal data and the exercise of the right to object. The controller
        should also provide means for requests to be made electronically, especially
        where personal data are processed by electronic means. The controller should
        be obliged to respond to requests from the data subject without undue delay
        and at the latest within one month and to give reasons where the controller
        does not intend to comply with any such requests.
      translations:
        sv:
          name: "Sk\xE4l 59"
          description: "F\xF6rfaranden b\xF6r fastst\xE4llas som g\xF6r det l\xE4\
            ttare f\xF6r registrerade att ut\xF6va sina r\xE4ttigheter enligt denna\
            \ f\xF6rordning, inklusive mekanismer f\xF6r att beg\xE4ra och i f\xF6\
            rekommande fall kostnadsfritt f\xE5 tillg\xE5ng till och erh\xE5lla r\xE4\
            ttelse eller radering av personuppgifter samt f\xF6r att ut\xF6va r\xE4\
            tten att g\xF6ra inv\xE4ndningar. Den personuppgiftsansvarige b\xF6r ocks\xE5\
            \ tillhandah\xE5lla hj\xE4lpmedel f\xF6r elektroniskt ingivna framst\xE4\
            llningar, s\xE4rskilt i fall d\xE5 personuppgifter behandlas elektroniskt.\
            \ Personuppgiftsansvariga b\xF6r utan on\xF6digt dr\xF6jsm\xE5l och senast\
            \ inom en m\xE5nad vara skyldiga att besvara registrerades \xF6nskem\xE5\
            l och l\xE4mna en motivering, om de inte avser att uppfylla s\xE5dana\
            \ \xF6nskem\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-60
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 60
      description: The principles of fair and transparent processing require that
        the data subject be informed of the existence of the processing operation
        and its purposes. The controller should provide the data subject with any
        further information necessary to ensure fair and transparent processing taking
        into account the specific circumstances and context in which the personal
        data are processed. Furthermore, the data subject should be informed of the
        existence of profiling and the consequences of such profiling. Where the personal
        data are collected from the data subject, the data subject should also be
        informed whether he or she is obliged to provide the personal data and of
        the consequences, where he or she does not provide such data. That information
        may be provided in combination with standardised icons in order to give in
        an easily visible, intelligible and clearly legible manner, a meaningful overview
        of the intended processing. Where the icons are presented electronically,
        they should be machine-readable.
      translations:
        sv:
          name: "Sk\xE4l 60"
          description: "Principerna om r\xE4ttvis och \xF6ppen behandling fordrar\
            \ att den registrerade informeras om att behandling sker och syftet med\
            \ den. Den personuppgiftsansvarige b\xF6r till den registrerade l\xE4\
            mna all ytterligare information som kr\xE4vs f\xF6r att s\xE4kerst\xE4\
            lla en r\xE4ttvis och \xF6ppen behandling, med beaktande av personuppgiftsbehandlingens\
            \ specifika omst\xE4ndigheter och sammanhang. Dessutom b\xF6r den registrerade\
            \ informeras om f\xF6rekomsten av profilering samt om konsekvenserna av\
            \ s\xE5dan profilering. Om personuppgifterna samlas in fr\xE5n den registrerade,\
            \ b\xF6r denne \xE4ven informeras om huruvida han eller hon \xE4r skyldig\
            \ att tillhandah\xE5lla personuppgifterna och om konsekvenserna om han\
            \ eller hon inte l\xE4mnar dem. Denna information f\xE5r tillhandah\xE5\
            llas kombinerad med standardiserade symboler f\xF6r att ge en \xF6versk\xE5\
            dlig, begriplig, l\xE4ttl\xE4st och meningsfull \xF6verblick \xF6ver den\
            \ planerade behandlingen. Om s\xE5dana symboler visas elektroniskt b\xF6\
            r de vara maskinl\xE4sbara."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-61
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 61
      description: The information in relation to the processing of personal data
        relating to the data subject should be given to him or her at the time of
        collection from the data subject, or, where the personal data are obtained
        from another source, within a reasonable period, depending on the circumstances
        of the case. Where personal data can be legitimately disclosed to another
        recipient, the data subject should be informed when the personal data are
        first disclosed to the recipient. Where the controller intends to process
        the personal data for a purpose other than that for which they were collected,
        the controller should provide the data subject prior to that further processing
        with information on that other purpose and other necessary information. Where
        the origin of the personal data cannot be provided to the data subject because
        various sources have been used, general information should be provided.
      translations:
        sv:
          name: "Sk\xE4l 61"
          description: "Information om behandling av personuppgifter som r\xF6r den\
            \ registrerade b\xF6r l\xE4mnas till honom eller henne vid den tidpunkt\
            \ d\xE5 personuppgifterna samlas in fr\xE5n den registrerade eller, om\
            \ personuppgifterna erh\xE5lls direkt fr\xE5n en annan k\xE4lla, inom\
            \ en rimlig period, beroende p\xE5 omst\xE4ndigheterna i fallet. Om personuppgifter\
            \ legitimt kan l\xE4mnas ut till en annan mottagare, b\xF6r de registrerade\
            \ informeras f\xF6rsta g\xE5ngen personuppgifterna l\xE4mnas ut till denna\
            \ mottagare. Om den personuppgiftsansvarige avser att behandla personuppgifter\
            \ f\xF6r ett annat \xE4ndam\xE5l \xE4n det f\xF6r vilket uppgifterna insamlades,\
            \ b\xF6r denne f\xF6re ytterligare behandling informera den registrerade\
            \ om detta andra syfte och l\xE4mna annan n\xF6dv\xE4ndig information.\
            \ Om personuppgifternas ursprung inte kan meddelas den registrerade p\xE5\
            \ grund av att olika k\xE4llor har anv\xE4nts, b\xF6r allm\xE4n information\
            \ ges."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-62
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 62
      description: However, it is not necessary to impose the obligation to provide
        information where the data subject already possesses the information, where
        the recording or disclosure of the personal data is expressly laid down by
        law or where the provision of information to the data subject proves to be
        impossible or would involve a disproportionate effort. The latter could in
        particular be the case where processing is carried out for archiving purposes
        in the public interest, scientific or historical research purposes or statistical
        purposes. In that regard, the number of data subjects, the age of the data
        and any appropriate safeguards adopted should be taken into consideration.
      translations:
        sv:
          name: "Sk\xE4l 62"
          description: "Det \xE4r dock inte n\xF6dv\xE4ndigt att inf\xF6ra n\xE5gon\
            \ skyldighet att tillhandah\xE5lla information, om den registrerade redan\
            \ innehar denna information, om registreringen eller utl\xE4mnandet av\
            \ personuppgifterna uttryckligen f\xF6reskrivs i lag eller om det visar\
            \ sig vara om\xF6jligt eller skulle medf\xF6ra orimliga anstr\xE4ngningar\
            \ att tillhandah\xE5lla den registrerade informationen. Det sistn\xE4\
            mnda skulle s\xE4rskilt kunna vara fallet om behandlingen sker f\xF6r\
            \ arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga eller historiska\
            \ forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5l. I detta avseende\
            \ b\xF6r antalet registrerade, uppgifternas \xE5lder och l\xE4mpliga skydds\xE5\
            tg\xE4rder beaktas."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-63
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 63
      description: A data subject should have the right of access to personal data
        which have been collected concerning him or her, and to exercise that right
        easily and at reasonable intervals, in order to be aware of, and verify, the
        lawfulness of the processing. This includes the right for data subjects to
        have access to data concerning their health, for example the data in their
        medical records containing information such as diagnoses, examination results,
        assessments by treating physicians and any treatment or interventions provided.
        Every data subject should therefore have the right to know and obtain communication
        in particular with regard to the purposes for which the personal data are
        processed, where possible the period for which the personal data are processed,
        the recipients of the personal data, the logic involved in any automatic personal
        data processing and, at least when based on profiling, the consequences of
        such processing. Where possible, the controller should be able to provide
        remote access to a secure system which would provide the data subject with
        direct access to his or her personal data. That right should not adversely
        affect the rights or freedoms of others, including trade secrets or intellectual
        property and in particular the copyright protecting the software. However,
        the result of those considerations should not be a refusal to provide all
        information to the data subject. Where the controller processes a large quantity
        of information concerning the data subject, the controller should be able
        to request that, before the information is delivered, the data subject specify
        the information or processing activities to which the request relates.
      translations:
        sv:
          name: "Sk\xE4l 63"
          description: "Den registrerade b\xF6r ha r\xE4tt att f\xE5 tillg\xE5ng till\
            \ personuppgifter som insamlats om denne samt p\xE5 enkelt s\xE4tt och\
            \ med rimliga intervall kunna ut\xF6va denna r\xE4tt, f\xF6r att vara\
            \ medveten om att behandling sker och kunna kontrollera att den \xE4r\
            \ laglig. Detta innefattar r\xE4tten f\xF6r registrerade att f\xE5 tillg\xE5\
            ng till uppgifter om sin h\xE4lsa, exempelvis uppgifter i l\xE4karjournaler\
            \ med t.ex. diagnoser, unders\xF6kningsresultat, bed\xF6mningar av behandlande\
            \ l\xE4kare och eventuella v\xE5rdbehandlingar eller interventioner. Alla\
            \ registrerade b\xF6r d\xE4rf\xF6r ha r\xE4tt att f\xE5 k\xE4nnedom och\
            \ underr\xE4ttelse om framf\xF6r allt orsaken till att personuppgifterna\
            \ behandlas, om m\xF6jligt vilken tidsperiod behandlingen p\xE5g\xE5r,\
            \ vilka som mottar personuppgifterna, bakomliggande logik i samband med\
            \ automatisk behandling av personuppgifter och, \xE5tminstone n\xE4r behandlingen\
            \ bygger p\xE5 profilering, konsekvenserna av s\xE5dan behandling. Om\
            \ m\xF6jligt b\xF6r den personuppgiftsansvarige kunna ge fj\xE4rr\xE5\
            tkomst till ett s\xE4kert system genom vilket den registrerade kan f\xE5\
            \ direkt \xE5tkomst till sina personuppgifter. Denna r\xE4tt b\xF6r inte\
            \ inverka menligt p\xE5 andras r\xE4ttigheter eller friheter, t.ex. aff\xE4\
            rshemligheter eller immateriell \xE4gander\xE4tt och s\xE4rskilt inte\
            \ p\xE5 upphovsr\xE4tt som skyddar programvaran. Resultatet av dessa \xF6\
            verv\xE4ganden b\xF6r dock inte bli att den registrerade f\xF6rv\xE4gras\
            \ all information. Om den personuppgiftsansvarige behandlar en stor m\xE4\
            ngd uppgifter om den registrerade, b\xF6r den personuppgiftsansvarige\
            \ kunna beg\xE4ra att den registrerade l\xE4mnar uppgift om vilken information\
            \ eller vilken behandling en framst\xE4llan avser, innan informationen\
            \ l\xE4mnas ut."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-64
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 64
      description: The controller should use all reasonable measures to verify the
        identity of a data subject who requests access, in particular in the context
        of online services and online identifiers. A controller should not retain
        personal data for the sole purpose of being able to react to potential requests.
      translations:
        sv:
          name: "Sk\xE4l 64"
          description: "Personuppgiftsansvariga b\xF6r vidta alla rimliga \xE5tg\xE4\
            rder f\xF6r att kontrollera identiteten p\xE5 en registrerad som beg\xE4\
            r tillg\xE5ng, s\xE4rskilt inom ramen f\xF6r n\xE4ttj\xE4nster och i fr\xE5\
            ga om n\xE4tidentifierare. Personuppgiftsansvariga b\xF6r inte beh\xE5\
            lla personuppgifter enbart f\xF6r att kunna agera vid en potentiell beg\xE4\
            ran."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-65
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 65
      description: "A data subject should have the right to have personal data concerning\
        \ him or her rectified and a \u2018right to be forgotten\u2019 where the retention\
        \ of such data infringes this Regulation or Union or Member State law to which\
        \ the controller is subject. In particular, a data subject should have the\
        \ right to have his or her personal data erased and no longer processed where\
        \ the personal data are no longer necessary in relation to the purposes for\
        \ which they are collected or otherwise processed, where a data subject has\
        \ withdrawn his or her consent or objects to the processing of personal data\
        \ concerning him or her, or where the processing of his or her personal data\
        \ does not otherwise comply with this Regulation. That right is relevant in\
        \ particular where the data subject has given his or her consent as a child\
        \ and is not fully aware of the risks involved by the processing, and later\
        \ wants to remove such personal data, especially on the internet. The data\
        \ subject should be able to exercise that right notwithstanding the fact that\
        \ he or she is no longer a child. However, the further retention of the personal\
        \ data should be lawful where it is necessary, for exercising the right of\
        \ freedom of expression and information, for compliance with a legal obligation,\
        \ for the performance of a task carried out in the public interest or in the\
        \ exercise of official authority vested in the controller, on the grounds\
        \ of public interest in the area of public health, for archiving purposes\
        \ in the public interest, scientific or historical research purposes or statistical\
        \ purposes, or for the establishment, exercise or defence of legal claims."
      translations:
        sv:
          name: "Sk\xE4l 65"
          description: "Den registrerade b\xF6r ha r\xE4tt att f\xE5 sina personuppgifter\
            \ r\xE4ttade och en\_r\xE4tt att bli bortgl\xF6md, om lagringen av uppgifterna\
            \ strider mot denna f\xF6rordning eller unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt som den personuppgiftsansvarige omfattas av. En registrerad\
            \ b\xF6r s\xE4rskilt ha r\xE4tt att f\xE5 sina personuppgifter raderade\
            \ och kunna beg\xE4ra att dessa personuppgifter inte behandlas, om de\
            \ inte l\xE4ngre beh\xF6vs med tanke p\xE5 de \xE4ndam\xE5l f\xF6r vilka\
            \ de samlats in eller p\xE5 annat s\xE4tt behandlats, om en registrerad\
            \ har \xE5tertagit sitt samtycke till behandling eller inv\xE4nder mot\
            \ behandling av personuppgifter som r\xF6r honom eller henne, eller om\
            \ behandlingen av hans eller hennes personuppgifter p\xE5 annat s\xE4\
            tt inte \xF6verensst\xE4mmer med denna f\xF6rordning. Denna r\xE4ttighet\
            \ \xE4r s\xE4rskilt relevant n\xE4r den registrerade har gett sitt samtycke\
            \ som barn, utan att vara fullst\xE4ndigt medveten om riskerna med behandlingen,\
            \ och senare vill ta bort dessa personuppgifter, s\xE4rskilt p\xE5 internet.\
            \ Den registrerade b\xF6r kunna ut\xF6va denna r\xE4tt \xE4ven n\xE4r\
            \ han eller hon inte l\xE4ngre \xE4r barn. Ytterligare lagring av personuppgifterna\
            \ b\xF6r dock vara laglig, om detta kr\xE4vs f\xF6r att ut\xF6va yttrandefrihet\
            \ och informationsfrihet, f\xF6r att uppfylla en r\xE4ttslig f\xF6rpliktelse,\
            \ f\xF6r att utf\xF6ra en uppgift i av allm\xE4nt intresse eller som ett\
            \ led i myndighetsut\xF6vning som anf\xF6rtrotts den personuppgiftsansvarige,\
            \ med anledning av ett allm\xE4nt intresse inom folkh\xE4lsoomr\xE5det,\
            \ f\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga eller\
            \ historiska forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5l eller\
            \ f\xF6r fastst\xE4llande, ut\xF6vande eller f\xF6rsvar av r\xE4ttsliga\
            \ anspr\xE5k."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-66
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 66
      description: To strengthen the right to be forgotten in the online environment,
        the right to erasure should also be extended in such a way that a controller
        who has made the personal data public should be obliged to inform the controllers
        which are processing such personal data to erase any links to, or copies or
        replications of those personal data. In doing so, that controller should take
        reasonable steps, taking into account available technology and the means available
        to the controller, including technical measures, to inform the controllers
        which are processing the personal data of the data subject's request.
      translations:
        sv:
          name: "Sk\xE4l 66"
          description: "F\xF6r att st\xE4rka \u201Dr\xE4tten att bli bortgl\xF6md\u201D\
            \ i n\xE4tmilj\xF6n b\xF6r r\xE4tten till radering utvidgas genom att\
            \ personuppgiftsansvariga som offentliggjort personuppgifter \xE4r f\xF6\
            rpliktigade att vidta rimliga \xE5tg\xE4rder, d\xE4ribland tekniska \xE5\
            tg\xE4rder, f\xF6r att informera de personuppgiftsansvariga som behandlar\
            \ dessa personuppgifter om att den registrerade har beg\xE4rt radering\
            \ av alla l\xE4nkar till och kopior eller reproduktioner av dessa personuppgifter.\
            \ I samband med detta b\xF6r den personuppgiftsansvarige vidta rimliga\
            \ \xE5tg\xE4rder, med beaktande av tillg\xE4nglig teknik och de hj\xE4\
            lpmedel som st\xE5r den personuppgiftsansvarige till buds, d\xE4ribland\
            \ tekniska \xE5tg\xE4rder, f\xF6r att informera de personuppgiftsansvariga\
            \ som behandlar personuppgifterna om den registrerades beg\xE4ran."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-67
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 67
      description: Methods by which to restrict the processing of personal data could
        include, inter alia, temporarily moving the selected data to another processing
        system, making the selected personal data unavailable to users, or temporarily
        removing published data from a website. In automated filing systems, the restriction
        of processing should in principle be ensured by technical means in such a
        manner that the personal data are not subject to further processing operations
        and cannot be changed. The fact that the processing of personal data is restricted
        should be clearly indicated in the system.
      translations:
        sv:
          name: "Sk\xE4l 67"
          description: "S\xE4tten att begr\xE4nsa behandlingen av personuppgifter\
            \ kan bland annat inbegripa att man tillf\xE4lligt flyttar de valda personuppgifterna\
            \ till ett annat databehandlingssystem, g\xF6r de valda uppgifterna otillg\xE4\
            ngliga f\xF6r anv\xE4ndare eller tillf\xE4lligt avl\xE4gsnar offentliggjorda\
            \ uppgifter fr\xE5n en webbplats. I automatiserade register b\xF6r begr\xE4\
            nsningen av behandlingen i\_princip ske med tekniska medel p\xE5 ett s\xE5\
            dant s\xE4tt att personuppgifterna inte blir f\xF6rem\xE5l f\xF6r ytterligare\
            \ behandling och inte kan \xE4ndras. Det f\xF6rh\xE5llandet att behandlingen\
            \ av personuppgifter \xE4r begr\xE4nsad b\xF6r klart anges inom systemet."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-68
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 68
      description: To further strengthen the control over his or her own data, where
        the processing of personal data is carried out by automated means, the data
        subject should also be allowed to receive personal data concerning him or
        her which he or she has provided to a controller in a structured, commonly
        used, machine-readable and interoperable format, and to transmit it to another
        controller. Data controllers should be encouraged to develop interoperable
        formats that enable data portability. That right should apply where the data
        subject provided the personal data on the basis of his or her consent or the
        processing is necessary for the performance of a contract. It should not apply
        where processing is based on a legal ground other than consent or contract.
        By its very nature, that right should not be exercised against controllers
        processing personal data in the exercise of their public duties. It should
        therefore not apply where the processing of the personal data is necessary
        for compliance with a legal obligation to which the controller is subject
        or for the performance of a task carried out in the public interest or in
        the exercise of an official authority vested in the controller. The data subject's
        right to transmit or receive personal data concerning him or her should not
        create an obligation for the controllers to adopt or maintain processing systems
        which are technically compatible. Where, in a certain set of personal data,
        more than one data subject is concerned, the right to receive the personal
        data should be without prejudice to the rights and freedoms of other data
        subjects in accordance with this Regulation. Furthermore, that right should
        not prejudice the right of the data subject to obtain the erasure of personal
        data and the limitations of that right as set out in this Regulation and should,
        in particular, not imply the erasure of personal data concerning the data
        subject which have been provided by him or her for the performance of a contract
        to the extent that and for as long as the personal data are necessary for
        the performance of that contract. Where technically feasible, the data subject
        should have the right to have the personal data transmitted directly from
        one controller to another.
      translations:
        sv:
          name: "Sk\xE4l 68"
          description: "F\xF6r att ytterligare f\xF6rb\xE4ttra kontrollen \xF6ver\
            \ sina egna uppgifter b\xF6r den registrerade, om personuppgifterna behandlas\
            \ automatiskt, ocks\xE5 till\xE5tas att motta de personuppgifter som r\xF6\
            r honom eller henne, som han eller hon har tillhandah\xE5llit den personuppgiftsansvarige,\
            \ i\_ett strukturerat, allm\xE4nt anv\xE4nt, maskinl\xE4sbart och kompatibelt\
            \ format och \xF6verf\xF6ra dessa till en annan personuppgiftsansvarig.\
            \ Personuppgiftsansvariga b\xF6r uppmuntras att utveckla kompatibla format\
            \ som m\xF6jligg\xF6r dataportabilitet. Denna r\xE4ttighet b\xF6r vara\
            \ till\xE4mplig om den registrerade har tillhandah\xE5llit uppgifterna\
            \ efter att ha l\xE4mnat sitt samtycke eller om behandlingen \xE4r n\xF6\
            dv\xE4ndig f\xF6r att ett avtal ska kunna genomf\xF6ras. Den b\xF6r inte\
            \ vara till\xE4mplig om behandlingen utg\xE5r fr\xE5n en annan r\xE4ttslig\
            \ grund \xE4n samtycke eller avtal. P\xE5 grund av sin art b\xF6r denna\
            \ r\xE4ttighet inte ut\xF6vas mot personuppgiftsansvariga som behandlar\
            \ personuppgifter som ett led i myndighetsut\xF6vning. D\xE4rf\xF6r b\xF6\
            r den inte vara till\xE4mplig n\xE4r behandlingen av personuppgifterna\
            \ \xE4r n\xF6dv\xE4ndig f\xF6r att fullg\xF6ra en r\xE4ttslig f\xF6rpliktelse\
            \ som \xE5vilar den personuppgiftsansvarige eller f\xF6r att utf\xF6ra\
            \ en uppgift av allm\xE4nt intresse eller som ett led i\_myndighetsut\xF6\
            vning som utf\xF6rs av den personuppgiftsansvarige. Den registrerades\
            \ r\xE4tt att \xF6verf\xF6ra eller motta personuppgifter som r\xF6r honom\
            \ eller henne inneb\xE4r inte n\xE5gon skyldighet f\xF6r de personuppgiftsansvariga\
            \ att inf\xF6ra eller uppr\xE4tth\xE5lla behandlingssystem som \xE4r tekniskt\
            \ kompatibla. Om mer \xE4n en registrerad ber\xF6rs inom en viss upps\xE4\
            ttning personuppgifter, b\xF6r r\xE4tten att motta personuppgifterna inte\
            \ inverka p\xE5 andra registrerades r\xE4ttigheter och friheter enligt\
            \ denna f\xF6rordning. Denna r\xE4ttighet b\xF6r inte heller p\xE5verka\
            \ den registrerades r\xE4tt att f\xE5 till st\xE5nd radering av personuppgifter\
            \ och de inskr\xE4nkningar av denna r\xE4ttighet vilka anges i denna f\xF6\
            rordning och b\xF6r i synnerhet inte medf\xF6ra radering av personuppgifter\
            \ om den registrerade som denne har l\xE4mnat f\xF6r genomf\xF6rande av\
            \ ett avtal, i den utstr\xE4ckning och s\xE5 l\xE4nge som personuppgifterna\
            \ kr\xE4vs f\xF6r genomf\xF6rande av avtalet. Om det \xE4r tekniskt m\xF6\
            jligt, b\xF6r den registrerade ha r\xE4tt till direkt \xF6verf\xF6ring\
            \ av personuppgifterna fr\xE5n en personuppgiftsansvarig till en annan."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-69
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 69
      description: Where personal data might lawfully be processed because processing
        is necessary for the performance of a task carried out in the public interest
        or in the exercise of official authority vested in the controller, or on grounds
        of the legitimate interests of a controller or a third party, a data subject
        should, nevertheless, be entitled to object to the processing of any personal
        data relating to his or her particular situation. It should be for the controller
        to demonstrate that its compelling legitimate interest overrides the interests
        or the fundamental rights and freedoms of the data subject.
      translations:
        sv:
          name: "Sk\xE4l 69"
          description: "N\xE4r personuppgifter lagligen f\xE5r behandlas, eftersom\
            \ behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att utf\xF6ra en uppgift av\
            \ allm\xE4nt intresse eller som ett led i en myndighetsut\xF6vning som\
            \ utf\xF6rs av den personuppgiftsansvarige, eller p\xE5 grund av en personuppgiftsansvarigs\
            \ eller en tredje parts ber\xE4ttigade intressen, b\xF6r alla registrerade\
            \ \xE4nd\xE5 ha r\xE4tt att g\xF6ra inv\xE4ndningar mot behandling av\
            \ personuppgifter som r\xF6r de registrerades s\xE4rskilda situation.\
            \ Det b\xF6r ankomma p\xE5 den personuppgiftsansvarige att visa att dennes\
            \ tvingande ber\xE4ttigade intressen v\xE4ger tyngre \xE4n den registrerades\
            \ intressen eller grundl\xE4ggande r\xE4ttigheter och friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-70
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 70
      description: Where personal data are processed for the purposes of direct marketing,
        the data subject should have the right to object to such processing, including
        profiling to the extent that it is related to such direct marketing, whether
        with regard to initial or further processing, at any time and free of charge.
        That right should be explicitly brought to the attention of the data subject
        and presented clearly and separately from any other information.
      translations:
        sv:
          name: "Sk\xE4l 70"
          description: "Om personuppgifter behandlas f\xF6r direktmarknadsf\xF6ring,\
            \ b\xF6r den registrerade, oavsett om det handlar om inledande eller ytterligare\
            \ behandling, ha r\xE4tt att n\xE4r som helst kostnadsfritt inv\xE4nda\
            \ mot s\xE5dan behandling, inbegripet profilering, i den m\xE5n denna\
            \ \xE4r kopplad till direktmarknadsf\xF6ring. Denna r\xE4ttighet b\xF6\
            r uttryckligen meddelas den registrerade och redovisas tydligt, klart\
            \ och \xE5tskilt fr\xE5n annan information."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-71
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 71
      description: "The data subject should have the right not to be subject to a\
        \ decision, which may include a measure, evaluating personal aspects relating\
        \ to him or her which is based solely on automated processing and which produces\
        \ legal effects concerning him or her or similarly significantly affects him\
        \ or her, such as automatic refusal of an online credit application or e-recruiting\
        \ practices without any human intervention. Such processing includes \u2018\
        profiling\u2019 that consists of any form of automated processing of personal\
        \ data evaluating the personal aspects relating to a natural person, in particular\
        \ to analyse or predict aspects concerning the data subject's performance\
        \ at work, economic situation, health, personal preferences or interests,\
        \ reliability or behaviour, location or movements, where it produces legal\
        \ effects concerning him or her or similarly significantly affects him or\
        \ her. However, decision-making based on such processing, including profiling,\
        \ should be allowed where expressly authorised by Union or Member State law\
        \ to which the controller is subject, including for fraud and tax-evasion\
        \ monitoring and prevention purposes conducted in accordance with the regulations,\
        \ standards and recommendations of Union institutions or national oversight\
        \ bodies and to ensure the security and reliability of a service provided\
        \ by the controller, or necessary for the entering or performance of a contract\
        \ between the data subject and a controller, or when the data subject has\
        \ given his or her explicit consent. In any case, such processing should be\
        \ subject to suitable safeguards, which should include specific information\
        \ to the data subject and the right to obtain human intervention, to express\
        \ his or her point of view, to obtain an explanation of the decision reached\
        \ after such assessment and to challenge the decision. Such measure should\
        \ not concern a child."
      translations:
        sv:
          name: "Sk\xE4l 71"
          description: "Den registrerade b\xF6r ha r\xE4tt att inte bli f\xF6rem\xE5\
            l f\xF6r ett beslut, vilket kan inbegripa en \xE5tg\xE4rd, med bed\xF6\
            mning av personliga aspekter r\xF6rande honom eller henne, vilket enbart\
            \ grundas p\xE5 automatiserad behandling och medf\xF6r r\xE4ttsverkan\
            \ f\xF6r honom eller henne eller p\xE5 liknande s\xE4tt i betydande grad\
            \ p\xE5verkar honom eller henne, s\xE5som ett automatiserat avslag p\xE5\
            \ en kreditans\xF6kan online eller e-rekrytering utan personlig kontakt.\
            \ S\xE5dan behandling omfattar \u201Dprofilering\u201D i form av automatisk\
            \ behandling av personuppgifter med bed\xF6mning av personliga aspekter\
            \ r\xF6rande en fysisk person, s\xE4rskilt f\xF6r att analysera eller\
            \ f\xF6rutse aspekter avseende den registrerades arbetsprestation, ekonomiska\
            \ situation, h\xE4lsa, personliga preferenser eller intressen, p\xE5litlighet\
            \ eller beteende, vistelseort eller f\xF6rflyttningar, i den m\xE5n dessa\
            \ har r\xE4ttsverkan r\xF6rande honom eller henne eller p\xE5 liknande\
            \ s\xE4tt i betydande grad p\xE5verkar honom eller henne. Beslutsfattande\
            \ grundat p\xE5 s\xE5dan behandling, inbegripet profilering, b\xF6r dock\
            \ till\xE5tas n\xE4r det uttryckligen beviljas genom unionsr\xE4tten eller\
            \ medlemsstaternas nationella r\xE4tt som den personuppgiftsansvarige\
            \ omfattas av, inbegripet f\xF6r s\xE5dan \xF6vervakning och s\xE5dant\
            \ f\xF6rebyggande av bedr\xE4gerier och skatteundandragande som genomf\xF6\
            rs i enlighet med unionsinstitutionernas eller de nationella tillsynsorganens\
            \ best\xE4mmelser, standarder och rekommendationer samt f\xF6r att s\xF6\
            rja f\xF6r tillf\xF6rlitlighet hos en tj\xE4nst som tillhandah\xE5lls\
            \ av den personuppgiftsansvarige, eller n\xE4r det kr\xE4vs f\xF6r ing\xE5\
            ende eller genomf\xF6rande av ett avtal mellan den registrerade och en\
            \ personuppgiftsansvarig eller den registrerade har gett sitt uttryckliga\
            \ samtycke. Denna form av uppgiftsbehandling b\xF6r under alla omst\xE4\
            ndigheter omg\xE4rdas av l\xE4mpliga skydds\xE5tg\xE4rder, som b\xF6r\
            \ inkludera specifik information till den registrerade och r\xE4tt till\
            \ m\xE4nskligt ingripande, att framf\xF6ra sina synpunkter, att erh\xE5\
            lla en f\xF6rklaring till det beslut som fattas efter s\xE5dan bed\xF6\
            mning och att \xF6verklaga beslutet. S\xE5dana \xE5tg\xE4rder b\xF6r inte\
            \ g\xE4lla barn."
    - urn: urn:intuitem:risk:req_node:gdpr:node74
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      description: In order to ensure fair and transparent processing in respect of
        the data subject, taking into account the specific circumstances and context
        in which the personal data are processed, the controller should use appropriate
        mathematical or statistical procedures for the profiling, implement technical
        and organisational measures appropriate to ensure, in particular, that factors
        which result in inaccuracies in personal data are corrected and the risk of
        errors is minimised, secure personal data in a manner that takes account of
        the potential risks involved for the interests and rights of the data subject
        and that prevents, inter alia, discriminatory effects on natural persons on
        the basis of racial or ethnic origin, political opinion, religion or beliefs,
        trade union membership, genetic or health status or sexual orientation, or
        that result in measures having such an effect. Automated decision-making and
        profiling based on special categories of personal data should be allowed only
        under specific conditions.
      translations:
        sv:
          description: "I syfte att s\xF6rja f\xF6r r\xE4ttvis och transparent behandling\
            \ med avseende p\xE5 den registrerade, med beaktande av omst\xE4ndigheterna\
            \ och det sammanhang i\_vilket personuppgifterna behandlas, b\xF6r den\
            \ personuppgiftsansvarige anv\xE4nda adekvata matematiska eller statistiska\
            \ f\xF6rfaranden f\xF6r profilering, genomf\xF6ra tekniska och organisatoriska\
            \ \xE5tg\xE4rder som framf\xF6r allt s\xE4kerst\xE4ller att faktorer som\
            \ kan medf\xF6ra felaktigheter i personuppgifter korrigeras och att risken\
            \ f\xF6r fel minimeras samt s\xE4kra personuppgifterna p\xE5 s\xE5dant\
            \ s\xE4tt att man beaktar potentiella risker f\xF6r den registrerades\
            \ intressen och r\xE4ttigheter och f\xF6rhindrar bland annat diskriminerande\
            \ effekter f\xF6r fysiska personer, p\xE5 grund av ras eller etniskt ursprung,\
            \ politiska \xE5sikter, religion eller \xF6vertygelse, medlemskap i fackf\xF6\
            reningar, genetisk status eller h\xE4lsostatus eller sexuell l\xE4ggning,\
            \ eller som leder till \xE5tg\xE4rder som f\xE5r s\xE5dana effekter. Automatiserat\
            \ beslutsfattande och profilering baserat p\xE5 s\xE4rskilda kategorier\
            \ av personuppgifter b\xF6r endast till\xE5tas p\xE5 s\xE4rskilda villkor."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-72
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 72
      description: "Profiling is subject to the rules of this Regulation governing\
        \ the processing of personal data, such as the legal grounds for processing\
        \ or data protection principles. The European Data Protection Board established\
        \ by this Regulation (the \u2018Board\u2019) should be able to issue guidance\
        \ in that context."
      translations:
        sv:
          name: "Sk\xE4l 72"
          description: "Profilering omfattas av denna f\xF6rordnings best\xE4mmelser\
            \ om behandling av personuppgifter, s\xE5som de r\xE4ttsliga grunderna\
            \ f\xF6r behandlingen och principer f\xF6r dataskydd. Europeiska dataskyddsstyrelsen\
            \ som inr\xE4ttas genom denna f\xF6rordning (nedan kallad\_styrelsen)\
            \ b\xF6r kunna utf\xE4rda riktlinjer i detta avseende."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-73
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 73
      description: Restrictions concerning specific principles and the rights of information,
        access to and rectification or erasure of personal data, the right to data
        portability, the right to object, decisions based on profiling, as well as
        the communication of a personal data breach to a data subject and certain
        related obligations of the controllers may be imposed by Union or Member State
        law, as far as necessary and proportionate in a democratic society to safeguard
        public security, including the protection of human life especially in response
        to natural or manmade disasters, the prevention, investigation and prosecution
        of criminal offences or the execution of criminal penalties, including the
        safeguarding against and the prevention of threats to public security, or
        of breaches of ethics for regulated professions, other important objectives
        of general public interest of the Union or of a Member State, in particular
        an important economic or financial interest of the Union or of a Member State,
        the keeping of public registers kept for reasons of general public interest,
        further processing of archived personal data to provide specific information
        related to the political behaviour under former totalitarian state regimes
        or the protection of the data subject or the rights and freedoms of others,
        including social protection, public health and humanitarian purposes. Those
        restrictions should be in accordance with the requirements set out in the
        Charter and in the European Convention for the Protection of Human Rights
        and Fundamental Freedoms.
      translations:
        sv:
          name: "Sk\xE4l 73"
          description: "Begr\xE4nsningar med avseende p\xE5 specifika principer och\
            \ r\xE4tten till information, tillg\xE5ng till och r\xE4ttelse eller radering\
            \ av personuppgifter, r\xE4tten till dataportabilitet, r\xE4tten att g\xF6\
            ra inv\xE4ndningar, profileringsbaserade beslut samt information till\
            \ den registrerade om personuppgiftsincidenter och vissa av den personuppgiftsansvariges\
            \ relaterade skyldigheter kan inf\xF6ras genom unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt, i den m\xE5n de \xE4r n\xF6dv\xE4ndiga och proportionella\
            \ i\_ett demokratiskt samh\xE4lle f\xF6r att uppr\xE4tth\xE5lla den allm\xE4\
            nna s\xE4kerheten, exempelvis f\xF6r att skydda m\xE4nniskoliv, s\xE4\
            rskilt vid naturkatastrofer eller katastrofer framkallade av m\xE4nniskan,\
            \ vid f\xF6rebyggande, f\xF6rhindrande, utredning och lagf\xF6ring av\
            \ brott eller verkst\xE4llande av straffr\xE4ttsliga sanktioner, inbegripet\
            \ skydd mot samt f\xF6rebyggande och f\xF6rhindrande av hot mot den allm\xE4\
            nna s\xE4kerheten eller \xF6vertr\xE4delser av etiska principer f\xF6\
            r reglerade yrken, vad g\xE4ller unionens eller en medlemsstats \xF6vriga\
            \ viktiga m\xE5l av allm\xE4nt intresse, s\xE4rskilt om de \xE4r av stort\
            \ ekonomiskt eller finansiellt intresse f\xF6r unionen eller en medlemsstat,\
            \ f\xF6rande av offentliga register som f\xF6rs av h\xE4nsyn till ett\
            \ allm\xE4nt intresse, ytterligare behandling av arkiverade personuppgifter\
            \ f\xF6r att tillhandah\xE5lla specifik information om politiskt beteende\
            \ under tidigare totalit\xE4ra regimer eller skydd av den registrerade\
            \ eller andras r\xE4ttigheter och friheter, inklusive socialt skydd, folkh\xE4\
            lsa och humanit\xE4ra sk\xE4l. Dessa begr\xE4nsningar b\xF6r \xF6verensst\xE4\
            mma med kraven i stadgan och den europeiska konventionen om skydd f\xF6\
            r de m\xE4nskliga r\xE4ttigheterna och de grundl\xE4ggande friheterna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-74
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 74
      description: The responsibility and liability of the controller for any processing
        of personal data carried out by the controller or on the controller's behalf
        should be established. In particular, the controller should be obliged to
        implement appropriate and effective measures and be able to demonstrate the
        compliance of processing activities with this Regulation, including the effectiveness
        of the measures. Those measures should take into account the nature, scope,
        context and purposes of the processing and the risk to the rights and freedoms
        of natural persons.
      translations:
        sv:
          name: "Sk\xE4l 74"
          description: "Personuppgiftsansvariga b\xF6r \xE5l\xE4ggas ansvaret f\xF6\
            r all behandling av personuppgifter som de utf\xF6r eller som utf\xF6\
            rs p\xE5 deras v\xE4gnar. Personuppgiftsansvariga b\xF6r s\xE4rskilt vara\
            \ skyldiga att vidta l\xE4mpliga och effektiva \xE5tg\xE4rder och kunna\
            \ visa att behandlingen \xE4r f\xF6renlig med denna f\xF6rordning, \xE4\
            ven vad g\xE4ller \xE5tg\xE4rdernas effektivitet. Man b\xF6r inom dessa\
            \ \xE5tg\xE4rder beakta behandlingens art, omfattning, sammanhang och\
            \ \xE4ndam\xE5l samt risken f\xF6r fysiska personers r\xE4ttigheter och\
            \ friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-75
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 75
      description: 'The risk to the rights and freedoms of natural persons, of varying
        likelihood and severity, may result from personal data processing which could
        lead to physical, material or non-material damage, in particular: where the
        processing may give rise to discrimination, identity theft or fraud, financial
        loss, damage to the reputation, loss of confidentiality of personal data protected
        by professional secrecy, unauthorised reversal of pseudonymisation, or any
        other significant economic or social disadvantage; where data subjects might
        be deprived of their rights and freedoms or prevented from exercising control
        over their personal data; where personal data are processed which reveal racial
        or ethnic origin, political opinions, religion or philosophical beliefs, trade
        union membership, and the processing of genetic data, data concerning health
        or data concerning sex life or criminal convictions and offences or related
        security measures; where personal aspects are evaluated, in particular analysing
        or predicting aspects concerning performance at work, economic situation,
        health, personal preferences or interests, reliability or behaviour, location
        or movements, in order to create or use personal profiles; where personal
        data of vulnerable natural persons, in particular of children, are processed;
        or where processing involves a large amount of personal data and affects a
        large number of data subjects.'
      translations:
        sv:
          name: "Sk\xE4l 75"
          description: "Risken f\xF6r fysiska personers r\xE4ttigheter och friheter,\
            \ av varierande sannolikhetsgrad och allvar, kan uppkomma till f\xF6ljd\
            \ av personuppgiftsbehandling som skulle kunna medf\xF6ra fysiska, materiella\
            \ eller immateriella skador, i synnerhet om behandlingen kan leda till\
            \ diskriminering, identitetsst\xF6ld eller bedr\xE4geri, ekonomisk f\xF6\
            rlust, skadat anseende, f\xF6rlust av konfidentialitet n\xE4r det g\xE4\
            ller personuppgifter som omfattas av tystnadsplikt, obeh\xF6rigt h\xE4\
            vande av pseudonymisering eller annan betydande ekonomisk eller social\
            \ nackdel, om registrerade kan ber\xF6vas sina r\xE4ttigheter och friheter\
            \ eller hindras att ut\xF6va kontroll \xF6ver sina personuppgifter, om\
            \ personuppgifter behandlas som avsl\xF6jar ras eller etniskt ursprung,\
            \ politiska \xE5sikter, religion eller \xF6vertygelse eller medlemskap\
            \ i fackf\xF6rening, om genetiska uppgifter, uppgifter om h\xE4lsa eller\
            \ sexualliv eller f\xE4llande domar i brottm\xE5l samt \xF6vertr\xE4delser\
            \ eller d\xE4rmed sammanh\xE4ngande s\xE4kerhets\xE5tg\xE4rder behandlas,\
            \ om personliga aspekter bed\xF6ms, framf\xF6r allt analyser eller f\xF6\
            ruts\xE4gelser betr\xE4ffande s\xE5dant som r\xF6r arbetsprestationer,\
            \ ekonomisk st\xE4llning, h\xE4lsa, personliga preferenser eller intressen,\
            \ tillf\xF6rlitlighet eller beteende, vistelseort eller f\xF6rflyttningar,\
            \ i syfte att skapa eller anv\xE4nda personliga profiler, om det sker\
            \ behandling av personuppgifter r\xF6rande s\xE5rbara fysiska personer,\
            \ framf\xF6r allt barn, eller om behandlingen inbegriper ett stort antal\
            \ personuppgifter och g\xE4ller ett stort antal registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-76
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 76
      description: The likelihood and severity of the risk to the rights and freedoms
        of the data subject should be determined by reference to the nature, scope,
        context and purposes of the processing. Risk should be evaluated on the basis
        of an objective assessment, by which it is established whether data processing
        operations involve a risk or a high risk.
      translations:
        sv:
          name: "Sk\xE4l 76"
          description: "Hur sannolik och allvarlig risken f\xF6r den registrerades\
            \ r\xE4ttigheter och friheter \xE4r b\xF6r fastst\xE4llas utifr\xE5n behandlingens\
            \ art, omfattning, sammanhang och \xE4ndam\xE5l. Risken b\xF6r utv\xE4\
            rderas p\xE5 grundval av en objektiv bed\xF6mning, genom vilken det fastst\xE4\
            lls huruvida uppgiftsbehandlingen inbegriper en risk eller en h\xF6g risk."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-77
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 77
      description: Guidance on the implementation of appropriate measures and on the
        demonstration of compliance by the controller or the processor, especially
        as regards the identification of the risk related to the processing, their
        assessment in terms of origin, nature, likelihood and severity, and the identification
        of best practices to mitigate the risk, could be provided in particular by
        means of approved codes of conduct, approved certifications, guidelines provided
        by the Board or indications provided by a data protection officer. The Board
        may also issue guidelines on processing operations that are considered to
        be unlikely to result in a high risk to the rights and freedoms of natural
        persons and indicate what measures may be sufficient in such cases to address
        such risk.
      translations:
        sv:
          name: "Sk\xE4l 77"
          description: "V\xE4gledning f\xF6r den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets genomf\xF6rande av l\xE4mpliga \xE5tg\xE4rder och f\xF6r p\xE5visande\
            \ av att behandlingen \xE4r f\xF6renlig med denna f\xF6rordning, s\xE4\
            rskilt n\xE4r det g\xE4ller att kartl\xE4gga den risk som \xE4r f\xF6\
            rknippad med behandlingen och bed\xF6ma dess ursprung, art, sannolikhetsgrad\
            \ och allvar samt fastst\xE4lla b\xE4sta praxis f\xF6r att minska risken,\
            \ kan framf\xF6r allt ges genom godk\xE4nda uppf\xF6randekoder, godk\xE4\
            nd certifiering, riktlinjer fr\xE5n styrelsen eller genom anvisningar\
            \ fr\xE5n ett dataskyddsombud. Styrelsen kan ocks\xE5 utf\xE4rda riktlinjer\
            \ f\xF6r uppgiftsbehandling som inte bed\xF6ms medf\xF6ra n\xE5gon h\xF6\
            g risk f\xF6r fysiska personers r\xE4ttigheter och friheter samt ange\
            \ vilka \xE5tg\xE4rder som i s\xE5dana fall kan vara tillr\xE4ckliga f\xF6\
            r att bem\xF6ta en s\xE5dan risk."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-78
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 78
      description: The protection of the rights and freedoms of natural persons with
        regard to the processing of personal data require that appropriate technical
        and organisational measures be taken to ensure that the requirements of this
        Regulation are met. In order to be able to demonstrate compliance with this
        Regulation, the controller should adopt internal policies and implement measures
        which meet in particular the principles of data protection by design and data
        protection by default. Such measures could consist, inter alia, of minimising
        the processing of personal data, pseudonymising personal data as soon as possible,
        transparency with regard to the functions and processing of personal data,
        enabling the data subject to monitor the data processing, enabling the controller
        to create and improve security features. When developing, designing, selecting
        and using applications, services and products that are based on the processing
        of personal data or process personal data to fulfil their task, producers
        of the products, services and applications should be encouraged to take into
        account the right to data protection when developing and designing such products,
        services and applications and, with due regard to the state of the art, to
        make sure that controllers and processors are able to fulfil their data protection
        obligations. The principles of data protection by design and by default should
        also be taken into consideration in the context of public tenders.
      translations:
        sv:
          name: "Sk\xE4l 78"
          description: "Skyddet av fysiska personers r\xE4ttigheter och friheter i\
            \ samband med behandling av personuppgifter f\xF6ruts\xE4tter att l\xE4\
            mpliga tekniska och organisatoriska \xE5tg\xE4rder vidtas, s\xE5 att kraven\
            \ i denna f\xF6rordning uppfylls. F\xF6r att kunna visa att denna f\xF6\
            rordning f\xF6ljs b\xF6r den personuppgiftsansvarige anta interna strategier\
            \ och vidta \xE5tg\xE4rder, s\xE4rskilt f\xF6r att uppfylla principerna\
            \ om inbyggt dataskydd och dataskydd som standard. S\xE5dana \xE5tg\xE4\
            rder kan bland annat best\xE5 av att uppgiftsbehandlingen minimeras, att\
            \ personuppgifter snarast m\xF6jligt pseudonymiseras, att \xF6ppenhet\
            \ om personuppgifternas syfte och behandling iakttas, att den registrerade\
            \ f\xE5r m\xF6jlighet att \xF6vervaka uppgiftsbehandlingen och att den\
            \ personuppgiftsansvarige f\xE5r m\xF6jlighet att skapa och f\xF6rb\xE4\
            ttra s\xE4kerhetsanordningar. Vid utveckling, utformning, urval och anv\xE4\
            ndning av applikationer, tj\xE4nster och produkter som \xE4r baserade\
            \ p\xE5 behandling av personuppgifter eller behandlar personuppgifter\
            \ f\xF6r att uppfylla sitt syfte b\xF6r producenterna av dessa produkter,\
            \ tj\xE4nster och applikationer uppmanas att beakta r\xE4tten till dataskydd\
            \ n\xE4r s\xE5dana produkter, tj\xE4nster och applikationer utvecklas\
            \ och utformas och att, med tillb\xF6rlig h\xE4nsyn till den tekniska\
            \ utvecklingen, s\xE4kerst\xE4lla att personuppgiftsansvariga och personuppgiftsbitr\xE4\
            den kan fullg\xF6ra sina skyldigheter avseende dataskydd. Principerna\
            \ om inbyggt dataskydd och dataskydd som standard b\xF6r ocks\xE5 beaktas\
            \ vid offentliga upphandlingar."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-79
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 79
      description: The protection of the rights and freedoms of data subjects as well
        as the responsibility and liability of controllers and processors, also in
        relation to the monitoring by and measures of supervisory authorities, requires
        a clear allocation of the responsibilities under this Regulation, including
        where a controller determines the purposes and means of the processing jointly
        with other controllers or where a processing operation is carried out on behalf
        of a controller.
      translations:
        sv:
          name: "Sk\xE4l 79"
          description: "Skyddet av de registrerades r\xE4ttigheter och friheter samt\
            \ de personuppgiftsansvarigas och personuppgiftsbitr\xE4denas ansvar,\
            \ \xE4ven i f\xF6rh\xE5llande till tillsynsmyndigheternas \xF6vervakning\
            \ och \xE5tg\xE4rder, kr\xE4ver ett tydligt fastst\xE4llande av vem som\
            \ b\xE4r ansvaret enligt denna f\xF6rordning, bl.a. n\xE4r personuppgiftsansvariga\
            \ gemensamt fastst\xE4ller \xE4ndam\xE5l och medel f\xF6r en behandling\
            \ tillsammans med andra personuppgiftsansvariga eller n\xE4r en behandling\
            \ utf\xF6rs p\xE5 en personuppgiftsansvarigs v\xE4gnar."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-80
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 80
      description: Where a controller or a processor not established in the Union
        is processing personal data of data subjects who are in the Union whose processing
        activities are related to the offering of goods or services, irrespective
        of whether a payment of the data subject is required, to such data subjects
        in the Union, or to the monitoring of their behaviour as far as their behaviour
        takes place within the Union, the controller or the processor should designate
        a representative, unless the processing is occasional, does not include processing,
        on a large scale, of special categories of personal data or the processing
        of personal data relating to criminal convictions and offences, and is unlikely
        to result in a risk to the rights and freedoms of natural persons, taking
        into account the nature, context, scope and purposes of the processing or
        if the controller is a public authority or body. The representative should
        act on behalf of the controller or the processor and may be addressed by any
        supervisory authority. The representative should be explicitly designated
        by a written mandate of the controller or of the processor to act on its behalf
        with regard to its obligations under this Regulation. The designation of such
        a representative does not affect the responsibility or liability of the controller
        or of the processor under this Regulation. Such a representative should perform
        its tasks according to the mandate received from the controller or processor,
        including cooperating with the competent supervisory authorities with regard
        to any action taken to ensure compliance with this Regulation. The designated
        representative should be subject to enforcement proceedings in the event of
        non-compliance by the controller or processor.
      translations:
        sv:
          name: "Sk\xE4l 80"
          description: "N\xE4r personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            den som inte \xE4r etablerade inom unionen behandlar personuppgifter om\
            \ registrerade som befinner sig inom unionen och det bakomliggande syftet\
            \ med uppgiftsbehandlingen \xE4r att erbjuda de registrerade personerna\
            \ i\_unionen varor eller tj\xE4nster, oberoende av om de registrerade\
            \ personerna m\xE5ste betala f\xF6r dem, eller att \xF6vervaka deras beteende\
            \ i den m\xE5n beteendet \xE4ger rum i unionen, b\xF6r de personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4dena utn\xE4mna en f\xF6retr\xE4dare, s\xE5\
            vida inte behandlingen endast \xE4r tillf\xE4llig, inte omfattar behandling\
            \ i stor omfattning av s\xE4rskilda kategorier av personuppgifter eller\
            \ behandling av personuppgifter om f\xE4llande domar i brottm\xE5l samt\
            \ \xF6vertr\xE4delser och det \xE4r osannolikt att den inbegriper en risk\
            \ f\xF6r fysiska personers r\xE4ttigheter och friheter, med beaktande\
            \ av behandlingens art, sammanhang, omfattning och \xE4ndam\xE5l eller\
            \ om den personuppgiftsansvarige \xE4r en myndighet eller ett organ. F\xF6\
            retr\xE4daren b\xF6r agera p\xE5 den personuppgiftsansvariges eller p\xE5\
            \ personuppgiftsbitr\xE4dets v\xE4gnar och kan kontaktas av samtliga tillsynsmyndigheter.\
            \ F\xF6retr\xE4daren b\xF6r uttryckligen utses genom en skriftlig fullmakt\
            \ fr\xE5n den personuppgiftsansvarige eller fr\xE5n personuppgiftsbitr\xE4\
            det att agera p\xE5 dennes v\xE4gnar med avseende p\xE5 dennes skyldigheter\
            \ enligt denna f\xF6rordning. Utn\xE4mningen av f\xF6retr\xE4daren inverkar\
            \ inte p\xE5 den personuppgiftsansvariges eller p\xE5 personuppgiftsbitr\xE4\
            dets ansvar enligt denna f\xF6rordning. F\xF6retr\xE4daren b\xF6r utf\xF6\
            ra sina uppgifter i enlighet med erh\xE5llen fullmakt fr\xE5n den personuppgiftsansvarige\
            \ eller fr\xE5n personuppgiftsbitr\xE4det, vilket inbegriper samarbete\
            \ med de beh\xF6riga tillsynsmyndigheterna i fr\xE5ga om alla \xE5tg\xE4\
            rder som vidtas f\xF6r att s\xF6rja f\xF6r efterlevnad av denna f\xF6\
            rordning. Den utsedda f\xF6retr\xE4daren b\xF6r underkastas verkst\xE4\
            llighetsf\xF6rfaranden i h\xE4ndelse den personuppgiftsansvarige eller\
            \ personuppgiftsbitr\xE4det inte uppfyller sina skyldigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-81
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 81
      description: To ensure compliance with the requirements of this Regulation in
        respect of the processing to be carried out by the processor on behalf of
        the controller, when entrusting a processor with processing activities, the
        controller should use only processors providing sufficient guarantees, in
        particular in terms of expert knowledge, reliability and resources, to implement
        technical and organisational measures which will meet the requirements of
        this Regulation, including for the security of processing. The adherence of
        the processor to an approved code of conduct or an approved certification
        mechanism may be used as an element to demonstrate compliance with the obligations
        of the controller. The carrying-out of processing by a processor should be
        governed by a contract or other legal act under Union or Member State law,
        binding the processor to the controller, setting out the subject- matter and
        duration of the processing, the nature and purposes of the processing, the
        type of personal data and categories of data subjects, taking into account
        the specific tasks and responsibilities of the processor in the context of
        the processing to be carried out and the risk to the rights and freedoms of
        the data subject. The controller and processor may choose to use an individual
        contract or standard contractual clauses which are adopted either directly
        by the Commission or by a supervisory authority in accordance with the consistency
        mechanism and then adopted by the Commission. After the completion of the
        processing on behalf of the controller, the processor should, at the choice
        of the controller, return or delete the personal data, unless there is a requirement
        to store the personal data under Union or Member State law to which the processor
        is subject.
      translations:
        sv:
          name: "Sk\xE4l 81"
          description: "F\xF6r att se till att kraven i denna f\xF6rordning uppfylls\
            \ vad g\xE4ller behandling som av ett personuppgiftsbitr\xE4de ska utf\xF6\
            ras p\xE5 en personuppgiftsansvarigs v\xE4gnar ska den personuppgiftsansvarige,\
            \ n\xE4r denne anf\xF6rtror behandling \xE5t ett personuppgiftsbitr\xE4\
            de, endast anv\xE4nda personuppgiftsbitr\xE4den som ger tillr\xE4ckliga\
            \ garantier, i synnerhet i fr\xE5ga om sakkunskap, tillf\xF6rlitlighet\
            \ och resurser, f\xF6r att genomf\xF6ra tekniska och organisatoriska \xE5\
            tg\xE4rder som uppfyller kraven i denna f\xF6rordning, bl.a. vad g\xE4\
            ller s\xE4kerhet i samband med behandlingen av uppgifter. Personuppgiftsbitr\xE4\
            dets anslutning till en godk\xE4nd uppf\xF6randekod eller en godk\xE4\
            nd certifieringsmekanism kan anv\xE4ndas som ett s\xE4tt att p\xE5visa\
            \ att den personuppgiftsansvarige fullg\xF6r sina skyldigheter. N\xE4\
            r uppgifter behandlas av ett personuppgiftsbitr\xE4de, b\xF6r hanteringen\
            \ regleras genom ett avtal eller en annan r\xE4ttsakt enligt unionsr\xE4\
            tten eller medlemsstaternas nationella r\xE4tt mellan personuppgiftsbitr\xE4\
            det och den personuppgiftsansvarige, d\xE4r f\xF6rem\xE5let f\xF6r behandlingen,\
            \ behandlingens varaktighet, art och \xE4ndam\xE5l, typen av personuppgifter\
            \ och kategorier av registrerade anges, med beaktande av personuppgiftsbitr\xE4\
            dets specifika arbets- och ansvarsuppgifter inom ramen f\xF6r den behandling\
            \ som ska utf\xF6ras och risken med avseende p\xE5 den registrerades r\xE4\
            ttigheter och friheter. Den personuppgiftsansvarige och personuppgiftsbitr\xE4\
            det f\xE5r v\xE4lja att anv\xE4nda sig av ett enskilt avtal eller standardavtalsklausuler\
            \ som antingen antas direkt av kommissionen eller av en tillsynsmyndighet\
            \ i enlighet med mekanismen f\xF6r enhetlighet och d\xE4refter antas av\
            \ kommissionen. Efter det att behandlingen p\xE5 den personuppgiftsansvariges\
            \ v\xE4gnar har avslutats, b\xF6r personuppgiftsbitr\xE4det \xE5terl\xE4\
            mna eller radera personuppgifterna, beroende p\xE5 vad den personuppgiftsansvarige\
            \ v\xE4ljer, s\xE5vida inte lagring av personuppgifterna kr\xE4vs enligt\
            \ den unionsr\xE4tt eller medlemsstaternas nationella r\xE4tt som personuppgiftsbitr\xE4\
            det omfattas av."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-82
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 82
      description: In order to demonstrate compliance with this Regulation, the controller
        or processor should maintain records of processing activities under its responsibility.
        Each controller and processor should be obliged to cooperate with the supervisory
        authority and make those records, on request, available to it, so that it
        might serve for monitoring those processing operations.
      translations:
        sv:
          name: "Sk\xE4l 82"
          description: "F\xF6r att p\xE5visa att denna f\xF6rordning f\xF6ljs b\xF6\
            r de personuppgiftsansvariga eller personuppgiftsbitr\xE4dena f\xF6ra\
            \ register \xF6ver behandling som sker under deras ansvar. Alla personuppgiftsansvariga\
            \ och personuppgiftsbitr\xE4den b\xF6r vara skyldiga att samarbeta med\
            \ tillsynsmyndigheten och p\xE5 dennas beg\xE4ran g\xF6ra detta register\
            \ tillg\xE4ngligt, s\xE5 att det kan tj\xE4na som grund f\xF6r \xF6vervakningen\
            \ av behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-83
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 83
      description: In order to maintain security and to prevent processing in infringement
        of this Regulation, the controller or processor should evaluate the risks
        inherent in the processing and implement measures to mitigate those risks,
        such as encryption. Those measures should ensure an appropriate level of security,
        including confidentiality, taking into account the state of the art and the
        costs of implementation in relation to the risks and the nature of the personal
        data to be protected. In assessing data security risk, consideration should
        be given to the risks that are presented by personal data processing, such
        as accidental or unlawful destruction, loss, alteration, unauthorised disclosure
        of, or access to, personal data transmitted, stored or otherwise processed
        which may in particular lead to physical, material or non-material damage.
      translations:
        sv:
          name: "Sk\xE4l 83"
          description: "F\xF6r att uppr\xE4tth\xE5lla s\xE4kerheten och f\xF6rhindra\
            \ behandling som bryter mot denna f\xF6rordning b\xF6r personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den utv\xE4rdera riskerna med behandlingen\
            \ och vidta \xE5tg\xE4rder, s\xE5som kryptering, f\xF6r att minska dem.\
            \ \xC5tg\xE4rderna b\xF6r s\xE4kerst\xE4lla en l\xE4mplig s\xE4kerhetsniv\xE5\
            , inbegripet konfidentialitet, med beaktande av den senaste utvecklingen\
            \ och genomf\xF6randekostnader i f\xF6rh\xE5llande till riskerna och vilken\
            \ typ av personuppgifter som ska skyddas. Vid bed\xF6mningen av datas\xE4\
            kerhetsrisken b\xF6r man \xE4ven beakta de risker som personuppgiftsbehandling\
            \ medf\xF6r, s\xE5som f\xF6rst\xF6ring, f\xF6rlust eller \xE4ndringar\
            \ genom olycksh\xE4ndelse eller otill\xE5tna handlingar eller obeh\xF6\
            rigt r\xF6jande av eller obeh\xF6rig \xE5tkomst till de personuppgifter\
            \ som \xF6verf\xF6rts, lagrats eller p\xE5 annat s\xE4tt behandlats, framf\xF6\
            r allt n\xE4r denna kan medf\xF6ra fysisk, materiell eller immateriell\
            \ skada."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-84
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 84
      description: In order to enhance compliance with this Regulation where processing
        operations are likely to result in a high risk to the rights and freedoms
        of natural persons, the controller should be responsible for the carrying-out
        of a data protection impact assessment to evaluate, in particular, the origin,
        nature, particularity and severity of that risk. The outcome of the assessment
        should be taken into account when determining the appropriate measures to
        be taken in order to demonstrate that the processing of personal data complies
        with this Regulation. Where a data-protection impact assessment indicates
        that processing operations involve a high risk which the controller cannot
        mitigate by appropriate measures in terms of available technology and costs
        of implementation, a consultation of the supervisory authority should take
        place prior to the processing.
      translations:
        sv:
          name: "Sk\xE4l 84"
          description: "I syfte att s\xF6rja f\xF6r b\xE4ttre efterlevnad av denna\
            \ f\xF6rordning n\xE4r behandlingen sannolikt kan inneb\xE4ra en h\xF6\
            g risk f\xF6r fysiska personers r\xE4ttigheter och friheter, b\xF6r den\
            \ personuppgiftsansvarige vara ansvarig f\xF6r att en konsekvensbed\xF6\
            mning utf\xF6rs avseende datasskydd f\xF6r att bed\xF6ma framf\xF6r allt\
            \ riskens ursprung, art, s\xE4rdrag och allvar. Resultatet av denna bed\xF6\
            mning b\xF6r beaktas vid fastst\xE4llandet av de l\xE4mpliga \xE5tg\xE4\
            rder som ska vidtas f\xF6r att visa att behandlingen av personuppgifter\
            \ \xE4r f\xF6renlig med denna f\xF6rordning. I de fall en konsekvensbed\xF6\
            mning avseende dataskydd ger vid handen att uppgiftsbehandlingen medf\xF6\
            r en h\xF6g risk, som den personuppgiftsansvarige inte kan begr\xE4nsa\
            \ genom l\xE4mpliga \xE5tg\xE4rder med avseende p\xE5 tillg\xE4nglig teknik\
            \ och genomf\xF6randekostnader, b\xF6r ett samr\xE5d med tillsynsmyndigheten\
            \ ske f\xF6re behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-85
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 85
      description: A personal data breach may, if not addressed in an appropriate
        and timely manner, result in physical, material or non-material damage to
        natural persons such as loss of control over their personal data or limitation
        of their rights, discrimination, identity theft or fraud, financial loss,
        unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality
        of personal data protected by professional secrecy or any other significant
        economic or social disadvantage to the natural person concerned. Therefore,
        as soon as the controller becomes aware that a personal data breach has occurred,
        the controller should notify the personal data breach to the supervisory authority
        without undue delay and, where feasible, not later than 72 hours after having
        become aware of it, unless the controller is able to demonstrate, in accordance
        with the accountability principle, that the personal data breach is unlikely
        to result in a risk to the rights and freedoms of natural persons. Where such
        notification cannot be achieved within 72 hours, the reasons for the delay
        should accompany the notification and information may be provided in phases
        without undue further delay.
      translations:
        sv:
          name: "Sk\xE4l 85"
          description: "En personuppgiftsincident som inte snabbt \xE5tg\xE4rdas p\xE5\
            \ l\xE4mpligt s\xE4tt kan f\xF6r fysiska personer leda till fysisk, materiell\
            \ eller immateriell skada, s\xE5som f\xF6rlust av kontrollen \xF6ver de\
            \ egna personuppgifterna eller till begr\xE4nsning av deras r\xE4ttigheter,\
            \ diskriminering, identitetsst\xF6ld eller bedr\xE4geri, ekonomisk f\xF6\
            rlust, obeh\xF6rigt h\xE4vande av pseudonymisering, skadat anseende, f\xF6\
            rlust av konfidentialitet n\xE4r det g\xE4ller personuppgifter som omfattas\
            \ av tystnadsplikt, eller till annan ekonomisk eller social nackdel f\xF6\
            r den ber\xF6rda fysiska personen. S\xE5 snart en personuppgiftsansvarig\
            \ blir medveten om att en personuppgiftsincident har intr\xE4ffat, b\xF6\
            r den personuppgiftsansvarige d\xE4rf\xF6r anm\xE4la personuppgiftsincidenten\
            \ till tillsynsmyndigheten utan on\xF6digt dr\xF6jsm\xE5l och, om s\xE5\
            \ \xE4r m\xF6jligt, inom 72 timmar efter att ha blivit medveten om denna,\
            \ om inte den personuppgiftsansvarige, i enlighet med ansvarsprincipen,\
            \ kan p\xE5visa att det \xE4r osannolikt att personuppgiftsincidenten\
            \ kommer att medf\xF6ra en risk f\xF6r fysiska personers r\xE4ttigheter\
            \ och friheter. Om en s\xE5dan anm\xE4lan inte kan ske inom 72\_timmar,\
            \ b\xF6r sk\xE4len till f\xF6rdr\xF6jningen \xE5tf\xF6lja anm\xE4lan och\
            \ information f\xE5r l\xE4mnas i omg\xE5ngar utan otillb\xF6rligt vidare\
            \ dr\xF6jsm\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-86
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 86
      description: The controller should communicate to the data subject a personal
        data breach, without undue delay, where that personal data breach is likely
        to result in a high risk to the rights and freedoms of the natural person
        in order to allow him or her to take the necessary precautions. The communication
        should describe the nature of the personal data breach as well as recommendations
        for the natural person concerned to mitigate potential adverse effects. Such
        communications to data subjects should be made as soon as reasonably feasible
        and in close cooperation with the supervisory authority, respecting guidance
        provided by it or by other relevant authorities such as law-enforcement authorities.
        For example, the need to mitigate an immediate risk of damage would call for
        prompt communication with data subjects whereas the need to implement appropriate
        measures against continuing or similar personal data breaches may justify
        more time for communication.
      translations:
        sv:
          name: "Sk\xE4l 86"
          description: "Den personuppgiftsansvarige b\xF6r utan on\xF6digt dr\xF6\
            jsm\xE5l underr\xE4tta den registrerade om en personuppgiftsincident,\
            \ om personuppgiftsincidenten sannolikt kommer att medf\xF6ra en h\xF6\
            g risk f\xF6r den fysiska personens r\xE4ttigheter och friheter, s\xE5\
            \ att denne kan vidta n\xF6dv\xE4ndiga f\xF6rsiktighets\xE5tg\xE4rder.\
            \ Denna underr\xE4ttelse b\xF6r beskriva personuppgiftsincidentens art\
            \ samt inneh\xE5lla rekommendationer f\xF6r den ber\xF6rda fysiska personen\
            \ om hur de potentiella negativa effekterna kan mildras. De registrerade\
            \ b\xF6r underr\xE4ttas s\xE5 snart detta rimligtvis \xE4r m\xF6jligt,\
            \ i\_n\xE4ra samarbete med tillsynsmyndigheten och i enlighet med den\
            \ v\xE4gledning som l\xE4mnats av den eller andra relevanta myndigheter,\
            \ exempelvis brottsbek\xE4mpande myndigheter. Till exempel kr\xE4ver behovet\
            \ av att mildra en omedelbar skaderisk att de registrerade underr\xE4\
            ttas omedelbart, medan behovet av att vidta l\xE4mpliga \xE5tg\xE4rder\
            \ vid fortl\xF6pande eller likartade personuppgiftsincidenter d\xE4remot\
            \ kan motivera l\xE4ngre tid f\xF6r underr\xE4ttelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-87
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 87
      description: It should be ascertained whether all appropriate technological
        protection and organisational measures have been implemented to establish
        immediately whether a personal data breach has taken place and to inform promptly
        the supervisory authority and the data subject. The fact that the notification
        was made without undue delay should be established taking into account in
        particular the nature and gravity of the personal data breach and its consequences
        and adverse effects for the data subject. Such notification may result in
        an intervention of the supervisory authority in accordance with its tasks
        and powers laid down in this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 87"
          description: "Det b\xF6r unders\xF6kas huruvida alla l\xE4mpliga tekniska\
            \ skydds\xE5tg\xE4rder och alla l\xE4mpliga organisatoriska \xE5tg\xE4\
            rder har vidtagits f\xF6r att omedelbart fastst\xE4lla om en personuppgiftsincident\
            \ har \xE4gt rum och skyndsamt informera tillsynsmyndigheten och den registrerade.\
            \ Att en anm\xE4lan gjordes utan on\xF6digt dr\xF6jsm\xE5l b\xF6r fastst\xE4\
            llas med h\xE4nsyn tagen bl.a. till personuppgiftsincidentens art och\
            \ sv\xE5righetsgrad och dess f\xF6ljder och negativa effekter f\xF6r den\
            \ registrerade. En s\xE5dan anm\xE4lan kan leda till ett ingripande fr\xE5\
            n tillsynsmyndighetens sida i\_enlighet med dess uppgifter och befogenheter\
            \ enligt denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-88
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 88
      description: In setting detailed rules concerning the format and procedures
        applicable to the notification of personal data breaches, due consideration
        should be given to the circumstances of that breach, including whether or
        not personal data had been protected by appropriate technical protection measures,
        effectively limiting the likelihood of identity fraud or other forms of misuse.
        Moreover, such rules and procedures should take into account the legitimate
        interests of law-enforcement authorities where early disclosure could unnecessarily
        hamper the investigation of the circumstances of a personal data breach.
      translations:
        sv:
          name: "Sk\xE4l 88"
          description: "N\xE4r ing\xE5ende regler fastst\xE4lls f\xF6r format och\
            \ f\xF6rfaranden f\xF6r anm\xE4lan av personuppgiftsincidenter, b\xF6\
            r vederb\xF6rlig h\xE4nsyn tas till omst\xE4ndigheterna kring incidenten,\
            \ d\xE4ribland om personuppgifterna var skyddade av l\xE4mpliga tekniska\
            \ skydds\xE5tg\xE4rder, som betydligt begr\xE4nsar sannolikheten f\xF6\
            r identitetsbedr\xE4geri eller andra former av missbruk. Dessutom b\xF6\
            r s\xE5dana regler och f\xF6rfaranden beakta brottsbek\xE4mpande myndigheters\
            \ ber\xE4ttigade intressen, d\xE4r en f\xF6r tidig redovisning kan riskera\
            \ att i on\xF6dan h\xE4mma utredning av omst\xE4ndigheterna kring en personuppgiftsincident."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-89
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 89
      description: Directive 95/46/EC provided for a general obligation to notify
        the processing of personal data to the supervisory authorities. While that
        obligation produces administrative and financial burdens, it did not in all
        cases contribute to improving the protection of personal data. Such indiscriminate
        general notification obligations should therefore be abolished, and replaced
        by effective procedures and mechanisms which focus instead on those types
        of processing operations which are likely to result in a high risk to the
        rights and freedoms of natural persons by virtue of their nature, scope, context
        and purposes. Such types of processing operations may be those which in, particular,
        involve using new technologies, or are of a new kind and where no data protection
        impact assessment has been carried out before by the controller, or where
        they become necessary in the light of the time that has elapsed since the
        initial processing.
      translations:
        sv:
          name: "Sk\xE4l 89"
          description: "Direktiv 95/46/EG f\xF6reskrev en allm\xE4n skyldighet att\
            \ anm\xE4la behandling av personuppgifter till tillsynsmyndigheterna.\
            \ Denna skyldighet medf\xF6rde administrativa och ekonomiska b\xF6rdor,\
            \ men f\xF6rb\xE4ttrade inte alltid personuppgiftsskyddet. S\xE5dana \xF6\
            vergripande och allm\xE4nna anm\xE4lningsskyldigheter b\xF6r d\xE4rf\xF6\
            r avskaffas och ers\xE4ttas av effektiva f\xF6rfaranden och mekanismer\
            \ som i st\xE4llet inriktas p\xE5 de typer av behandlingar som sannolikt\
            \ inneb\xE4r en h\xF6g risk f\xF6r fysiska personers r\xE4ttigheter och\
            \ friheter, i kraft av deras art, omfattning, sammanhang och \xE4ndam\xE5\
            l. Dessa behandlingar kan vara s\xE5dana som s\xE4rskilt inbegriper anv\xE4\
            ndning av ny teknik eller \xE4r av en ny typ, f\xF6r vilken konsekvensbed\xF6\
            mning avseende uppgiftsskydd inte tidigare har genomf\xF6rts av den personuppgiftsansvarige,\
            \ eller som blir n\xF6dv\xE4ndiga p\xE5 grund av den tid som har f\xF6\
            rflutit sedan den ursprungliga behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-90
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 90
      description: In such cases, a data protection impact assessment should be carried
        out by the controller prior to the processing in order to assess the particular
        likelihood and severity of the high risk, taking into account the nature,
        scope, context and purposes of the processing and the sources of the risk.
        That impact assessment should include, in particular, the measures, safeguards
        and mechanisms envisaged for mitigating that risk, ensuring the protection
        of personal data and demonstrating compliance with this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 90"
          description: "I s\xE5dana fall b\xF6r den personuppgiftsansvarige f\xF6\
            re behandlingen, med beaktande av behandlingens art, omfattning, sammanhang\
            \ och \xE4ndam\xE5l samt upphovet till risken, g\xF6ra en konsekvensbed\xF6\
            mning avseende dataskydd i syfte att bed\xF6ma den h\xF6ga riskens specifika\
            \ sannolikhetsgrad och allvar samt dess ursprung. Konsekvensbed\xF6mningen\
            \ b\xF6r fr\xE4mst innefatta de planerade \xE5tg\xE4rder, skydds\xE5tg\xE4\
            rder och mekanismer som ska minska denna risk, s\xE4kerst\xE4lla personuppgiftskyddet\
            \ och visa att denna f\xF6rordning efterlevs."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-91
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 91
      description: This should in particular apply to large-scale processing operations
        which aim to process a considerable amount of personal data at regional, national
        or supranational level and which could affect a large number of data subjects
        and which are likely to result in a high risk, for example, on account of
        their sensitivity, where in accordance with the achieved state of technological
        knowledge a new technology is used on a large scale as well as to other processing
        operations which result in a high risk to the rights and freedoms of data
        subjects, in particular where those operations render it more difficult for
        data subjects to exercise their rights. A data protection impact assessment
        should also be made where personal data are processed for taking decisions
        regarding specific natural persons following any systematic and extensive
        evaluation of personal aspects relating to natural persons based on profiling
        those data or following the processing of special categories of personal data,
        biometric data, or data on criminal convictions and offences or related security
        measures. A data protection impact assessment is equally required for monitoring
        publicly accessible areas on a large scale, especially when using optic-electronic
        devices or for any other operations where the competent supervisory authority
        considers that the processing is likely to result in a high risk to the rights
        and freedoms of data subjects, in particular because they prevent data subjects
        from exercising a right or using a service or a contract, or because they
        are carried out systematically on a large scale. The processing of personal
        data should not be considered to be on a large scale if the processing concerns
        personal data from patients or clients by an individual physician, other health
        care professional or lawyer. In such cases, a data protection impact assessment
        should not be mandatory.
      translations:
        sv:
          name: "Sk\xE4l 91"
          description: "Detta b\xF6r s\xE4rskilt vara till\xE4mpligt p\xE5 storskalig\
            \ uppgiftsbehandling med syftet att behandla betydande m\xE4ngder personuppgifter\
            \ p\xE5 regional, nationell eller \xF6vernationell niv\xE5, vilket skulle\
            \ kunna p\xE5verka ett stort antal registrerade och sannolikt kommer att\
            \ inneb\xE4ra en h\xF6g risk, exempelvis till f\xF6ljd av uppgifternas\
            \ k\xE4nsliga natur, d\xE4r i enlighet med den uppn\xE5dda niv\xE5n av\
            \ teknisk kunskap en ny teknik anv\xE4nds storskaligt, samt p\xE5 annan\
            \ behandling som inneb\xE4r en h\xF6g risk f\xF6r registrerades r\xE4\
            ttigheter och friheter, framf\xF6r allt n\xE4r denna behandling g\xF6\
            r det sv\xE5rare f\xF6r de registrerade att ut\xF6va sina r\xE4ttigheter.\
            \ En konsekvensbed\xF6mning avseende dataskydd b\xF6r ocks\xE5 g\xF6ras,\
            \ d\xE4r personuppgifter behandlas i syfte att fatta beslut om specifika\
            \ fysiska personer efter en systematisk och omfattande bed\xF6mning av\
            \ fysiska personers personliga aspekter p\xE5 grundval av profilering\
            \ av dessa uppgifter eller efter behandling av s\xE4rskilda kategorier\
            \ av personuppgifter, biometriska uppgifter eller uppgifter om f\xE4llande\
            \ domar i brottm\xE5l samt \xF6vertr\xE4delser eller d\xE4rmed sammanh\xE4\
            ngande s\xE4kerhets\xE5tg\xE4rder. Likas\xE5 kr\xE4vs en konsekvensbed\xF6\
            mning avseende dataskydd f\xF6r \xF6vervakning av allm\xE4n plats i stor\
            \ omfattning, s\xE4rskilt vid anv\xE4ndning av optisk-elektroniska anordningar,\
            \ eller f\xF6r all annan behandling d\xE4r den beh\xF6riga tillsynsmyndigheten\
            \ anser att behandlingen sannolikt kommer att inneb\xE4ra en h\xF6g risk\
            \ f\xF6r de registrerades r\xE4ttigheter och friheter, framf\xF6r allt\
            \ p\xE5 grund av att den hindrar de registrerade fr\xE5n att ut\xF6va\
            \ en r\xE4ttighet eller anv\xE4nda en tj\xE4nst eller ett avtal eller\
            \ p\xE5 grund av att den systematiskt genomf\xF6rs i stor omfattning.\
            \ Behandling av personuppgifter b\xF6r inte anses vara storskalig, om\
            \ det \xE4r fr\xE5ga om personuppgifter fr\xE5n patienter eller klienter\
            \ som behandlas av enskilda l\xE4kare, andra yrkesverksamma p\xE5 h\xE4\
            lsoomr\xE5det eller juridiska ombud. I dessa fall b\xF6r en konsekvensbed\xF6\
            mning avseende dataskydd inte vara obligatorisk."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-92
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 92
      description: There are circumstances under which it may be reasonable and economical
        for the subject of a data protection impact assessment to be broader than
        a single project, for example where public authorities or bodies intend to
        establish a common application or processing platform or where several controllers
        plan to introduce a common application or processing environment across an
        industry sector or segment or for a widely used horizontal activity.
      translations:
        sv:
          name: "Sk\xE4l 92"
          description: "Ibland kan det vara f\xF6rnuftigt och ekonomiskt att en konsekvensbed\xF6\
            mning avseende dataskydd inriktar sig p\xE5 ett vidare omr\xE5de \xE4\
            n ett enda projekt, exempelvis n\xE4r myndigheter eller organ avser att\
            \ skapa en gemensam till\xE4mpnings- eller behandlingsplattform eller\
            \ n\xE4r flera personuppgiftsansvariga planerar att inf\xF6ra en gemensam\
            \ till\xE4mpnings- eller behandlingsmilj\xF6 f\xF6r en hel bransch eller\
            \ ett helt segment eller f\xF6r en allm\xE4nt utnyttjad horisontell verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-93
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 93
      description: In the context of the adoption of the Member State law on which
        the performance of the tasks of the public authority or public body is based
        and which regulates the specific processing operation or set of operations
        in question, Member States may deem it necessary to carry out such assessment
        prior to the processing activities.
      translations:
        sv:
          name: "Sk\xE4l 93"
          description: "Medlemsstaterna kan anse det n\xF6dv\xE4ndigt att genomf\xF6\
            ra en s\xE5dan bed\xF6mning f\xF6re behandlingen i samband med antagandet\
            \ av medlemsstaters nationella r\xE4tt som ligger till grund f\xF6r utf\xF6\
            randet av myndighetens eller det offentliga organets uppgifter och reglerar\
            \ den aktuella specifika behandlings\xE5tg\xE4rden eller serien av \xE5\
            tg\xE4rder."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-94
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 94
      description: Where a data protection impact assessment indicates that the processing
        would, in the absence of safeguards, security measures and mechanisms to mitigate
        the risk, result in a high risk to the rights and freedoms of natural persons
        and the controller is of the opinion that the risk cannot be mitigated by
        reasonable means in terms of available technologies and costs of implementation,
        the supervisory authority should be consulted prior to the start of processing
        activities. Such high risk is likely to result from certain types of processing
        and the extent and frequency of processing, which may result also in a realisation
        of damage or interference with the rights and freedoms of the natural person.
        The supervisory authority should respond to the request for consultation within
        a specified period. However, the absence of a reaction of the supervisory
        authority within that period should be without prejudice to any intervention
        of the supervisory authority in accordance with its tasks and powers laid
        down in this Regulation, including the power to prohibit processing operations.
        As part of that consultation process, the outcome of a data protection impact
        assessment carried out with regard to the processing at issue may be submitted
        to the supervisory authority, in particular the measures envisaged to mitigate
        the risk to the rights and freedoms of natural persons.
      translations:
        sv:
          name: "Sk\xE4l 94"
          description: "Om det av en konsekvensbed\xF6mning avseende dataskydd framg\xE5\
            r att behandlingen utan skydds\xE5tg\xE4rder, s\xE4kerhets\xE5tg\xE4rder\
            \ och mekanismer f\xF6r att minska risken kommer att inneb\xE4ra en h\xF6\
            g risk f\xF6r fysiska personers r\xE4ttigheter och friheter, och den personuppgiftsansvarige\
            \ anser att risken inte kan begr\xE4nsas genom \xE5tg\xE4rder som \xE4\
            r rimliga med avseende p\xE5 tillg\xE4nglig teknik och genomf\xF6randekostnader,\
            \ b\xF6r samr\xE5d h\xE5llas med tillsynsmyndigheten innan behandlingen\
            \ inleds. En s\xE5dan h\xF6g risk kommer sannolikt att orsakas av vissa\
            \ typer av behandling samt av en viss omfattning och frekvens f\xF6r behandlingen,\
            \ vilket \xE4ven kan leda till skador f\xF6r eller kr\xE4nkningar av fysiska\
            \ personers r\xE4ttigheter och friheter. Tillsynsmyndigheten b\xF6r inom\
            \ en fastst\xE4lld tid svara p\xE5 en beg\xE4ran om samr\xE5d. Ett uteblivet\
            \ svar fr\xE5n tillsynsmyndigheten inom denna tid b\xF6r dock inte hindra\
            \ ett eventuellt ingripande fr\xE5n tillsynsmyndighetens sida i enlighet\
            \ med dess uppgifter och befogenheter enligt denna f\xF6rordning, inbegripet\
            \ befogenheten att f\xF6rbjuda behandling. Som en del av denna samr\xE5\
            dsprocess f\xE5r resultatet av en konsekvensbed\xF6mning avseende dataskydd\
            \ som utf\xF6rs med avseende p\xE5 behandlingen i fr\xE5ga \xF6verl\xE4\
            mnas till tillsynsmyndigheten, framf\xF6r allt de \xE5tg\xE4rder som planeras\
            \ f\xF6r att minska risken f\xF6r fysiska personers r\xE4ttigheter och\
            \ friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-95
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 95
      description: The processor should assist the controller, where necessary and
        upon request, in ensuring compliance with the obligations deriving from the
        carrying out of data protection impact assessments and from prior consultation
        of the supervisory authority.
      translations:
        sv:
          name: "Sk\xE4l 95"
          description: "Personuppgiftsbitr\xE4det b\xF6r vid behov och p\xE5 beg\xE4\
            ran bist\xE5 den personuppgiftsansvarige med fullg\xF6rande av de skyldigheter\
            \ som h\xE4rr\xF6r fr\xE5n utf\xF6randet av konsekvensbed\xF6mningar avseende\
            \ dataskydd och f\xF6rhandssamr\xE5d med tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-96
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 96
      description: A consultation of the supervisory authority should also take place
        in the course of the preparation of a legislative or regulatory measure which
        provides for the processing of personal data, in order to ensure compliance
        of the intended processing with this Regulation and in particular to mitigate
        the risk involved for the data subject.
      translations:
        sv:
          name: "Sk\xE4l 96"
          description: "Ett samr\xE5d med tillsynsmyndigheten b\xF6r \xE4ven ske som\
            \ ett led i det f\xF6rberedande arbetet med en lagstiftnings\xE5tg\xE4\
            rd som stadgar om behandling av personuppgifter i syfte att s\xE4kerst\xE4\
            lla att den avsedda behandlingen \xF6verensst\xE4mmer med denna f\xF6\
            rordning och framf\xF6r allt f\xF6r att minska den risk den medf\xF6r\
            \ f\xF6r den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-97
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 97
      description: Where the processing is carried out by a public authority, except
        for courts or independent judicial authorities when acting in their judicial
        capacity, where, in the private sector, processing is carried out by a controller
        whose core activities consist of processing operations that require regular
        and systematic monitoring of the data subjects on a large scale, or where
        the core activities of the controller or the processor consist of processing
        on a large scale of special categories of personal data and data relating
        to criminal convictions and offences, a person with expert knowledge of data
        protection law and practices should assist the controller or processor to
        monitor internal compliance with this Regulation. In the private sector, the
        core activities of a controller relate to its primary activities and do not
        relate to the processing of personal data as ancillary activities. The necessary
        level of expert knowledge should be determined in particular according to
        the data processing operations carried out and the protection required for
        the personal data processed by the controller or the processor. Such data
        protection officers, whether or not they are an employee of the controller,
        should be in a position to perform their duties and tasks in an independent
        manner.
      translations:
        sv:
          name: "Sk\xE4l 97"
          description: "N\xE4r en behandling utf\xF6rs av en myndighet, med undantag\
            \ av domstolar eller oberoende r\xE4ttsliga myndigheter som en del av\
            \ deras d\xF6mande verksamhet, eller n\xE4r en behandling utf\xF6rs i\
            \ den privata sektorn av en personuppgiftsansvarig vars k\xE4rnverksamhet\
            \ best\xE5r av behandlingsverksamhet som kr\xE4ver regelbunden och systematisk\
            \ \xF6vervakning av de registrerade i stor omfattning, eller n\xE4r den\
            \ personuppgiftsansvariges eller personuppgiftsbitr\xE4dets k\xE4rnverksamhet\
            \ best\xE5r av behandling i stor omfattning av s\xE4rskilda kategorier\
            \ av personuppgifter och uppgifter som r\xF6r f\xE4llande domar i brottm\xE5\
            l och \xF6vertr\xE4delser, b\xF6r en person med sakkunskap i fr\xE5ga\
            \ om dataskyddslagstiftning och\_-f\xF6rfaranden bist\xE5 den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det f\xF6r att \xF6vervaka den interna efterlevnaden\
            \ av denna f\xF6rordning. I den privata sektorn avser personuppgiftsansvarigas\
            \ k\xE4rnverksamhet deras prim\xE4ra verksamhet och inte behandling av\
            \ personuppgifter som kompletterande verksamhet. Den n\xF6dv\xE4ndiga\
            \ niv\xE5n p\xE5 sakkunskapen b\xF6r fastst\xE4llas s\xE4rskilt i enlighet\
            \ med den uppgiftsbehandling som utf\xF6rs och det skydd som kr\xE4vs\
            \ f\xF6r de personuppgifter som behandlas av den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det. Denna typ av dataskyddsombud b\xF6\
            r, oavsett om de \xE4r anst\xE4llda av den personuppgiftsansvarige eller\
            \ ej, kunna fullg\xF6ra sitt uppdrag och utf\xF6ra sina uppgifter p\xE5\
            \ ett oberoende s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-98
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 98
      description: Associations or other bodies representing categories of controllers
        or processors should be encouraged to draw up codes of conduct, within the
        limits of this Regulation, so as to facilitate the effective application of
        this Regulation, taking account of the specific characteristics of the processing
        carried out in certain sectors and the specific needs of micro, small and
        medium enterprises. In particular, such codes of conduct could calibrate the
        obligations of controllers and processors, taking into account the risk likely
        to result from the processing for the rights and freedoms of natural persons.
      translations:
        sv:
          name: "Sk\xE4l 98"
          description: "Sammanslutningar eller andra organ som f\xF6retr\xE4der kategorier\
            \ av personuppgiftsansvariga eller personuppgiftsbitr\xE4den b\xF6r uppmuntras\
            \ att utarbeta uppf\xF6randekoder inom gr\xE4nserna f\xF6r denna f\xF6\
            rordning, s\xE5 att till\xE4mpningen av denna f\xF6rordning effektiviseras,\
            \ med beaktande av s\xE4rdragen hos den behandling som sker inom vissa\
            \ sektorer och de s\xE4rskilda behov som finns inom mikrof\xF6retag samt\
            \ inom sm\xE5 och medelstora f\xF6retag. I synnerhet skulle man genom\
            \ s\xE5dana uppf\xF6randekoder kunna anpassa personuppgiftsansvarigas\
            \ och personuppgiftsbitr\xE4dens skyldigheter, med beaktande av den risk\
            \ som behandlingen sannolikt inneb\xE4r f\xF6r fysiska personers r\xE4\
            ttigheter och friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-99
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 99
      description: When drawing up a code of conduct, or when amending or extending
        such a code, associations and other bodies representing categories of controllers
        or processors should consult relevant stakeholders, including data subjects
        where feasible, and have regard to submissions received and views expressed
        in response to such consultations.
      translations:
        sv:
          name: "Sk\xE4l 99"
          description: "Vid utformningen av en uppf\xF6randekod eller vid \xE4ndring\
            \ eller utvidgning av en befintlig s\xE5dan kod b\xF6r sammanslutningar\
            \ och andra organ som f\xF6retr\xE4der kategorier av personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den samr\xE5da med ber\xF6rda intressenter,\
            \ i\_m\xF6jligaste m\xE5n inbegripet registrerade, och beakta de inlagor\
            \ som mottas och de \xE5sikter som framf\xF6rs som svar p\xE5 samr\xE5\
            den."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-100
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 100
      description: In order to enhance transparency and compliance with this Regulation,
        the establishment of certification mechanisms and data protection seals and
        marks should be encouraged, allowing data subjects to quickly assess the level
        of data protection of relevant products and services.
      translations:
        sv:
          name: "Sk\xE4l 100"
          description: "F\xF6r att f\xF6rb\xE4ttra \xF6ppenheten och efterlevnaden\
            \ av denna f\xF6rordning b\xF6r inf\xF6randet av certifieringsmekanismer\
            \ och dataskyddsf\xF6rsegling och dataskyddsm\xE4rkning uppmuntras, s\xE5\
            \ att registrerade snabbt kan bed\xF6ma niv\xE5n p\xE5 relevanta produkters\
            \ och tj\xE4nsters dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-101
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 101
      description: Flows of personal data to and from countries outside the Union
        and international organisations are necessary for the expansion of international
        trade and international cooperation. The increase in such flows has raised
        new challenges and concerns with regard to the protection of personal data.
        However, when personal data are transferred from the Union to controllers,
        processors or other recipients in third countries or to international organisations,
        the level of protection of natural persons ensured in the Union by this Regulation
        should not be undermined, including in cases of onward transfers of personal
        data from the third country or international organisation to controllers,
        processors in the same or another third country or international organisation.
        In any event, transfers to third countries and international organisations
        may only be carried out in full compliance with this Regulation. A transfer
        could take place only if, subject to the other provisions of this Regulation,
        the conditions laid down in the provisions of this Regulation relating to
        the transfer of personal data to third countries or international organisations
        are complied with by the controller or processor.
      translations:
        sv:
          name: "Sk\xE4l 101"
          description: "Fl\xF6den av personuppgifter till och fr\xE5n l\xE4nder utanf\xF6\
            r unionen och till och fr\xE5n internationella organisationer \xE4r n\xF6\
            dv\xE4ndiga f\xF6r utvecklingen av internationell handel och internationellt\
            \ samarbete. \xD6kningen av dessa fl\xF6den har medf\xF6rt nya utmaningar\
            \ och nya farh\xE5gor n\xE4r det g\xE4ller skyddet av personuppgifter.\
            \ Det \xE4r viktigt att den skyddsniv\xE5 som fysiska personer s\xE4kerst\xE4\
            lls inom unionen genom denna f\xF6rordning inte undergr\xE4vs n\xE4r personuppgifter\
            \ \xF6verf\xF6rs fr\xE5n unionen till personuppgiftsansvariga, personuppgiftsbitr\xE4\
            den eller andra mottagare i tredjeland eller till internationella organisationer,\
            \ vilket inbegriper vidarebefordran av personuppgifter fr\xE5n tredjelandet\
            \ eller den internationella organisationen till personuppgiftsansvariga,\
            \ personuppgiftsbitr\xE4den i\_samma eller ett annat tredjeland eller\
            \ en annan internationell organisation. \xD6verf\xF6ringar till tredjel\xE4\
            nder och internationella organisationer f\xE5r under alla omst\xE4ndigheter\
            \ endast utf\xF6ras i\_full \xF6verensst\xE4mmelse med denna f\xF6rordning.\
            \ En \xF6verf\xF6ring kan endast ske, om de villkor som fastst\xE4lls\
            \ i best\xE4mmelserna i denna f\xF6rordning om \xF6verf\xF6ring av personuppgifter\
            \ till tredjel\xE4nder eller internationella organisationer har uppfyllts\
            \ av den personuppgiftsansvarige eller personuppgiftsbitr\xE4det, med\
            \ f\xF6rbeh\xE5ll f\xF6r de \xF6vriga best\xE4mmelserna i denna f\xF6\
            rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-102
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 102
      description: This Regulation is without prejudice to international agreements
        concluded between the Union and third countries regulating the transfer of
        personal data including appropriate safeguards for the data subjects. Member
        States may conclude international agreements which involve the transfer of
        personal data to third countries or international organisations, as far as
        such agreements do not affect this Regulation or any other provisions of Union
        law and include an appropriate level of protection for the fundamental rights
        of the data subjects.
      translations:
        sv:
          name: "Sk\xE4l 102"
          description: "Denna f\xF6rordning p\xE5verkar inte internationella avtal\
            \ mellan unionen och tredjel\xE4nder som reglerar \xF6verf\xF6ring av\
            \ personuppgifter, d\xE4ribland l\xE4mpliga skydds\xE5tg\xE4rder f\xF6\
            r de registrerade. Medlemsstaterna f\xE5r ing\xE5 internationella avtal\
            \ som innefattar \xF6verf\xF6ring av personuppgifter till tredjel\xE4\
            nder eller internationella organisationer i den m\xE5n s\xE5dana avtal\
            \ inte p\xE5verkar denna f\xF6rordning eller andra best\xE4mmelser i unionsr\xE4\
            tten och inneh\xE5ller en sk\xE4lig niv\xE5 av skydd f\xF6r de registrerades\
            \ grundl\xE4ggande r\xE4ttigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-103
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 103
      description: The Commission may decide with effect for the entire Union that
        a third country, a territory or specified sector within a third country, or
        an international organisation, offers an adequate level of data protection,
        thus providing legal certainty and uniformity throughout the Union as regards
        the third country or international organisation which is considered to provide
        such level of protection. In such cases, transfers of personal data to that
        third country or international organisation may take place without the need
        to obtain any further authorisation. The Commission may also decide, having
        given notice and a full statement setting out the reasons to the third country
        or international organisation, to revoke such a decision.
      translations:
        sv:
          name: "Sk\xE4l 103"
          description: "Kommissionen kan med verkan f\xF6r hela unionen fastst\xE4\
            lla att ett tredjeland, ett territorium eller en specificerad sektor i\
            \ ett tredjeland eller en internationell organisation erbjuder en adekvat\
            \ dataskyddsniv\xE5 och p\xE5 s\xE5 s\xE4tt skapa r\xE4ttslig s\xE4kerhet\
            \ och enhetlighet i hela unionen vad g\xE4ller tredjelandet eller den\
            \ internationella organisationen som anses tillhandah\xE5lla en s\xE5\
            dan skyddsniv\xE5. I dessa fall f\xE5r \xF6verf\xF6ringar av personuppgifter\
            \ till det tredjelandet eller den internationella organisationen ske utan\
            \ ytterligare tillst\xE5nd. Kommissionen kan ocks\xE5, efter att ha underr\xE4\
            ttat tredjelandet eller den internationella organisationen och l\xE4mnat\
            \ en fullst\xE4ndig motivering, besluta att ett s\xE5dant beslut ska \xE5\
            terkallas."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-104
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 104
      description: In line with the fundamental values on which the Union is founded,
        in particular the protection of human rights, the Commission should, in its
        assessment of the third country, or of a territory or specified sector within
        a third country, take into account how a particular third country respects
        the rule of law, access to justice as well as international human rights norms
        and standards and its general and sectoral law, including legislation concerning
        public security, defence and national security as well as public order and
        criminal law. The adoption of an adequacy decision with regard to a territory
        or a specified sector in a third country should take into account clear and
        objective criteria, such as specific processing activities and the scope of
        applicable legal standards and legislation in force in the third country.
        The third country should offer guarantees ensuring an adequate level of protection
        essentially equivalent to that ensured within the Union, in particular where
        personal data are processed in one or several specific sectors. In particular,
        the third country should ensure effective independent data protection supervision
        and should provide for cooperation mechanisms with the Member States' data
        protection authorities, and the data subjects should be provided with effective
        and enforceable rights and effective administrative and judicial redress.
      translations:
        sv:
          name: "Sk\xE4l 104"
          description: "I enlighet med de grundl\xE4ggande v\xE4rderingar som unionen\
            \ bygger p\xE5, bl.a. skyddet av m\xE4nskliga r\xE4ttigheter, b\xF6r kommissionen\
            \ i sin bed\xF6mning av tredjelandet eller ett territorium eller en specificerad\
            \ sektor i ett tredjeland beakta hur ett visst tredjeland respekterar\
            \ r\xE4ttsstatsprincipen, tillg\xE5ngen till r\xE4ttslig pr\xF6vning samt\
            \ internationella m\xE4nniskor\xE4ttsnormer och -standarder samt landets\
            \ allm\xE4nna lagstiftning och sektorslagstiftning, inklusive lagstiftning\
            \ om allm\xE4n s\xE4kerhet, f\xF6rsvar och nationell s\xE4kerhet samt\
            \ allm\xE4n ordning och straffr\xE4tt. Vid antagandet av ett beslut om\
            \ adekvat skyddsniv\xE5 avseende ett territorium eller en specificerad\
            \ sektor i ett tredjeland b\xF6r h\xE4nsyn tas till tydliga och objektiva\
            \ kriterier, t.ex. specifik behandling och till\xE4mpningsomr\xE5det f\xF6\
            r till\xE4mpliga r\xE4ttsliga standarder och g\xE4llande lagstiftning\
            \ i tredjelandet. Tredjelandet b\xF6r erbjuda garantier som s\xE4kerst\xE4\
            ller en tillfredsst\xE4llande skyddsniv\xE5 som i huvudsak motsvarar den\
            \ som s\xE4kerst\xE4lls i unionen, i\_synnerhet n\xE4r personuppgifter\
            \ behandlas inom en eller flera specifika sektorer. Tredjelandet b\xF6\
            r framf\xF6r allt s\xE4kerst\xE4lla en effektiv oberoende dataskydds\xF6\
            vervakning och s\xF6rja f\xF6r samarbetsmekanismer med medlemsstaternas\
            \ dataskyddsmyndigheter, och de registrerade b\xF6r tillf\xF6rs\xE4kras\
            \ effektiva och lagstadgade r\xE4ttigheter samt effektiv administrativ\
            \ och r\xE4ttslig pr\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-105
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 105
      description: Apart from the international commitments the third country or international
        organisation has entered into, the Commission should take account of obligations
        arising from the third country's or international organisation's participation
        in multilateral or regional systems in particular in relation to the protection
        of personal data, as well as the implementation of such obligations. In particular,
        the third country's accession to the Council of Europe Convention of 28 January
        1981 for the Protection of Individuals with regard to the Automatic Processing
        of Personal Data and its Additional Protocol should be taken into account.
        The Commission should consult the Board when assessing the level of protection
        in third countries or international organisations.
      translations:
        sv:
          name: "Sk\xE4l 105"
          description: "Ut\xF6ver de internationella \xE5taganden som tredjelandet\
            \ eller den internationella organisationen har gjort b\xF6r kommissionen\
            \ beakta de skyldigheter som f\xF6ljer av tredjelandets eller den internationella\
            \ organisationens deltagande i multilaterala eller regionala system, s\xE4\
            rskilt r\xF6rande skydd av personuppgifter och genomf\xF6randet av dessa\
            \ skyldigheter. Framf\xF6r allt b\xF6r tredjelandets anslutning till Europar\xE5\
            dets konvention av den\_28\_januari\_1981 om skydd f\xF6r enskilda vid\
            \ automatisk behandling av personuppgifter och dess till\xE4ggsprotokoll\
            \ beaktas. Kommissionen b\xF6r samr\xE5da med styrelsen vid bed\xF6mningen\
            \ av skyddsniv\xE5n i tredjel\xE4nder eller internationella organisationer."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-106
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 106
      description: The Commission should monitor the functioning of decisions on the
        level of protection in a third country, a territory or specified sector within
        a third country, or an international organisation, and monitor the functioning
        of decisions adopted on the basis of Article 25(6) or Article 26(4) of Directive
        95/46/EC. In its adequacy decisions, the Commission should provide for a periodic
        review mechanism of their functioning. That periodic review should be conducted
        in consultation with the third country or international organisation in question
        and take into account all relevant developments in the third country or international
        organisation. For the purposes of monitoring and of carrying out the periodic
        reviews, the Commission should take into consideration the views and findings
        of the European Parliament and of the Council as well as of other relevant
        bodies and sources. The Commission should evaluate, within a reasonable time,
        the functioning of the latter decisions and report any relevant findings to
        the Committee within the meaning of Regulation (EU) No 182/2011 of the European
        Parliament and of the Council (1) as established under this Regulation, to
        the European Parliament and to the Council.
      translations:
        sv:
          name: "Sk\xE4l 106"
          description: "Kommissionen b\xF6r \xF6vervaka hur beslut om skyddsniv\xE5\
            \ i ett tredjeland, ett territorium eller en specificerad sektor i ett\
            \ tredjeland eller en internationell organisation fungerar, och \xF6vervaka\
            \ hur beslut som antas p\xE5 grundval av artikel 25.6 eller 26.4 i direktiv\
            \ 95/46/EG fungerar. Kommissionen b\xF6r i sina beslut om adekvat skyddsniv\xE5\
            \ f\xF6reskriva en mekanism f\xF6r periodisk \xF6versyn av hur de fungerar.\
            \ Denna periodiska \xF6versyn b\xF6r genomf\xF6ras i\_samr\xE5d med det\
            \ ber\xF6rda tredjelandet eller den ber\xF6rda internationella organisationen,\
            \ med beaktande av all relevant utveckling i tredjelandet eller den internationella\
            \ organisationen. Vid \xF6vervakningen och genomf\xF6randet av den periodiska\
            \ \xF6versynen b\xF6r kommissionen ta h\xE4nsyn till synpunkter och resultat\
            \ fr\xE5n Europaparlamentet och r\xE5det samt andra relevanta organ och\
            \ k\xE4llor. Kommissionen b\xF6r inom rimlig tid utv\xE4rdera hur de sistn\xE4\
            mnda besluten fungerar och rapportera alla relevanta resultat till den\
            \ kommitt\xE9, i den mening som avses i\_Europaparlamentets och r\xE5\
            dets f\xF6rordning\_(EU) nr\_182/2011\_(12), som inr\xE4ttats enligt denna\
            \ f\xF6rordning och till Europaparlamentet och r\xE5det."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-107
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 107
      description: The Commission may recognise that a third country, a territory
        or a specified sector within a third country, or an international organisation
        no longer ensures an adequate level of data protection. Consequently the transfer
        of personal data to that third country or international organisation should
        be prohibited, unless the requirements in this Regulation relating to transfers
        subject to appropriate safeguards, including binding corporate rules, and
        derogations for specific situations are fulfilled. In that case, provision
        should be made for consultations between the Commission and such third countries
        or international organisations. The Commission should, in a timely manner,
        inform the third country or international organisation of the reasons and
        enter into consultations with it in order to remedy the situation.
      translations:
        sv:
          name: "Sk\xE4l 107"
          description: "Kommissionen kan konstatera att ett tredjeland, ett territorium\
            \ eller en viss specificerad sektor i ett tredjeland eller en internationell\
            \ organisation inte l\xE4ngre s\xE4kerst\xE4ller en adekvat dataskyddsniv\xE5\
            . \xD6verf\xF6ring av personuppgifter till detta tredjeland eller till\
            \ denna internationella organisation b\xF6r d\xE5 f\xF6rbjudas, s\xE5\
            vida inte kraven i denna f\xF6rordning avseende \xF6verf\xF6ring med st\xF6\
            d av l\xE4mpliga skydds\xE5tg\xE4rder, inbegripet bindande f\xF6retagsbest\xE4\
            mmelser och undantag f\xF6r s\xE4rskilda situationer, \xE4r uppfyllda.\
            \ I s\xE5 fall b\xF6r det finnas m\xF6jlighet till samr\xE5d mellan kommissionen\
            \ och dessa tredjel\xE4nder eller internationella organisationer. Kommissionen\
            \ b\xF6r i god tid informera tredjelandet eller den internationella organisationen\
            \ om sk\xE4len och inleda samr\xE5d med tredjelandet eller organisationen\
            \ f\xF6r att avhj\xE4lpa situationen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-108
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 108
      description: In the absence of an adequacy decision, the controller or processor
        should take measures to compensate for the lack of data protection in a third
        country by way of appropriate safeguards for the data subject. Such appropriate
        safeguards may consist of making use of binding corporate rules, standard
        data protection clauses adopted by the Commission, standard data protection
        clauses adopted by a supervisory authority or contractual clauses authorised
        by a supervisory authority. Those safeguards should ensure compliance with
        data protection requirements and the rights of the data subjects appropriate
        to processing within the Union, including the availability of enforceable
        data subject rights and of effective legal remedies, including to obtain effective
        administrative or judicial redress and to claim compensation, in the Union
        or in a third country. They should relate in particular to compliance with
        the general principles relating to personal data processing, the principles
        of data protection by design and by default. Transfers may also be carried
        out by public authorities or bodies with public authorities or bodies in third
        countries or with international organisations with corresponding duties or
        functions, including on the basis of provisions to be inserted into administrative
        arrangements, such as a memorandum of understanding, providing for enforceable
        and effective rights for data subjects. Authorisation by the competent supervisory
        authority should be obtained when the safeguards are provided for in administrative
        arrangements that are not legally binding.
      translations:
        sv:
          name: "Sk\xE4l 108"
          description: "Saknas beslut om adekvat skyddsniv\xE5 b\xF6r den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det vidta \xE5tg\xE4rder f\xF6r att kompensera\
            \ f\xF6r det bristande dataskyddet i ett tredjeland med hj\xE4lp av l\xE4\
            mpliga skydds\xE5tg\xE4rder f\xF6r den registrerade. S\xE5dana l\xE4mpliga\
            \ skydds\xE5tg\xE4rder kan best\xE5 i\_till\xE4mpning av bindande f\xF6\
            retagsbest\xE4mmelser, standardbest\xE4mmelser om dataskydd som antagits\
            \ av kommissionen, standardbest\xE4mmelser om dataskydd som antagits av\
            \ en tillsynsmyndighet eller avtalsbest\xE4mmelser som godk\xE4nts av\
            \ en tillsynsmyndighet. Dessa skydds\xE5tg\xE4rder b\xF6r s\xE4kerst\xE4\
            lla iakttagande av de krav i fr\xE5ga om dataskydd och registrerades r\xE4\
            ttigheter som \xE4r l\xE4mpliga f\xF6r behandling inom unionen, inbegripet\
            \ huruvida bindande r\xE4ttigheter f\xF6r de registrerade och effektiva\
            \ r\xE4ttsmedel \xE4r tillg\xE4ngliga, inbegripet en faktisk r\xE4tt att\
            \ f\xF6ra talan p\xE5 administrativ v\xE4g eller inf\xF6r domstol och\
            \ att kr\xE4va kompensation i\_unionen eller i ett tredjeland. De b\xF6\
            r s\xE4rskilt g\xE4lla \xF6verensst\xE4mmelse med allm\xE4nna principer\
            \ f\xF6r behandling av personuppgifter samt principerna om inbyggt dataskydd\
            \ och dataskydd som standard. \xD6verf\xF6ring av uppgifter kan ocks\xE5\
            \ utf\xF6ras av offentliga myndigheter eller organ till offentliga myndigheter\
            \ eller organ i tredjel\xE4nder eller internationella organisationer med\
            \ motsvarande skyldigheter eller uppgifter, inbegripet p\xE5 grundval\
            \ av best\xE4mmelser som ska inf\xF6ras i administrativa \xF6verenskommelser,\
            \ t.ex. samf\xF6rst\xE5ndsavtal, som f\xF6reskriver verkst\xE4llbara och\
            \ faktiska r\xE4ttigheter f\xF6r de registrerade. Tillst\xE5nd fr\xE5\
            n den beh\xF6riga tillsynsmyndigheten b\xF6r erh\xE5llas n\xE4r skydds\xE5\
            tg\xE4rder f\xF6reskrivs i\_icke r\xE4ttsligt bindande administrativa\
            \ arrangemang."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-109
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 109
      description: The possibility for the controller or processor to use standard
        data-protection clauses adopted by the Commission or by a supervisory authority
        should prevent controllers or processors neither from including the standard
        data-protection clauses in a wider contract, such as a contract between the
        processor and another processor, nor from adding other clauses or additional
        safeguards provided that they do not contradict, directly or indirectly, the
        standard contractual clauses adopted by the Commission or by a supervisory
        authority or prejudice the fundamental rights or freedoms of the data subjects.
        Controllers and processors should be encouraged to provide additional safeguards
        via contractual commitments that supplement standard protection clauses.
      translations:
        sv:
          name: "Sk\xE4l 109"
          description: "Personuppgiftsansvarigas eller personuppgiftsbitr\xE4dens\
            \ m\xF6jlighet att anv\xE4nda standardiserade dataskyddsbest\xE4mmelser\
            \ som antagits av kommissionen eller av en tillsynsmyndighet b\xF6r inte\
            \ hindra att de infogar standardiserade dataskyddsbest\xE4mmelser i\_\
            ett vidare avtal, s\xE5som ett avtal mellan personuppgiftsbitr\xE4det\
            \ och ett annat personuppgiftsbitr\xE4de, eller l\xE4gger till andra best\xE4\
            mmelser eller ytterligare skydds\xE5tg\xE4rder, under f\xF6ruts\xE4ttning\
            \ att de inte direkt eller indirekt st\xE5r i strid med standardavtalsklausuler\
            \ som antagits av kommissionen eller av en tillsynsmyndighet eller p\xE5\
            verkar de registrerades grundl\xE4ggande r\xE4ttigheter eller friheter.\
            \ Personuppgiftsansvariga och personuppgiftsbitr\xE4den b\xF6r uppmuntras\
            \ att tillhandah\xE5lla ytterligare skydds\xE5tg\xE4rder via avtalsm\xE4\
            ssiga \xE5taganden som kompletterar de standardiserade skyddsbest\xE4\
            mmelserna."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-110
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 110
      description: A group of undertakings, or a group of enterprises engaged in a
        joint economic activity, should be able to make use of approved binding corporate
        rules for its international transfers from the Union to organisations within
        the same group of undertakings, or group of enterprises engaged in a joint
        economic activity, provided that such corporate rules include all essential
        principles and  enforceable rights to ensure appropriate safeguards for transfers
        or categories of transfers of personal data.
      translations:
        sv:
          name: "Sk\xE4l 110"
          description: "En koncern eller en grupp av f\xF6retag som deltar i en gemensam\
            \ ekonomisk verksamhet b\xF6r kunna anv\xE4nda sig av godk\xE4nda bindande\
            \ f\xF6retagsbest\xE4mmelser f\xF6r sina internationella \xF6verf\xF6\
            ringar fr\xE5n unionen till organisationer inom samma koncern eller grupp\
            \ av f\xF6retag som deltar i en gemensam ekonomisk verksamhet, under f\xF6\
            ruts\xE4ttning att f\xF6retagsbest\xE4mmelserna inbegriper alla n\xF6\
            dv\xE4ndiga principer och bindande r\xE4ttigheter som s\xE4kerst\xE4ller\
            \ l\xE4mpliga skydds\xE5tg\xE4rder f\xF6r \xF6verf\xF6ringar eller kategorier\
            \ av \xF6verf\xF6ringar av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-111
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 111
      description: Provisions should be made for the possibility for transfers in
        certain circumstances where the data subject has given his or her explicit
        consent, where the transfer is occasional and necessary in relation to a contract
        or a legal claim, regardless of whether in a judicial procedure or whether
        in an administrative or any out-of-court procedure, including procedures before
        regulatory bodies. Provision should also be made for the possibility for transfers
        where important grounds of public interest laid down by Union or Member State
        law so require or where the transfer is made from a register established by
        law and intended for consultation by the public or persons having a legitimate
        interest. In the latter case, such a transfer should not involve the entirety
        of the personal data or entire categories of the data contained in the register
        and, when the register is intended for consultation by persons having a legitimate
        interest, the transfer should be made only at the request of those persons
        or, if they are to be the recipients, taking into full account the interests
        and fundamental rights of the data subject.
      translations:
        sv:
          name: "Sk\xE4l 111"
          description: "Det b\xF6r inf\xF6ras best\xE4mmelser som ger m\xF6jlighet\
            \ att under vissa omst\xE4ndigheter g\xF6ra \xF6verf\xF6ringar, om den\
            \ registrerade har l\xE4mnat sitt uttryckliga samtycke, n\xE4r \xF6verf\xF6\
            ringen \xE4r tillf\xE4llig och n\xF6dv\xE4ndig med h\xE4nsyn till ett\
            \ avtal eller ett r\xE4ttsligt anspr\xE5k, oavsett om detta sker inom\
            \ ett r\xE4ttsligt f\xF6rfarande eller i ett administrativt eller utomr\xE4\
            ttsligt f\xF6rfarande, inbegripet f\xF6rfaranden inf\xF6r tillsynsorgan.\
            \ Det b\xF6r ocks\xE5 inf\xF6ras best\xE4mmelser som ger m\xF6jlighet\
            \ till \xF6verf\xF6ringar om viktiga allm\xE4nintressen fastst\xE4llda\
            \ genom unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt s\xE5\
            \ kr\xE4ver eller n\xE4r \xF6verf\xF6ringen g\xF6rs fr\xE5n ett register\
            \ som inr\xE4ttats genom lag och \xE4r avsett att konsulteras av allm\xE4\
            nheten eller av personer med ett ber\xE4ttigat intresse. I sistn\xE4mnda\
            \ fall b\xF6r en s\xE5dan \xF6verf\xF6ring inte omfatta alla personuppgifter\
            \ eller hela kategorier av uppgifter i registret, och \xF6verf\xF6ringen\
            \ b\xF6r endast g\xF6ras n\xE4r registret \xE4r avsett att vara tillg\xE4\
            ngligt f\xF6r personer med ett ber\xE4ttigat intresse, p\xE5 beg\xE4ran\
            \ av dessa personer eller om de sj\xE4lva \xE4r mottagarna, med full h\xE4\
            nsyn till de registrerades intressen och grundl\xE4ggande r\xE4ttigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-112
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 112
      description: Those derogations should in particular apply to data transfers
        required and necessary for important reasons of public interest, for example
        in cases of international data exchange between competition authorities, tax
        or customs administrations, between financial supervisory authorities, between
        services competent for social security matters, or for public health, for
        example in the case of contact tracing for contagious diseases or in order
        to reduce and/or eliminate doping in sport. A transfer of personal data should
        also be regarded as lawful where it is necessary to protect an interest which
        is essential for the data subject's or another person's vital interests, including
        physical integrity or life, if the data subject is incapable of giving consent.
        In the absence of an adequacy decision, Union or Member State law may, for
        important reasons of public interest, expressly set limits to the transfer
        of specific categories of data to a third country or an international organisation.
        Member States should notify such provisions to the Commission. Any transfer
        to an international humanitarian organisation of personal data of a data subject
        who is physically or legally incapable of giving consent, with a view to accomplishing
        a task incumbent under the Geneva Conventions or to complying with international
        humanitarian law applicable in armed conflicts, could be considered to be
        necessary for an important reason of public interest or because it is in the
        vital interest of the data subject.
      translations:
        sv:
          name: "Sk\xE4l 112"
          description: "Dessa undantag b\xF6r fr\xE4mst vara till\xE4mpliga p\xE5\
            \ uppgifts\xF6verf\xF6ringar som kr\xE4vs och \xE4r n\xF6dv\xE4ndiga med\
            \ h\xE4nsyn till viktiga allm\xE4nintressen, exempelvis vid internationella\
            \ utbyten av uppgifter mellan konkurrensmyndigheter, skatte- eller tullmyndigheter,\
            \ finanstillsynsmyndigheter, socialf\xF6rs\xE4kringsmyndigheter eller\
            \ h\xE4lsov\xE5rdsmyndigheter, till exempel vid kontaktsp\xE5rning f\xF6\
            r smittsamma sjukdomar eller f\xF6r att minska och/eller undanr\xF6ja\
            \ dopning inom idrott. En \xF6verf\xF6ring av personuppgifter b\xF6r ocks\xE5\
            \ betraktas som laglig, om den \xE4r n\xF6dv\xE4ndig f\xF6r att skydda\
            \ ett intresse som \xE4r v\xE4sentligt f\xF6r den registrerades eller\
            \ en annan persons vitala intressen, inklusive dennes fysiska integritet\
            \ och liv, om den registrerade \xE4r of\xF6rm\xF6gen att ge sitt samtycke.\
            \ Saknas beslut om adekvat skyddsniv\xE5 f\xE5r unionsr\xE4tten eller\
            \ medlemsstaternas nationella r\xE4tt med h\xE4nsyn till viktiga allm\xE4\
            nintressen uttryckligen fastst\xE4lla gr\xE4nser f\xF6r \xF6verf\xF6ringen\
            \ av s\xE4rskilda kategorier av uppgifter till ett tredjeland eller en\
            \ internationell organisation. Medlemsstaterna b\xF6r underr\xE4tta kommissionen\
            \ om s\xE5dana best\xE4mmelser. Varje \xF6verf\xF6ring till en internationell\
            \ humanit\xE4r organisation av personuppgifter r\xF6rande en registrerad\
            \ som \xE4r fysiskt eller r\xE4ttsligt f\xF6rhindrad att ge sitt samtycke,\
            \ i syfte att utf\xF6ra en uppgift inom ramen f\xF6r Gen\xE8vekonventionerna\
            \ eller vara f\xF6renlig med internationell humanit\xE4r r\xE4tt, vilken\
            \ \xE4r till\xE4mplig vid v\xE4pnade konflikter, skulle kunna anses vara\
            \ n\xF6dv\xE4ndig f\xF6r ett betydande allm\xE4nintresse eller f\xF6r\
            \ att den \xE4r av vitalt intresse f\xF6r den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-113
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 113
      description: Transfers which can be qualified as not repetitive and that only
        concern a limited number of data subjects, could also be possible for the
        purposes of the compelling legitimate interests pursued by the controller,
        when those interests are not overridden by the interests or rights and freedoms
        of the data subject and when the controller has assessed all the circumstances
        surrounding the data transfer. The controller should give particular consideration
        to the nature of the personal data, the purpose and duration of the proposed
        processing operation or operations, as well as the situation in the country
        of origin, the third country and the country of final destination, and should
        provide suitable safeguards to protect fundamental rights and freedoms of
        natural persons with regard to the processing of their personal data. Such
        transfers should be possible only in residual cases where none of the other
        grounds for transfer are applicable. For scientific or historical research
        purposes or statistical purposes, the legitimate expectations of society for
        an increase of knowledge should be taken into consideration. The controller
        should inform the supervisory authority and the data subject about the transfer.
      translations:
        sv:
          name: "Sk\xE4l 113"
          description: "\xD6verf\xF6ringar som kan anses vara icke \xE5terkommande\
            \ och endast g\xE4ller ett begr\xE4nsat antal registrerade kan ocks\xE5\
            \ vara m\xF6jliga n\xE4r personuppgiftsansvarigas tvingande ber\xE4ttigade\
            \ intressen motiverar detta, om inte den registrerades intressen eller\
            \ r\xE4ttigheter och friheter v\xE4ger tyngre \xE4n dessa intressen, och\
            \ den personuppgiftsansvarige har bed\xF6mt alla omst\xE4ndigheter kring\
            \ uppgifts\xF6verf\xF6ringen. Den personuppgiftsansvarige b\xF6r ta s\xE4\
            rskild h\xE4nsyn till personuppgifternas art, den eller de avsedda behandlingarnas\
            \ \xE4ndam\xE5l och varaktighet samt situationen i ursprungslandet, tredjelandet\
            \ och det slutliga best\xE4mmelselandet och b\xF6r tillhandah\xE5lla l\xE4\
            mpliga \xE5tg\xE4rder f\xF6r att skydda fysiska personers grundl\xE4ggande\
            \ r\xE4ttigheter och friheter vid behandlingen av deras personuppgifter.\
            \ S\xE5dana \xF6verf\xF6ringar b\xF6r endast vara m\xF6jliga i vissa fall\
            \ d\xE4r inget av de andra sk\xE4len till \xF6verf\xF6ring \xE4r till\xE4\
            mpligt. F\xF6r vetenskapliga eller historiska forsknings\xE4ndam\xE5l\
            \ eller statistiska \xE4ndam\xE5l b\xF6r h\xE4nsyn tas till samh\xE4llets\
            \ legitima f\xF6rv\xE4ntningar i fr\xE5ga om \xF6kad kunskap. Den personuppgiftsansvarige\
            \ b\xF6r informera tillsynsmyndigheten och den registrerade om \xF6verf\xF6\
            ringen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-114
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 114
      description: In any case, where the Commission has taken no decision on the
        adequate level of data protection in a third country, the controller or processor
        should make use of solutions that provide data subjects with enforceable and
        effective rights as regards the processing of their data in the Union once
        those data have been transferred so that that they will continue to benefit
        from fundamental rights and safeguards.
      translations:
        sv:
          name: "Sk\xE4l 114"
          description: "Om kommissionen inte har fattat beslut om adekvat dataskyddsniv\xE5\
            \ i ett tredjeland, b\xF6r den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det i alla fall anv\xE4nda sig av l\xF6sningar som ger de registrerade\
            \ verkst\xE4llbara och effektiva r\xE4ttigheter vad g\xE4ller behandlingen\
            \ av deras personuppgifter inom unionen n\xE4r dessa uppgifter v\xE4l\
            \ har \xF6verf\xF6rts, s\xE5 att de fortsatt kan ut\xF6va sina grundl\xE4\
            ggande r\xE4ttigheter och att skydds\xE5tg\xE4rder fortsatt g\xE4ller\
            \ i f\xF6rh\xE5llande till dem."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-115
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 115
      description: Some third countries adopt laws, regulations and other legal acts
        which purport to directly regulate the processing activities of natural and
        legal persons under the jurisdiction of the Member States. This may include
        judgments of courts or tribunals or decisions of administrative authorities
        in third countries requiring a controller or processor to transfer or disclose
        personal data, and which are not based on an international agreement, such
        as a mutual legal assistance treaty, in force between the requesting third
        country and the Union or a Member State. The extraterritorial application
        of those laws, regulations and other legal acts may be in breach of international
        law and may impede the attainment of the protection of natural persons ensured
        in the Union by this Regulation. Transfers should only be allowed where the
        conditions of this Regulation for a transfer to third countries are met. This
        may be the case, inter alia, where disclosure is necessary for an important
        ground of public interest recognised in Union or Member State law to which
        the controller is subject.
      translations:
        sv:
          name: "Sk\xE4l 115"
          description: "Vissa tredjel\xE4nder antar lagar och andra f\xF6rfattningar\
            \ som syftar till att direkt reglera behandling som genomf\xF6rs av fysiska\
            \ och juridiska personer under medlemsstaternas jurisdiktion. Detta kan\
            \ inkludera r\xE4ttsliga avg\xF6randen eller beslut av administrativa\
            \ myndigheter i tredjel\xE4nder med krav p\xE5 att personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den \xF6verf\xF6r eller \xF6verl\xE4mnar\
            \ personuppgifter, vilka inte grundar sig p\xE5 n\xE5got g\xE4llande internationellt\
            \ avtal, s\xE5som ett f\xF6rdrag om \xF6msesidig r\xE4ttshj\xE4lp, mellan\
            \ det beg\xE4rande tredjelandet och unionen eller en medlemsstat. Extraterritoriell\
            \ till\xE4mpning av dessa lagar och andra f\xF6rfattningar kan strida\
            \ mot internationell r\xE4tt och inverka menligt p\xE5 det skydd av fysiska\
            \ personer som s\xE4kerst\xE4lls inom unionen genom denna f\xF6rordning.\
            \ \xD6verf\xF6ringar b\xF6r endast till\xE5tas om villkoren i denna f\xF6\
            rordning f\xF6r en \xF6verf\xF6ring till tredjel\xE4nder \xE4r uppfyllda.\
            \ Detta kan vara fallet bl.a. n\xE4r utl\xE4mnande \xE4r n\xF6dv\xE4ndigt\
            \ p\xE5 grund av ett viktigt allm\xE4nintresse som erk\xE4nns i\_unionsr\xE4\
            tten eller i medlemsstaternas nationella r\xE4tt som den personuppgiftsansvarige\
            \ omfattas av."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-116
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 116
      description: When personal data moves across borders outside the Union it may
        put at increased risk the ability of natural persons to exercise data protection
        rights in particular to protect themselves from the unlawful use or disclosure
        of that information. At the same time, supervisory authorities may find that
        they are unable to pursue complaints or conduct investigations relating to
        the activities outside their borders. Their efforts to work together in the
        cross-border context may also be hampered by insufficient preventative or
        remedial powers, inconsistent legal regimes, and practical obstacles like
        resource constraints. Therefore, there is a need to promote closer cooperation
        among data protection supervisory authorities to help them exchange information
        and carry out investigations with their international counterparts. For the
        purposes of developing international cooperation mechanisms to facilitate
        and provide international mutual assistance for the enforcement of legislation
        for the protection of personal data, the Commission and the supervisory authorities
        should exchange information and cooperate in activities related to the exercise
        of their powers with competent authorities in third countries, based on reciprocity
        and in accordance with this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 116"
          description: "N\xE4r personuppgifter f\xF6rs \xF6ver gr\xE4nser utanf\xF6\
            r unionen kan detta \xF6ka risken f\xF6r att fysiska personer inte kan\
            \ ut\xF6va sina dataskyddsr\xE4ttigheter, i synnerhet f\xF6r att skydda\
            \ sig fr\xE5n otill\xE5ten anv\xE4ndning eller otill\xE5tet utl\xE4mnande\
            \ av denna information. Samtidigt kan tillsynsmyndigheter finna att de\
            \ inte \xE4r i st\xE5nd att handl\xE4gga klagom\xE5l eller g\xF6ra utredningar\
            \ som g\xE4ller verksamheter utanf\xF6r gr\xE4nserna f\xF6r deras land.\
            \ Deras str\xE4van att arbeta tillsammans \xF6ver gr\xE4nserna kan ocks\xE5\
            \ hindras av otillr\xE4ckliga preventiva eller korrigerande befogenheter,\
            \ oenhetliga r\xE4ttsliga regelverk och praktiska hinder, som exempelvis\
            \ bristande resurser. N\xE4rmare samarbete mellan dataskyddstillsynsmyndigheter\
            \ b\xF6r d\xE4rf\xF6r fr\xE4mjas f\xF6r att hj\xE4lpa dem att utbyta information\
            \ och utf\xF6ra utredningar med sina internationella motparter. I syfte\
            \ att bygga upp internationella samarbetsmekanismer f\xF6r att underl\xE4\
            tta och tillhandah\xE5lla \xF6msesidig internationell hj\xE4lp med att\
            \ kontrollera efterlevnaden av lagstiftningen till skydd f\xF6r personuppgifter,\
            \ b\xF6r kommissionen och tillsynsmyndigheterna utbyta information och\
            \ samarbeta, inom verksamhet som r\xF6r ut\xF6vandet av deras befogenheter,\
            \ med beh\xF6riga myndigheter i tredjel\xE4nder, p\xE5 grundval av \xF6\
            msesidighet och i \xF6verensst\xE4mmelse med denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-117
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 117
      description: The establishment of supervisory authorities in Member States,
        empowered to perform their tasks and exercise their powers with complete independence,
        is an essential component of the protection of natural persons with regard
        to the processing of their personal data. Member States should be able to
        establish more than one supervisory authority, to reflect their constitutional,
        organisational and administrative structure.
      translations:
        sv:
          name: "Sk\xE4l 117"
          description: "Ett v\xE4sentligt inslag i skyddet av fysiska personer vid\
            \ behandlingen av personuppgifter \xE4r att medlemsstaterna inr\xE4ttar\
            \ tillsynsmyndigheter med beh\xF6righet att utf\xF6ra sina uppgifter och\
            \ ut\xF6va sina befogenheter under fullst\xE4ndigt oberoende. Medlemsstaterna\
            \ b\xF6r kunna inr\xE4tta fler \xE4n en tillsynsmyndighet om det beh\xF6\
            vs f\xF6r att ta h\xE4nsyn till den egna konstitutionella, organisatoriska\
            \ och administrativa strukturen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-118
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 118
      description: The independence of supervisory authorities should not mean that
        the supervisory authorities cannot be subject to control or monitoring mechanisms
        regarding their financial expenditure or to judicial review.
      translations:
        sv:
          name: "Sk\xE4l 118"
          description: "Tillsynsmyndigheternas oberoende b\xF6r dock inte inneb\xE4\
            ra att deras utgifter inte kan underkastas kontroll- eller \xF6vervakningsmekanismer\
            \ eller bli f\xF6rem\xE5l f\xF6r domstolspr\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-119
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 119
      description: Where a Member State establishes several supervisory authorities,
        it should establish by law mechanisms for ensuring the effective participation
        of those supervisory authorities in the consistency mechanism. That Member
        State should in particular designate the supervisory authority which functions
        as a single contact point for the effective participation of those authorities
        in the mechanism, to ensure swift and smooth cooperation with other supervisory
        authorities, the Board and the Commission.
      translations:
        sv:
          name: "Sk\xE4l 119"
          description: "Om en medlemsstat inr\xE4ttar flera tillsynsmyndigheter, b\xF6\
            r den genom lagstiftning s\xE4kerst\xE4lla att dessa tillsynsmyndigheter\
            \ effektivt deltar i mekanismen f\xF6r enhetlighet. Medlemsstaten b\xF6\
            r i synnerhet utn\xE4mna en tillsynsmyndighet som fungerar som samlande\
            \ kontaktpunkt f\xF6r dessa myndigheters effektiva deltagande i mekanismen\
            \ f\xF6r att s\xE4kra ett snabbt och smidigt samarbete med \xF6vriga tillsynsmyndigheter,\
            \ styrelsen och kommissionen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-120
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 120
      description: Each supervisory authority should be provided with the financial
        and human resources, premises and infrastructure necessary for the effective
        performance of their tasks, including those related to mutual assistance and
        cooperation with other supervisory authorities throughout the Union. Each
        supervisory authority should have a separate, public annual budget, which
        may be part of the overall state or national budget.
      translations:
        sv:
          name: "Sk\xE4l 120"
          description: "Varje tillsynsmyndighet b\xF6r tilldelas de ekonomiska och\
            \ personella resurser och lokalutrymmen samt den infrastruktur som \xE4\
            r n\xF6dv\xE4ndig f\xF6r att den effektivt ska kunna utf\xF6ra sina uppgifter,\
            \ d\xE4ribland de uppgifter som \xE4r knutna till \xF6msesidigt bist\xE5\
            nd och samarbete med \xF6vriga tillsynsmyndigheter i hela unionen. Varje\
            \ tillsynsmyndighet b\xF6r ha en separat offentlig \xE5rlig budget, som\
            \ kan ing\xE5 i den \xF6vergripande statsbudgeten eller nationella budgeten."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-121
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 121
      description: The general conditions for the member or members of the supervisory
        authority should be laid down by law in each Member State and should in particular
        provide that those members are to be appointed, by means of a transparent
        procedure, either by the parliament, government or the head of State of the
        Member State on the basis of a proposal from the government, a member of the
        government, the parliament or a chamber of the parliament, or by an independent
        body entrusted under Member State law. In order to ensure the independence
        of the supervisory authority, the member or members should act with integrity,
        refrain from any action that is incompatible with their duties and should
        not, during their term of office, engage in any incompatible occupation, whether
        gainful or not. The supervisory authority should have its own staff, chosen
        by the supervisory authority or an independent body established by Member
        State law, which should be subject to the exclusive direction of the member
        or members of the supervisory authority.
      translations:
        sv:
          name: "Sk\xE4l 121"
          description: "De allm\xE4nna villkoren f\xF6r tillsynsmyndighetens ledamot\
            \ eller ledam\xF6ter b\xF6r fastst\xE4llas genom varje medlemsstats lagstiftning\
            \ och d\xE4r b\xF6r i synnerhet f\xF6reskrivas att ledam\xF6terna ska\
            \ utn\xE4mnas genom ett \xF6ppet f\xF6rfarande antingen av medlemsstatens\
            \ parlament, regering eller statschef, p\xE5 grundval av ett f\xF6rslag\
            \ fr\xE5n regeringen, en ledamot av regeringen, parlamentet eller en av\
            \ parlamentets kammare eller av ett oberoende organ som enligt medlemsstaternas\
            \ nationella r\xE4tt har anf\xF6rtrotts utn\xE4mningen. I syfte att s\xE4\
            kerst\xE4lla tillsynsmyndighetens oberoende b\xF6r ledamoten eller ledam\xF6\
            terna handla med integritet, avst\xE5 fr\xE5n alla handlingar som st\xE5\
            r i strid med deras tj\xE4nsteut\xF6vning och under sin mandattid avst\xE5\
            \ fr\xE5n all annan avl\xF6nad eller oavl\xF6nad yrkesverksamhet som st\xE5\
            r i strid med deras uppdrag. Tillsynsmyndigheten b\xF6r ha egen personal,\
            \ som valts ut av tillsynsmyndigheten eller ett oberoende organ som fastst\xE4\
            lls i medlemsstaternas nationella r\xE4tt, vilken uteslutande b\xF6r vara\
            \ underst\xE4lld tillsynsmyndighetens ledamot eller ledam\xF6ter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-122
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 122
      description: Each supervisory authority should be competent on the territory
        of its own Member State to exercise the powers and to perform the tasks conferred
        on it in accordance with this Regulation. This should cover in particular
        the processing in the context of the activities of an establishment of the
        controller or processor on the territory of its own Member State, the processing
        of personal data carried out by public authorities or private bodies acting
        in the public interest, processing affecting data subjects on its territory
        or processing carried out by a controller or processor not established in
        the Union when targeting data subjects residing on its territory. This should
        include handling complaints lodged by a data subject, conducting investigations
        on the application of this Regulation and promoting public awareness of the
        risks, rules, safeguards and rights in relation to the processing of personal
        data.
      translations:
        sv:
          name: "Sk\xE4l 122"
          description: "Varje tillsynsmyndighet b\xF6r ha beh\xF6righet att inom sin\
            \ medlemsstats territorium ut\xF6va de befogenheter och utf\xF6ra de uppgifter\
            \ som den tilldelats i enlighet med denna f\xF6rordning. Detta b\xF6r\
            \ framf\xF6r allt omfatta behandling inom ramen f\xF6r verksamhet vid\
            \ den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets verksamhetsst\xE4\
            llen inom den egna medlemsstatens territorium, behandling av personuppgifter\
            \ som utf\xF6rs av myndigheter eller privata organ som agerar i ett allm\xE4\
            nt intresse, behandling som p\xE5verkar registrerade p\xE5 dess territorium\
            \ eller behandling som utf\xF6rs av en personuppgiftsansvarig eller ett\
            \ personuppgiftsbitr\xE4de som inte \xE4r etablerad i unionen n\xE4r den\
            \ r\xF6r registrerade som \xE4r bosatta p\xE5 dess territorium. Detta\
            \ b\xF6r inbegripa att hantera klagom\xE5l som l\xE4mnas in av en registrerad,\
            \ genomf\xF6ra unders\xF6kningar om till\xE4mpningen av denna f\xF6rordning\
            \ samt fr\xE4mja allm\xE4nhetens medvetenhet om risker, best\xE4mmelser,\
            \ skydds\xE5tg\xE4rder och r\xE4ttigheter n\xE4r det g\xE4ller behandlingen\
            \ av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-123
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 123
      description: The supervisory authorities should monitor the application of the
        provisions pursuant to this Regulation and contribute to its consistent application
        throughout the Union, in order to protect natural persons in relation to the
        processing of their personal data and to facilitate the free flow of personal
        data within the internal market. For that purpose, the supervisory authorities
        should cooperate with each other and with the Commission, without the need
        for any agreement between Member States on the provision of mutual assistance
        or on such cooperation.
      translations:
        sv:
          name: "Sk\xE4l 123"
          description: "Tillsynsmyndigheterna b\xF6r \xF6vervaka till\xE4mpningen\
            \ av best\xE4mmelserna i denna f\xF6rordning och bidra till att till\xE4\
            mpningen blir enhetlig \xF6ver hela unionen, f\xF6r att skydda fysiska\
            \ personer vid behandling av deras personuppgifter och f\xF6r att underl\xE4\
            tta det fria fl\xF6det av personuppgifter inom den inre marknaden. F\xF6\
            r detta \xE4ndam\xE5l b\xF6r tillsynsmyndigheterna samarbeta s\xE5v\xE4\
            l sinsemellan som med kommissionen, utan att det beh\xF6vs n\xE5got avtal\
            \ mellan medlemsstaterna om tillhandah\xE5llande av \xF6msesidigt bist\xE5\
            nd eller om s\xE5dant samarbete."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-124
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 124
      description: Where the processing of personal data takes place in the context
        of the activities of an establishment of a controller or a processor in the
        Union and the controller or processor is established in more than one Member
        State, or where processing taking place in the context of the activities of
        a single establishment of a controller or processor in the Union substantially
        affects or is likely to substantially affect data subjects in more than one
        Member State, the supervisory authority for the main establishment of the
        controller or processor or for the single establishment of the controller
        or processor should act as lead authority. It should cooperate with the other
        authorities concerned, because the controller or processor has an establishment
        on the territory of their Member State, because data subjects residing on
        their territory are substantially affected, or because a complaint has been
        lodged with them. Also where a data subject not residing in that Member State
        has lodged a complaint, the supervisory authority with which such complaint
        has been lodged should also be a supervisory authority concerned. Within its
        tasks to issue guidelines on any question covering the application of this
        Regulation, the Board should be able to issue guidelines in particular on
        the criteria to be taken into account in order to ascertain whether the processing
        in question substantially affects data subjects in more than one Member State
        and on what constitutes a relevant and reasoned objection.
      translations:
        sv:
          name: "Sk\xE4l 124"
          description: "Om behandlingen av personuppgifter sker inom ramen f\xF6r\
            \ verksamhet vid en personuppgiftsansvarigs eller ett personuppgiftsbitr\xE4\
            des verksamhetsst\xE4lle i unionen och den personuppgiftsansvarige eller\
            \ personuppgiftsbitr\xE4det \xE4r etablerad i mer \xE4n en medlemsstat,\
            \ eller om behandling som sker inom ramen f\xF6r verksamhet vid ett enda\
            \ verksamhetsst\xE4lle tillh\xF6rande en personuppgiftsansvarig eller\
            \ ett personuppgiftsbitr\xE4de i\_unionen i v\xE4sentlig grad p\xE5verkar\
            \ eller sannolikt i\_v\xE4sentlig grad kommer att p\xE5verka registrerade\
            \ i mer \xE4n en medlemsstat, b\xF6r tillsynsmyndigheten f\xF6r den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets huvudsakliga verksamhetsst\xE4lle eller\
            \ f\xF6r detta enda verksamhetsst\xE4lle tillh\xF6rande den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det agera som ansvarig myndighet. Denna\
            \ b\xF6r samarbeta med de \xF6vriga myndigheter som ber\xF6rs, eftersom\
            \ den personuppgiftsansvarige eller personuppgiftsbitr\xE4det har ett\
            \ verksamhetsst\xE4lle inom deras medlemsstats territorium, eftersom registrerade\
            \ som \xE4r bosatta p\xE5 deras territorium i v\xE4sentlig grad p\xE5\
            verkas eller eftersom ett klagom\xE5l har l\xE4mnats in till dem. \xC4\
            ven n\xE4r en registrerad som inte \xE4r bosatt i\_medlemsstaten har l\xE4\
            mnat in ett klagom\xE5l, b\xF6r den tillsynsmyndighet som klagom\xE5let\
            \ har l\xE4mnats in till ocks\xE5 vara en ber\xF6rd tillsynsmyndighet.\
            \ Styrelsen b\xF6r inom ramen f\xF6r sina uppgifter kunna utf\xE4rda riktlinjer\
            \ f\xF6r alla fr\xE5gor som r\xF6r till\xE4mpningen av denna f\xF6rordning,\
            \ framf\xF6r allt f\xF6r vilka kriterier som ska beaktas f\xF6r att konstatera\
            \ om behandlingen i fr\xE5ga i v\xE4sentlig grad p\xE5verkar registrerade\
            \ i mer \xE4n en medlemsstat och f\xF6r vad som utg\xF6r en relevant och\
            \ motiverad inv\xE4ndning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-125
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 125
      description: The lead authority should be competent to adopt binding decisions
        regarding measures applying the powers conferred on it in accordance with
        this Regulation. In its capacity as lead authority, the supervisory authority
        should closely involve and coordinate the supervisory authorities concerned
        in the decision-making process. Where the decision is to reject the complaint
        by the data subject in whole or in part, that decision should be adopted by
        the supervisory authority with which the complaint has been lodged.
      translations:
        sv:
          name: "Sk\xE4l 125"
          description: "Den ansvariga myndigheten b\xF6r ha beh\xF6righet att anta\
            \ bindande beslut om \xE5tg\xE4rder inom ramen f\xF6r de befogenheter\
            \ som den tilldelats i enlighet med denna f\xF6rordning. I egenskap av\
            \ ansvarig myndighet b\xF6r tillsynsmyndigheten n\xE4ra involvera och\
            \ samordna de ber\xF6rda tillsynsmyndigheterna i beslutsfattandet. Om\
            \ man beslutar att helt eller delvis avsl\xE5 den registrerades klagom\xE5\
            l, b\xF6r detta beslut antas av den tillsynsmyndighet som klagom\xE5let\
            \ har l\xE4mnats in till."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-126
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 126
      description: The decision should be agreed jointly by the lead supervisory authority
        and the supervisory authorities concerned and should be directed towards the
        main or single establishment of the controller or processor and be binding
        on the controller and processor. The controller or processor should take the
        necessary measures to ensure compliance with this Regulation and the implementation
        of the decision notified by the lead supervisory authority to the main establishment
        of the controller or processor as regards the processing activities in the
        Union.
      translations:
        sv:
          name: "Sk\xE4l 126"
          description: "Den ansvariga tillsynsmyndigheten och de ber\xF6rda tillsynsmyndigheterna\
            \ b\xF6r gemensamt enas om beslutet, som b\xF6r rikta sig till den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets huvudsakliga eller enda verksamhetsst\xE4\
            lle och vara bindande f\xF6r den personuppgiftsansvarige och personuppgiftsbitr\xE4\
            det. Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det b\xF6\
            r vidta de \xE5tg\xE4rder som kr\xE4vs f\xF6r att s\xE4kerst\xE4lla efterlevnad\
            \ av denna f\xF6rordning och genomf\xF6rande av det beslut som den ansvariga\
            \ tillsynsmyndigheten har anm\xE4lt till den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets huvudsakliga verksamhetsst\xE4lle vad\
            \ g\xE4ller behandling i unionen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-127
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 127
      description: "Each supervisory authority not acting as the lead supervisory\
        \ authority should be competent to handle local cases where the controller\
        \ or processor is established in more than one Member State, but the subject\
        \ matter of the specific processing concerns only processing carried out in\
        \ a single Member State and involves only data subjects in that single Member\
        \ State, for example, where the subject matter concerns the processing of\
        \ employees' personal data in the specific employment context of a Member\
        \ State. In such cases, the supervisory authority should inform the lead supervisory\
        \ authority without delay about the matter. After being informed, the lead\
        \ supervisory authority should decide, whether it will handle the case pursuant\
        \ to the provision on cooperation between the lead supervisory authority and\
        \ other supervisory authorities concerned (\u2018one-stop-shop mechanism\u2019\
        ), or whether the supervisory authority which informed it should handle the\
        \ case at local level. When deciding whether it will handle the case, the\
        \ lead supervisory authority should take into account whether there is an\
        \ establishment of the controller or processor in the Member State of the\
        \ supervisory authority which informed it in order to ensure effective enforcement\
        \ of a decision vis-\xE0-vis the controller or processor. Where the lead supervisory\
        \ authority decides to handle the case, the supervisory authority which informed\
        \ it should have the possibility to submit a draft for a decision, of which\
        \ the lead supervisory authority should take utmost account when preparing\
        \ its draft decision in that one-stop-shop mechanism."
      translations:
        sv:
          name: "Sk\xE4l 127"
          description: "Varje tillsynsmyndighet som inte agerar som ansvarig tillsynsmyndighet\
            \ b\xF6r vara beh\xF6rig att behandla lokala fall, om den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det \xE4r etablerad i mer \xE4n en medlemsstat\
            \ men \xE4rendet f\xF6r den specifika behandlingen endast avser behandling\
            \ som utf\xF6rs i\_en enda medlemsstat och endast omfattar registrerade\
            \ i denna enda medlemsstat, till exempel om \xE4rendet avser behandling\
            \ av anst\xE4lldas personuppgifter inom ramen f\xF6r en medlemsstats specifika\
            \ anst\xE4llningsf\xF6rh\xE5llanden. I s\xE5dana fall b\xF6r tillsynsmyndigheten\
            \ utan dr\xF6jsm\xE5l underr\xE4tta den ansvariga tillsynsmyndigheten\
            \ om detta \xE4rende. Efter att ha underr\xE4ttats b\xF6r den ansvariga\
            \ tillsynsmyndigheten besluta huruvida den kommer att hantera \xE4rendet\
            \ i enlighet med best\xE4mmelsen om samarbete mellan den ansvariga tillsynsmyndigheten\
            \ och andra ber\xF6rda tillsynsmyndigheter (nedan kallad\_mekanismen f\xF6\
            r en enda kontaktpunkt), eller om den tillsynsmyndighet som underr\xE4\
            ttade den b\xF6r behandla \xE4rendet p\xE5 lokal niv\xE5. N\xE4r den ansvariga\
            \ tillsynsmyndigheten beslutar huruvida den kommer att behandla \xE4rendet,\
            \ b\xF6r den ta h\xE4nsyn till om den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det har ett verksamhetsst\xE4lle i den medlemsstat d\xE4r den tillsynsmyndighet\
            \ som underr\xE4ttade den ansvariga myndigheten \xE4r bel\xE4gen f\xF6\
            r att s\xE4kerst\xE4lla ett effektivt genomf\xF6rande av ett beslut gentemot\
            \ den personuppgiftsansvarige eller personuppgiftsbitr\xE4det. N\xE4r\
            \ den ansvariga tillsynsmyndigheten beslutar att behandla \xE4rendet,\
            \ b\xF6r den tillsynsmyndighet som underr\xE4ttade den ha m\xF6jlighet\
            \ att l\xE4mna in ett f\xF6rslag till beslut, som den ansvariga tillsynsmyndigheten\
            \ b\xF6r ta st\xF6rsta m\xF6jliga h\xE4nsyn till n\xE4r den utarbetar\
            \ utkastet till beslut inom ramen f\xF6r mekanismen f\xF6r en enda kontaktpunkt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-128
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 128
      description: The rules on the lead supervisory authority and the one-stop-shop
        mechanism should not apply where the processing is carried out by public authorities
        or private bodies in the public interest. In such cases the only supervisory
        authority competent to exercise the powers conferred to it in accordance with
        this Regulation should be the supervisory authority of the Member State where
        the public authority or private body is established.
      translations:
        sv:
          name: "Sk\xE4l 128"
          description: "Best\xE4mmelserna om den ansvariga tillsynsmyndigheten och\
            \ mekanismen f\xF6r en enda kontaktpunkt b\xF6r inte till\xE4mpas om behandlingen\
            \ utf\xF6rs av myndigheter eller privata organ i ett allm\xE4nt intresse.\
            \ I s\xE5dana fall b\xF6r den enda tillsynsmyndighet som \xE4r beh\xF6\
            rig att ut\xF6va de befogenheter som den tilldelas i enlighet med denna\
            \ f\xF6rordning vara tillsynsmyndigheten i den medlemsstat d\xE4r myndigheten\
            \ eller det privata organet \xE4r etablerat."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-129
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 129
      description: In order to ensure consistent monitoring and enforcement of this
        Regulation throughout the Union, the supervisory authorities should have in
        each Member State the same tasks and effective powers, including powers of
        investigation, corrective powers and sanctions, and authorisation and advisory
        powers, in particular in cases of complaints from natural persons, and without
        prejudice to the powers of prosecutorial authorities under Member State law,
        to bring infringements of this Regulation to the attention of the judicial
        authorities and engage in legal proceedings. Such powers should also include
        the power to impose a temporary or definitive limitation, including a ban,
        on processing. Member States may specify other tasks related to the protection
        of personal data under this Regulation. The powers of supervisory authorities
        should be exercised in accordance with appropriate procedural safeguards set
        out in Union and Member State law, impartially, fairly and within a reasonable
        time. In particular each measure should be appropriate, necessary and proportionate
        in view of ensuring compliance with this Regulation, taking into account the
        circumstances of each individual case, respect the right of every person to
        be heard before any individual measure which would affect him or her adversely
        is taken and avoid superfluous costs and excessive inconveniences for the
        persons concerned. Investigatory powers as regards access to premises should
        be exercised in accordance with specific requirements in Member State procedural
        law, such as the requirement to obtain a prior judicial authorisation. Each
        legally binding measure of the supervisory authority should be in writing,
        be clear and unambiguous, indicate the supervisory authority which has issued
        the measure, the date of issue of the measure, bear the signature of the head,
        or a member of the supervisory authority authorised by him or her, give the
        reasons for the measure, and refer to the right of an effective remedy. This
        should not preclude additional requirements pursuant to Member State procedural
        law. The adoption of a legally binding decision implies that it may give rise
        to judicial review in the Member State of the supervisory authority that adopted
        the decision.
      translations:
        sv:
          name: "Sk\xE4l 129"
          description: "F\xF6r att denna f\xF6rordning ska \xF6vervakas och verkst\xE4\
            llas p\xE5 ett enhetligt s\xE4tt i hela unionen b\xF6r tillsynsmyndigheterna\
            \ i alla medlemsstater ha samma uppgifter och effektiva befogenheter,\
            \ bl.a. unders\xF6kningsbefogenheter, korrigerande befogenheter och befogenheter\
            \ att \xE5l\xE4gga sanktioner samt befogenheter att utf\xE4rda tillst\xE5\
            nd och ge r\xE5d, s\xE4rskilt vid klagom\xE5l fr\xE5n fysiska personer\
            \ och, utan att det p\xE5verkar \xE5klagarmyndigheternas befogenheter\
            \ enligt medlemsstaternas nationella r\xE4tt, att upplysa de r\xE4ttsliga\
            \ myndigheterna om \xF6vertr\xE4delser av denna f\xF6rordning och delta\
            \ i r\xE4ttsliga f\xF6rfaranden. Dessa befogenheter b\xF6r \xE4ven omfatta\
            \ en befogenhet att inf\xF6ra en tillf\xE4llig eller definitiv begr\xE4\
            nsning av, inklusive f\xF6rbud mot, behandling. Medlemsstaterna f\xE5\
            r fastst\xE4lla andra uppgifter med anknytning till skyddet av personuppgifter\
            \ enligt denna f\xF6rordning. Tillsynsmyndigheternas befogenheter b\xF6\
            r ut\xF6vas opartiskt, r\xE4ttvist och inom rimlig tid i\_\xF6verensst\xE4\
            mmelse med l\xE4mpliga r\xE4ttss\xE4kerhetsgarantier i unionsr\xE4tten\
            \ och i\_medlemsstaternas nationella r\xE4tt. Framf\xF6r allt b\xF6r varje\
            \ \xE5tg\xE4rd vara l\xE4mplig, n\xF6dv\xE4ndig och proportionell f\xF6\
            r att s\xE4kerst\xE4lla efterlevnad av denna f\xF6rordning, med beaktande\
            \ av omst\xE4ndigheterna i varje enskilt fall, samt respektera varje persons\
            \ r\xE4tt att bli h\xF6rd innan n\xE5gra enskilda \xE5tg\xE4rder som p\xE5\
            verkar honom eller henne negativt vidtas och vara utformad s\xE5 att on\xF6\
            diga kostnader och alltf\xF6r stora ol\xE4genheter f\xF6r de ber\xF6rda\
            \ personerna undviks. Unders\xF6kningsbefogenheten n\xE4r det g\xE4ller\
            \ tilltr\xE4de till lokaler b\xF6r ut\xF6vas i enlighet med s\xE4rskilda\
            \ krav i medlemsstaternas nationella processr\xE4tt, s\xE5som kravet p\xE5\
            \ att inh\xE4mta f\xF6rhandstillst\xE5nd fr\xE5n r\xE4ttsliga myndigheter.\
            \ Varje r\xE4ttsligt bindande \xE5tg\xE4rd som vidtas av tillsynsmyndigheten\
            \ b\xF6r vara skriftlig, klar och entydig, inneh\xE5lla information om\
            \ vilken tillsynsmyndighet som har utf\xE4rdat \xE5tg\xE4rden och datum\
            \ f\xF6r utf\xE4rdandet, vara undertecknad av tillsynsmyndighetens chef\
            \ eller en av dess ledam\xF6ter efter dennes bemyndigande samt inneh\xE5\
            lla en motivering till \xE5tg\xE4rden och en h\xE4nvisning till r\xE4\
            tten till ett effektivt r\xE4ttsmedel. Detta b\xF6r inte utesluta ytterligare\
            \ krav enligt medlemsstaternas nationella processr\xE4tt. Antagande av\
            \ ett r\xE4ttsligt bindande beslut inneb\xE4r att det kan bli f\xF6rem\xE5\
            l f\xF6r domstolspr\xF6vning i den medlemsstat till vilken den tillsynsmyndighet\
            \ som antog beslutet\_h\xF6r."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-130
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 130
      description: Where the supervisory authority with which the complaint has been
        lodged is not the lead supervisory authority, the lead supervisory authority
        should closely cooperate with the supervisory authority with which the complaint
        has been lodged in accordance with the provisions on cooperation and consistency
        laid down in this Regulation. In such cases, the lead supervisory authority
        should, when taking measures intended to produce legal effects, including
        the imposition of administrative fines, take utmost account of the view of
        the supervisory authority with which the complaint has been lodged and which
        should remain competent to carry out any investigation on the territory of
        its own Member State in liaison with the competent supervisory authority.
      translations:
        sv:
          name: "Sk\xE4l 130"
          description: "Om den tillsynsmyndighet till vilken klagom\xE5let har ingetts\
            \ inte \xE4r den ansvariga tillsynsmyndigheten, b\xF6r den ansvariga tillsynsmyndigheten\
            \ n\xE4ra samarbeta med den tillsynsmyndighet till vilken klagom\xE5let\
            \ har ingetts i enlighet med de best\xE4mmelser om samarbete och enhetlighet\
            \ som fastst\xE4lls i denna f\xF6rordning. I s\xE5dana fall b\xF6r den\
            \ ansvariga tillsynsmyndigheten n\xE4r den vidtar \xE5tg\xE4rder avsedda\
            \ att ha r\xE4ttsverkan, inbegripet utd\xF6mandet av administrativa sanktionsavgifter,\
            \ ta st\xF6rsta h\xE4nsyn till synpunkter fr\xE5n den tillsynsmyndighet\
            \ till vilken klagom\xE5let har ingetts, vilken b\xF6r kvarst\xE5 som\
            \ beh\xF6rig f\xF6r genomf\xF6rande av utredningar p\xE5 den egna medlemsstatens\
            \ territorium i samverkan med den beh\xF6riga tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-131
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 131
      description: 'Where another supervisory authority should act as a lead supervisory
        authority for the processing activities of the controller or processor but
        the concrete subject matter of a complaint or the possible infringement concerns
        only processing activities of the controller or processor in the Member State
        where the complaint has been lodged or the possible infringement detected
        and the matter does not substantially affect or is not likely to substantially
        affect data subjects in other Member States, the supervisory authority receiving
        a complaint or detecting or being informed otherwise of situations that entail
        possible infringements of this Regulation should seek an amicable settlement
        with the controller and, if this proves unsuccessful, exercise its full range
        of powers. This should include: specific processing carried out in the territory
        of the Member State of the supervisory authority or with regard to data subjects
        on the territory of that Member State; processing that is carried out in the
        context of an offer of goods or services specifically aimed at data subjects
        in the territory of the Member State of the supervisory authority; or processing
        that has to be assessed taking into account relevant legal obligations under
        Member State law.'
      translations:
        sv:
          name: "Sk\xE4l 131"
          description: "Om en annan tillsynsmyndighet b\xF6r agera som ansvarig tillsynsmyndighet\
            \ f\xF6r den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets\
            \ behandling men den sakfr\xE5ga som klagom\xE5let g\xE4ller eller den\
            \ m\xF6jliga \xF6vertr\xE4delsen endast r\xF6r den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets behandling i den medlemsstat d\xE4\
            r klagom\xE5let har ingetts eller den eventuella \xF6vertr\xE4delsen har\
            \ uppt\xE4ckts, och fr\xE5gan inte i v\xE4sentlig grad p\xE5verkar eller\
            \ inte sannolikt i v\xE4sentlig grad kommer att p\xE5verka registrerade\
            \ i andra medlemsstater, b\xF6r den tillsynsmyndighet som mottar ett klagom\xE5\
            l eller uppt\xE4cker eller p\xE5 annat s\xE4tt informeras om situationer\
            \ som inneb\xE4r eventuella \xF6vertr\xE4delser av denna f\xF6rordning\
            \ f\xF6rs\xF6ka f\xE5 till st\xE5nd en uppg\xF6relse i godo med den personuppgiftsansvarige\
            \ och, om detta inte lyckas, ut\xF6va sina befogenheter fullt ut. Detta\
            \ b\xF6r omfatta s\xE4rskild behandling som utf\xF6rs inom tillsynsmyndighetens\
            \ medlemsstats territorium eller med avseende p\xE5 registrerade inom\
            \ denna medlemsstats territorium, behandling som utf\xF6rs inom ramen\
            \ f\xF6r ett erbjudande om varor eller tj\xE4nster som s\xE4rskilt riktar\
            \ sig till registrerade inom tillsynsmyndighetens medlemsstats territorium\
            \ eller behandling som m\xE5ste bed\xF6mas med beaktande av relevanta\
            \ r\xE4ttsliga skyldigheter enligt medlemsstaternas nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-132
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 132
      description: Awareness-raising activities by supervisory authorities addressed
        to the public should include specific measures directed at controllers and
        processors, including micro, small and medium-sized enterprises, as well as
        natural persons in particular in the educational context.
      translations:
        sv:
          name: "Sk\xE4l 132"
          description: "Medvetandeh\xF6jande kampanjer fr\xE5n tillsynsmyndigheters\
            \ sida riktade till allm\xE4nheten b\xF6r innefatta s\xE4rskilda \xE5\
            tg\xE4rder riktade dels till personuppgiftsansvariga och personuppgiftsbitr\xE4\
            den, inbegripet mikrof\xF6retag samt sm\xE5 och medelstora f\xF6retag,\
            \ dels till fysiska personer, s\xE4rskilt i utbildningssammanhang."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-133
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 133
      description: The supervisory authorities should assist each other in performing
        their tasks and provide mutual assistance, so as to ensure the consistent
        application and enforcement of this Regulation in the internal market. A supervisory
        authority requesting mutual assistance may adopt a provisional measure if
        it receives no response to a request for mutual assistance within one month
        of the receipt of that request by the other supervisory authority.
      translations:
        sv:
          name: "Sk\xE4l 133"
          description: "Tillsynsmyndigheterna b\xF6r hj\xE4lpa varandra att utf\xF6\
            ra sina uppgifter och ge \xF6msesidigt bist\xE5nd s\xE5 att denna f\xF6\
            rordning till\xE4mpas och verkst\xE4lls enhetligt p\xE5 den inre marknaden.\
            \ En tillsynsmyndighet som beg\xE4rt \xF6msesidigt bist\xE5nd f\xE5r anta\
            \ en provisorisk \xE5tg\xE4rd, om den inte har f\xE5tt n\xE5got svar p\xE5\
            \ en beg\xE4ran om \xF6msesidigt bist\xE5nd inom en m\xE5nad fr\xE5n det\
            \ att beg\xE4ran mottogs av den andra tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-134
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 134
      description: Each supervisory authority should, where appropriate, participate
        in joint operations with other supervisory authorities. The requested supervisory
        authority should be obliged to respond to the request within a specified time
        period.
      translations:
        sv:
          name: "Sk\xE4l 134"
          description: "Alla tillsynsmyndigheter b\xF6r om l\xE4mpligt delta i gemensamma\
            \ insatser med andra tillsynsmyndigheter. Den anmodade tillsynsmyndigheten\
            \ b\xF6r vara skyldig att besvara en beg\xE4ran inom en fastst\xE4lld\
            \ tidsperiod."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-135
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 135
      description: In order to ensure the consistent application of this Regulation
        throughout the Union, a consistency mechanism for cooperation between the
        supervisory authorities should be established. That mechanism should in particular
        apply where a supervisory authority intends to adopt a measure intended to
        produce legal effects as regards processing operations which substantially
        affect a significant number of data subjects in several Member States. It
        should also apply where any supervisory authority concerned or the Commission
        requests that such matter should be handled in the consistency mechanism.
        That mechanism should be without prejudice to any measures that the Commission
        may take in the exercise of its powers under the Treaties.
      translations:
        sv:
          name: "Sk\xE4l 135"
          description: "F\xF6r att denna f\xF6rordning ska till\xE4mpas enhetligt\
            \ i hela unionen b\xF6r en mekanism f\xF6r enhetlighet n\xE4r det g\xE4\
            ller samarbete mellan tillsynsmyndigheterna skapas. Denna mekanism b\xF6\
            r fr\xE4mst till\xE4mpas n\xE4r en tillsynsmyndighet avser att anta en\
            \ \xE5tg\xE4rd som \xE4r avsedd att ha r\xE4ttsverkan g\xE4llande behandlingar\
            \ som i v\xE4sentlig grad p\xE5verkar ett betydande antal registrerade\
            \ i flera medlemsstater. Den b\xF6r ocks\xE5 till\xE4mpas n\xE4r en ber\xF6\
            rd tillsynsmyndighet eller kommissionen beg\xE4r att ett s\xE5dant \xE4\
            rende ska hanteras inom ramen f\xF6r mekanismen f\xF6r enhetlighet. Mekanismen\
            \ b\xF6r inte p\xE5verka \xE5tg\xE4rder som kommissionen kan komma att\
            \ vidta n\xE4r den ut\xF6var sina befogenheter enligt f\xF6rdragen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-136
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 136
      description: In applying the consistency mechanism, the Board should, within
        a determined period of time, issue an opinion, if a majority of its members
        so decides or if so requested by any supervisory authority concerned or the
        Commission. The Board should also be empowered to adopt legally binding decisions
        where there are disputes between supervisory authorities. For that purpose,
        it should issue, in principle by a two-thirds majority of its members, legally
        binding decisions in clearly specified cases where there are conflicting views
        among supervisory authorities, in particular in the cooperation mechanism
        between the lead supervisory authority and supervisory authorities concerned
        on the merits of the case, in particular whether there is an infringement
        of this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 136"
          description: "Vid till\xE4mpningen av mekanismen f\xF6r enhetlighet b\xF6\
            r styrelsen inom en fastst\xE4lld tidsperiod avge ett yttrande, om en\
            \ majoritet av dess ledam\xF6ter s\xE5 beslutar eller om n\xE5gon ber\xF6\
            rd tillsynsmyndighet eller kommissionen beg\xE4r detta. Styrelsen b\xF6\
            r ocks\xE5 ges befogenhet att anta r\xE4ttsligt bindande beslut vid tvister\
            \ mellan tillsynsmyndigheter. F\xF6r detta \xE4ndam\xE5l b\xF6r den, normalt\
            \ med tv\xE5 tredjedelars majoritet av sina ledam\xF6ter, utf\xE4rda r\xE4\
            ttsligt bindande beslut i tydligt fastst\xE4llda fall d\xE5 tillsynsmyndigheter\
            \ har olika uppfattningar, framf\xF6r allt n\xE4r det g\xE4ller mekanismen\
            \ f\xF6r samarbete mellan den ansvariga tillsynsmyndigheten och ber\xF6\
            rda tillsynsmyndigheter om sakf\xF6rh\xE5llandena, i synnerhet om huruvida\
            \ denna f\xF6rordning har \xF6vertr\xE4tts."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-137
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 137
      description: There may be an urgent need to act in order to protect the rights
        and freedoms of data subjects, in particular when the danger exists that the
        enforcement of a right of a data subject could be considerably impeded. A
        supervisory authority should therefore be able to adopt duly justified provisional
        measures on its territory with a specified period of validity which should
        not exceed three months.
      translations:
        sv:
          name: "Sk\xE4l 137"
          description: "Det kan uppst\xE5 br\xE5dskande behov att agera f\xF6r att\
            \ skydda registrerades r\xE4ttigheter och friheter, s\xE4rskilt n\xE4\
            r fara f\xF6religger att s\xE4kerst\xE4llandet av en registrerad persons\
            \ r\xE4ttighet kan komma att f\xF6rsv\xE5ras avsev\xE4rt. En tillsynsmyndighet\
            \ b\xF6r d\xE4rf\xF6r kunna vidta vederb\xF6rligen motiverade provisoriska\
            \ \xE5tg\xE4rder inom sitt territorium med en viss giltighetsperiod, som\
            \ inte b\xF6r \xF6verskrida tre m\xE5nader."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-138
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 138
      description: The application of such mechanism should be a condition for the
        lawfulness of a measure intended to produce legal effects by a supervisory
        authority in those cases where its application is mandatory. In other cases
        of cross- border relevance, the cooperation mechanism between the lead supervisory
        authority and supervisory authorities concerned should be applied and mutual
        assistance and joint operations might be carried out between the supervisory
        authorities concerned on a bilateral or multilateral basis without triggering
        the consistency mechanism.
      translations:
        sv:
          name: "Sk\xE4l 138"
          description: "Till\xE4mpningen av en s\xE5dan mekanism b\xF6r vara ett villkor\
            \ f\xF6r lagligheten av en \xE5tg\xE4rd som \xE4r avsedd att ha r\xE4\
            ttsverkan och som vidtas av tillsynsmyndigheten i de fall d\xE4r denna\
            \ till\xE4mpning \xE4r obligatorisk. I andra \xE4renden som inbegriper\
            \ flera l\xE4nder b\xF6r samarbetsmekanismen mellan den ansvariga tillsynsmyndigheten\
            \ och ber\xF6rda tillsynsmyndigheter till\xE4mpas, och \xF6msesidigt bist\xE5\
            nd och gemensamma insatser kan utf\xF6ras mellan de ber\xF6rda tillsynsmyndigheterna\
            \ p\xE5 bilateral eller multilateral basis utan att mekanismen f\xF6r\
            \ enhetlighet utl\xF6ses."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-139
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 139
      description: In order to promote the consistent application of this Regulation,
        the Board should be set up as an independent body of the Union. To fulfil
        its objectives, the Board should have legal personality. The Board should
        be represented by its Chair. It should replace the Working Party on the Protection
        of Individuals with Regard to the Processing of Personal Data established
        by Directive 95/46/EC. It should consist of the head of a supervisory authority
        of each Member State and the European Data Protection Supervisor or their
        respective representatives. The Commission should participate in the Board's
        activities without voting rights and the European Data Protection Supervisor
        should have specific voting rights. The Board should contribute to the consistent
        application of this Regulation throughout the Union, including by advising
        the Commission, in particular on the level of protection in third countries
        or international organisations, and promoting cooperation of the supervisory
        authorities throughout the Union. The Board should act independently when
        performing its tasks.
      translations:
        sv:
          name: "Sk\xE4l 139"
          description: "I syfte att fr\xE4mja en enhetlig till\xE4mpning av denna\
            \ f\xF6rordning b\xF6r styrelsen inr\xE4ttas som ett oberoende unionsorgan.\
            \ F\xF6r att styrelsen ska kunna uppfylla sina m\xE5l b\xF6r den vara\
            \ en juridisk person. Styrelsen b\xF6r f\xF6retr\xE4das av sin ordf\xF6\
            rande. Den b\xF6r ers\xE4tta arbetsgruppen f\xF6r skydd av fysiska personer\
            \ med avseende p\xE5 behandlingen av personuppgifter, som inr\xE4ttades\
            \ genom direktiv 95/46/EG. Den b\xF6r best\xE5 av chefen f\xF6r en tillsynsmyndighet\
            \ i\_varje medlemsstat och Europeiska datatillsynsmannen eller deras respektive\
            \ f\xF6retr\xE4dare. Kommissionen b\xF6r delta i styrelsens verksamhet\
            \ utan att ha r\xF6str\xE4tt, och Europeiska datatillsynsmannen b\xF6\
            r ha specifik r\xF6str\xE4tt. Styrelsen b\xF6r bidra till denna f\xF6\
            rordnings enhetliga till\xE4mpning i hela unionen, bl.a. genom att l\xE4\
            mna r\xE5d till kommissionen, s\xE4rskilt vad g\xE4ller skyddsniv\xE5\
            n i tredjel\xE4nder eller internationella organisationer, och fr\xE4mja\
            \ samarbetet mellan tillsynsmyndigheterna i hela unionen. Styrelsen b\xF6\
            r agera oberoende n\xE4r den utf\xF6r sina uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-140
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 140
      description: The Board should be assisted by a secretariat provided by the European
        Data Protection Supervisor. The staff of the European Data Protection Supervisor
        involved in carrying out the tasks conferred on the Board by this Regulation
        should perform its tasks exclusively under the instructions of, and report
        to, the Chair of the Board.
      translations:
        sv:
          name: "Sk\xE4l 140"
          description: "Styrelsen b\xF6r bitr\xE4das av ett sekretariat som tillhandah\xE5\
            lls av Europeiska datatillsynsmannen. Den personal vid Europeiska datatillsynsmannen\
            \ som medverkar i\_utf\xF6randet av de uppgifter som enligt denna f\xF6\
            rordning anf\xF6rtros styrelsen b\xF6r f\xF6r sina uppgifter uteslutande\
            \ ta emot instruktioner fr\xE5n styrelsens ordf\xF6rande och rapportera\
            \ till\_denne."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-141
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 141
      description: Every data subject should have the right to lodge a complaint with
        a single supervisory authority, in particular in the Member State of his or
        her habitual residence, and the right to an effective judicial remedy in accordance
        with Article 47 of the Charter if the data subject considers that his or her
        rights under this Regulation are infringed or where the supervisory authority
        does not act on a complaint, partially or wholly rejects or dismisses a complaint
        or does not act where such action is necessary to protect the rights of the
        data subject. The investigation following a complaint should be carried out,
        subject to judicial review, to the extent that is appropriate in the specific
        case. The supervisory authority should inform the data subject of the progress
        and the outcome of the complaint within a reasonable period. If the case requires
        further investigation or coordination with another supervisory authority,
        intermediate information should be given to the data subject. In order to
        facilitate the submission of complaints, each supervisory authority should
        take measures such as providing a complaint submission form which can also
        be completed electronically, without excluding other means of communication.
      translations:
        sv:
          name: "Sk\xE4l 141"
          description: "Alla registrerade b\xF6r ha r\xE4tt att l\xE4mna in ett klagom\xE5\
            l till en enda tillsynsmyndighet, s\xE4rskilt i\_den medlemsstat d\xE4\
            r den registrerade har sin hemvist, och ha r\xE4tt till ett effektivt\
            \ r\xE4ttsmedel i\_enlighet med artikel 47 i stadgan, om den registrerade\
            \ anser att hans eller hennes r\xE4ttigheter enligt denna f\xF6rordning\
            \ har kr\xE4nkts eller om tillsynsmyndigheten inte reagerar p\xE5 ett\
            \ klagom\xE5l, helt eller delvis avsl\xE5r eller avvisar ett klagom\xE5\
            l eller inte agerar n\xE4r s\xE5 \xE4r n\xF6dv\xE4ndigt f\xF6r att skydda\
            \ den registrerades r\xE4ttigheter. Utredningen av ett klagom\xE5l b\xF6\
            r, med f\xF6rbeh\xE5ll f\xF6r eventuell domstolspr\xF6vning, ske i den\
            \ utstr\xE4ckning som \xE4r l\xE4mplig i det enskilda fallet. Tillsynsmyndigheten\
            \ b\xF6r inom rimlig tid informera den registrerade om hur arbetet med\
            \ klagom\xE5let fortskrider och vad resultatet blir. Om \xE4rendet fordrar\
            \ ytterligare utredning eller samordning med en annan tillsynsmyndighet,\
            \ b\xF6r den registrerade underr\xE4ttas \xE4ven om detta. F\xF6r att\
            \ f\xF6renkla inl\xE4mningen av klagom\xE5l b\xF6r varje tillsynsmyndighet\
            \ vidta \xE5tg\xE4rder, s\xE5som att tillhandah\xE5lla ett formul\xE4\
            r f\xF6r inl\xE4mnande av klagom\xE5l som \xE4ven kan fyllas i elektroniskt,\
            \ utan att andra kommunikationsformer utesluts."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-142
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 142
      description: Where a data subject considers that his or her rights under this
        Regulation are infringed, he or she should have the right to mandate a not-for-profit
        body, organisation or association which is constituted in accordance with
        the law of a Member State, has statutory objectives which are in the public
        interest and is active in the field of the protection of personal data to
        lodge a complaint on his or her behalf with a supervisory authority, exercise
        the right to a judicial remedy on behalf of data subjects or, if provided
        for in Member State law, exercise the right to receive compensation on behalf
        of data subjects. A Member State may provide for such a body, organisation
        or association to have the right to lodge a complaint in that Member State,
        independently of a data subject's mandate, and the right to an effective judicial
        remedy where it has reasons to consider that the rights of a data subject
        have been infringed as a result of the processing of personal data which infringes
        this Regulation. That body, organisation or association may not be allowed
        to claim compensation on a data subject's behalf independently of the data
        subject's mandate.
      translations:
        sv:
          name: "Sk\xE4l 142"
          description: "Om en registrerad anser att hans eller hennes r\xE4ttigheter\
            \ enligt denna f\xF6rordning har kr\xE4nkts, b\xF6r han eller hon ha r\xE4\
            tt att ge mandat till ett organ, en organisation eller en sammanslutning\
            \ som drivs utan vinstsyfte och som har inr\xE4ttats i enlighet med en\
            \ medlemsstats nationella r\xE4tt, som har stadgeenliga m\xE5l av allm\xE4\
            nt intresse och bedriver verksamhet p\xE5 omr\xE5det skydd av personuppgifter,\
            \ att p\xE5 hans eller hennes v\xE4gnar l\xE4mna in ett klagom\xE5l till\
            \ en tillsynsmyndighet, om detta f\xF6reskrivs i medlemsstatens nationella\
            \ r\xE4tt, att p\xE5 den registrerades v\xE4gnar ut\xF6va r\xE4tten till\
            \ domstolspr\xF6vning eller att p\xE5 den registrerades v\xE4gnar ut\xF6\
            va r\xE4tten att ta emot ers\xE4ttning. En medlemsstat f\xE5r f\xF6reskriva\
            \ att ett s\xE5dant organ, en s\xE5dan organisation eller en s\xE5dan\
            \ sammanslutning ska ha r\xE4tt att l\xE4mna in ett klagom\xE5l i den\
            \ medlemsstaten, oberoende av en registrerad persons mandat, och ha r\xE4\
            tt till ett effektivt r\xE4ttsmedel, om det eller den har sk\xE4l att\
            \ anse att en registrerad persons r\xE4ttigheter har kr\xE4nkts till f\xF6\
            ljd av behandling av personuppgifter som strider mot denna f\xF6rordning.\
            \ Detta organ, denna organisation eller denna sammanslutning f\xE5r inte\
            \ ges r\xE4tt att kr\xE4va ers\xE4ttning p\xE5 en registrerad persons\
            \ v\xE4gnar oberoende av den registrerades mandat."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-143
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 143
      description: Any natural or legal person has the right to bring an action for
        annulment of decisions of the Board before the Court of Justice under the
        conditions provided for in Article 263 TFEU. As addressees of such decisions,
        the supervisory authorities concerned which wish to challenge them have to
        bring action within two months of being notified of them, in accordance with
        Article 263 TFEU. Where decisions of the Board are of direct and individual
        concern to a controller, processor or complainant, the latter may bring an
        action for annulment against those decisions within two months of their publication
        on the website of the Board, in accordance with Article 263 TFEU. Without
        prejudice to this right under Article 263 TFEU, each natural or legal person
        should have an effective judicial remedy before the competent national court
        against a decision of a supervisory authority which produces legal effects
        concerning that person. Such a decision concerns in particular the exercise
        of investigative, corrective and authorisation powers by the supervisory authority
        or the dismissal or rejection of complaints. However, the right to an effective
        judicial remedy does not encompass measures taken by supervisory authorities
        which are not legally binding, such as opinions issued by or advice provided
        by the supervisory authority. Proceedings against a supervisory authority
        should be brought before the courts of the Member State where the supervisory
        authority is established and should be conducted in accordance with that Member
        State's procedural law. Those courts should exercise full jurisdiction, which
        should include jurisdiction to examine all questions of fact and law relevant
        to the dispute before them.
      translations:
        sv:
          name: "Sk\xE4l 143"
          description: "Varje fysisk eller juridisk person har r\xE4tt att v\xE4cka\
            \ ogiltighetstalan mot styrelsens beslut vid domstolen enligt de villkor\
            \ som f\xF6reskrivs i artikel 263 i EUF-f\xF6rdraget. I sin egenskap av\
            \ adressater f\xF6r s\xE5dana beslut m\xE5ste, i enlighet med artikel\
            \ 263 i EUF-f\xF6rdraget, de ber\xF6rda tillsynsmyndigheter som \xF6nskar\
            \ \xF6verklaga dessa v\xE4cka talan inom tv\xE5 m\xE5nader efter det att\
            \ beslutet meddelats dem. Om styrelsens beslut direkt och personligen\
            \ ber\xF6r en personuppgiftsansvarig, ett personuppgiftsbitr\xE4de eller\
            \ en enskild, kan den enskilde v\xE4cka ogiltighetstalan mot besluten\
            \ inom tv\xE5 m\xE5nader efter det att de har offentliggjorts p\xE5 styrelsens\
            \ webbplats, i enlighet med artikel 263 i EUF-f\xF6rdraget. Utan att det\
            \ p\xE5verkar denna r\xE4tt inom ramen f\xF6r artikel 263 i EUF-f\xF6\
            rdraget b\xF6r varje fysisk eller juridisk person ha r\xE4tt till ett\
            \ effektivt r\xE4ttsmedel vid den beh\xF6riga nationella domstolen mot\
            \ ett beslut av en tillsynsmyndighet som har r\xE4ttsliga f\xF6ljder f\xF6\
            r denna person. S\xE5dana beslut avser s\xE4rskilt tillsynsmyndighetens\
            \ ut\xF6vande av utrednings-, korrigerings- och godk\xE4nnandebefogenheter\
            \ eller avvisande av eller avslag p\xE5 klagom\xE5l. R\xE4tten till ett\
            \ effektivt r\xE4ttsmedel inbegriper dock inte \xE5tg\xE4rder som vidtagits\
            \ av tillsynsmyndigheter n\xE4r dessa inte \xE4r r\xE4ttsligt bindande,\
            \ s\xE5som yttranden som avgivits eller r\xE5dgivning som tillhandah\xE5\
            llits av tillsynsmyndigheten. Talan mot beslut som har fattats av en tillsynsmyndighet\
            \ b\xF6r v\xE4ckas vid domstolarna i den medlemsstat d\xE4r tillsynsmyndigheten\
            \ har sitt s\xE4te och b\xF6r genomf\xF6ras i enlighet med den medlemsstatens\
            \ nationella processr\xE4tt. Dessa domstolar b\xF6r ha fullst\xE4ndig\
            \ beh\xF6righet, vilket b\xF6r omfatta beh\xF6righet att pr\xF6va alla\
            \ fakta och r\xE4ttsliga fr\xE5gor som r\xF6r den tvist som anh\xE4ngiggjorts\
            \ vid dem."
    - urn: urn:intuitem:risk:req_node:gdpr:node147
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      description: Where a complaint has been rejected or dismissed by a supervisory
        authority, the complainant may bring proceedings before the courts in the
        same Member State. In the context of judicial remedies relating to the application
        of this Regulation, national courts which consider a decision on the question
        necessary to enable them to give judgment, may, or in the case provided for
        in Article 267 TFEU, must, request the Court of Justice to give a preliminary
        ruling on the interpretation of Union law, including this Regulation. Furthermore,
        where a decision of a supervisory authority implementing a decision of the
        Board is challenged before a national court and the validity of the decision
        of the Board is at issue, that national court does not have the power to declare
        the Board's decision invalid but must refer the question of validity to the
        Court of Justice in accordance with Article 267 TFEU as interpreted by the
        Court of Justice, where it considers the decision invalid. However, a national
        court may not refer a question on the validity of the decision of the Board
        at the request of a natural or legal person which had the opportunity to bring
        an action for annulment of that decision, in particular if it was directly
        and individually concerned by that decision, but had not done so within the
        period laid down in Article 263 TFEU.
      translations:
        sv:
          description: "Om talan avsl\xE5s eller avvisas av en tillsynsmyndighet,\
            \ kan den enskilde v\xE4cka talan vid domstolarna i samma medlemsstat.\
            \ I samband med r\xE4ttsmedel som avser till\xE4mpningen av denna f\xF6\
            rordning kan eller, i det fall som anges i artikel 267 i EUF-f\xF6rdraget,\
            \ m\xE5ste nationella domstolar som anser att ett beslut om ett f\xF6\
            rhandsavg\xF6rande \xE4r n\xF6dv\xE4ndigt f\xF6r att de ska kunna d\xF6\
            ma beg\xE4ra att domstolen meddelar ett f\xF6rhandsavg\xF6rande om tolkningen\
            \ av unionsr\xE4tten, inbegripet denna f\xF6rordning. Om dessutom ett\
            \ beslut av en tillsynsmyndighet om genomf\xF6rande av ett beslut av styrelsen\
            \ \xF6verklagas till en nationell domstol och giltigheten av styrelsens\
            \ beslut ifr\xE5gas\xE4tts, har inte den nationella domstolen befogenhet\
            \ att f\xF6rklara styrelsens beslut ogiltigt utan m\xE5ste h\xE4nskjuta\
            \ fr\xE5gan om giltighet till domstolen i enlighet med artikel 267 i EUF-f\xF6\
            rdraget s\xE5som den tolkats av domstolen, n\xE4rhelst den anser att beslutet\
            \ \xE4r ogiltigt. En nationell domstol f\xE5r dock inte h\xE4nskjuta en\
            \ fr\xE5ga om giltigheten av styrelsens beslut p\xE5 beg\xE4ran av en\
            \ fysisk eller juridisk person som haft tillf\xE4lle att v\xE4cka ogiltighetstalan\
            \ mot beslutet, i synnerhet inte om denna person direkt och personligen\
            \ ber\xF6rdes av beslutet men inte gjorde detta inom den frist som anges\
            \ i artikel 263 i EUF-f\xF6rdraget."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-144
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 144
      description: Where a court seized of proceedings against a decision by a supervisory
        authority has reason to believe that proceedings concerning the same processing,
        such as the same subject matter as regards processing by the same controller
        or processor, or the same cause of action, are brought before a competent
        court in another Member State, it should contact that court in order to confirm
        the existence of such related proceedings. If related proceedings are pending
        before a court in another Member State, any court other than the court first
        seized may stay its proceedings or may, on request of one of the parties,
        decline jurisdiction in favour of the court first seized if that court has
        jurisdiction over the proceedings in question and its law permits the consolidation
        of such related proceedings. Proceedings are deemed to be related where they
        are so closely connected that it is expedient to hear and determine them together
        in order to avoid the risk of irreconcilable judgments resulting from separate
        proceedings.
      translations:
        sv:
          name: "Sk\xE4l 144"
          description: "Om en domstol d\xE4r ett f\xF6rfarande inletts mot beslut\
            \ som har fattats av en tillsynsmyndighet har sk\xE4l att tro att ett\
            \ f\xF6rfarande r\xF6rande samma behandling, s\xE5som samma sakfr\xE5\
            ga vad g\xE4ller behandling av samma personuppgiftsansvarige eller samma\
            \ personuppgiftsbitr\xE4de, eller samma h\xE4ndelsef\xF6rlopp, har inletts\
            \ vid en annan beh\xF6rig domstol i en annan medlemsstat, b\xF6r den kontakta\
            \ denna domstol i syfte att bekr\xE4fta f\xF6rekomsten av s\xE5dana relaterade\
            \ f\xF6rfaranden. Om relaterade f\xF6rfaranden p\xE5g\xE5r vid en domstol\
            \ i en annan medlemsstat f\xE5r alla andra domstolar \xE4n den domstol\
            \ d\xE4r f\xF6rfarandet f\xF6rst inleddes l\xE5ta f\xF6rfarandena vila\
            \ eller p\xE5 en av parternas beg\xE4ran f\xF6rklara sig obeh\xF6riga\
            \ till f\xF6rm\xE5n f\xF6r den domstol d\xE4r f\xF6rfarandet f\xF6rst\
            \ inleddes, om den domstolen har beh\xF6righet i f\xF6rfarandet i\_fr\xE5\
            ga och dess lagstiftning till\xE5ter f\xF6rening av s\xE5dana relaterade\
            \ f\xF6rfaranden. F\xF6rfarandena anses vara relaterade, om de \xE4r s\xE5\
            \ n\xE4ra f\xF6renade att en gemensam handl\xE4ggning och dom \xE4r p\xE5\
            kallad f\xF6r att undvika att of\xF6renliga domar meddelas som en f\xF6\
            ljd av att f\xF6rfarandena pr\xF6vas i olika r\xE4tteg\xE5ngar."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-145
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 145
      description: For proceedings against a controller or processor, the plaintiff
        should have the choice to bring the action before the courts of the Member
        States where the controller or processor has an establishment or where the
        data subject resides, unless the controller is a public authority of a Member
        State acting in the exercise of its public powers.
      translations:
        sv:
          name: "Sk\xE4l 145"
          description: "N\xE4r det g\xE4ller ett r\xE4ttsligt f\xF6rfarande mot en\
            \ personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de b\xF6r k\xE4\
            randen kunna v\xE4lja att v\xE4cka talan antingen vid domstolarna i\_\
            de medlemsstater d\xE4r den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det \xE4r etablerad eller d\xE4r den registrerade \xE4r bosatt, s\xE5\
            vida inte den personuppgiftsansvarige \xE4r en myndighet i en medlemsstat\
            \ som agerar inom ramen f\xF6r sin myndighetsut\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-146
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 146
      description: The controller or processor should compensate any damage which
        a person may suffer as a result of processing that infringes this Regulation.
        The controller or processor should be exempt from liability if it proves that
        it is not in any way responsible for the damage. The concept of damage should
        be broadly interpreted in the light of the case-law of the Court of Justice
        in a manner which fully reflects the objectives of this Regulation. This is
        without prejudice to any claims for damage deriving from the violation of
        other rules in Union or Member State law. Processing that infringes this Regulation
        also includes processing that infringes delegated and implementing acts adopted
        in accordance with this Regulation and Member State law specifying rules of
        this Regulation. Data subjects should receive full and effective compensation
        for the damage they have suffered. Where controllers or processors are involved
        in the same processing, each controller or processor should be held liable
        for the entire damage. However, where they are joined to the same judicial
        proceedings, in accordance with Member State law, compensation may be apportioned
        according to the responsibility of each controller or processor for the damage
        caused by the processing, provided that full and effective compensation of
        the data subject who suffered the damage is ensured. Any controller or processor
        which has paid full compensation may subsequently institute recourse proceedings
        against other controllers or processors involved in the same processing.
      translations:
        sv:
          name: "Sk\xE4l 146"
          description: "Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det\
            \ b\xF6r ers\xE4tta all skada som en person kan komma att lida till f\xF6\
            ljd av behandling som strider mot denna f\xF6rordning. Den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det b\xF6r dock befrias fr\xE5n skadest\xE5\
            ndsskyldighet om den kan visa att den inte p\xE5 n\xE5got s\xE4tt \xE4\
            r ansvarig f\xF6r skadan. Begreppet skada b\xF6r tolkas brett mot bakgrund\
            \ av domstolens r\xE4ttspraxis p\xE5 ett s\xE4tt som fullt ut \xE5terspeglar\
            \ denna f\xF6rordnings m\xE5l. Detta p\xE5verkar inte skadest\xE5ndsanspr\xE5\
            k till f\xF6ljd av \xF6vertr\xE4delser av andra best\xE4mmelser i unionsr\xE4\
            tten eller i medlemsstaternas nationella r\xE4tt. Behandling som strider\
            \ mot denna f\xF6rordning omfattar \xE4ven behandling som strider mot\
            \ delegerade akter och genomf\xF6randeakter som antagits i enlighet med\
            \ denna f\xF6rordning och medlemsstaternas nationella r\xE4tt med n\xE4\
            rmare specifikation av denna f\xF6rordnings best\xE4mmelser. Registrerade\
            \ b\xF6r f\xE5 full och effektiv ers\xE4ttning f\xF6r den skada de lidit.\
            \ Om personuppgiftsansvariga eller personuppgiftsbitr\xE4den medverkat\
            \ vid samma behandling, b\xF6r varje personuppgiftsansvarig eller personuppgiftsbitr\xE4\
            de h\xE5llas ansvarig f\xF6r hela skadan. Om de \xE4r f\xF6renade i samma\
            \ r\xE4ttsliga f\xF6rfarande i enlighet med medlemsstaternas nationella\
            \ r\xE4tt, kan ers\xE4ttningen dock f\xF6rdelas i enlighet med varje personuppgiftsansvarigs\
            \ eller personuppgiftsbitr\xE4des ansvar f\xF6r den genom behandlingen\
            \ uppkomna skadan, f\xF6rutsatt att den registrerade som lidit skada tillf\xF6\
            rs\xE4kras full och effektiv ers\xE4ttning. Varje personuppgiftsansvarig\
            \ eller personuppgiftsbitr\xE4de som har betalat full ers\xE4ttning f\xE5\
            r d\xE4refter inleda f\xF6rfaranden f\xF6r \xE5terkrav mot andra personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den som medverkat vid samma behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-147
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 147
      description: Where specific rules on jurisdiction are contained in this Regulation,
        in particular as regards proceedings seeking a judicial remedy including compensation,
        against a controller or processor, general jurisdiction rules such as those
        of Regulation (EU) No 1215/2012 of the European Parliament and of the Council
        (1) should not prejudice the application of such specific rules.
      translations:
        sv:
          name: "Sk\xE4l 147"
          description: "Om s\xE4rskilda best\xE4mmelser om beh\xF6righet fastst\xE4\
            lls i denna f\xF6rordning, framf\xF6r allt vad g\xE4ller f\xF6rfaranden\
            \ f\xF6r att beg\xE4ra r\xE4ttslig pr\xF6vning som inbegriper ers\xE4\
            ttning mot en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de, b\xF6r inte allm\xE4nna best\xE4mmelser om beh\xF6righet, s\xE5som\
            \ best\xE4mmelserna i Europaparlamentets och r\xE5dets f\xF6rordning\_\
            (EU) nr\_1215/2012\_(13), p\xE5verka till\xE4mpningen av s\xE5dana s\xE4\
            rskilda best\xE4mmelser."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-148
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 148
      description: In order to strengthen the enforcement of the rules of this Regulation,
        penalties including administrative fines should be imposed for any infringement
        of this Regulation, in addition to, or instead of appropriate measures imposed
        by the supervisory authority pursuant to this Regulation. In a case of a minor
        infringement or if the fine likely to be imposed would constitute a disproportionate
        burden to a natural person, a reprimand may be issued instead of a fine. Due
        regard should however be given to the nature, gravity and duration of the
        infringement, the intentional character of the infringement, actions taken
        to mitigate the damage suffered, degree of responsibility or any relevant
        previous infringements, the manner in which the infringement became known
        to the supervisory authority, compliance with measures ordered against the
        controller or processor, adherence to a code of conduct and any other aggravating
        or mitigating factor. The imposition of penalties including administrative
        fines should be subject to appropriate procedural safeguards in accordance
        with the general principles of Union law and the Charter, including effective
        judicial protection and due process.
      translations:
        sv:
          name: "Sk\xE4l 148"
          description: "F\xF6r att st\xE4rka verkst\xE4lligheten av denna f\xF6rordning\
            \ b\xF6r det utd\xF6mas sanktioner, inbegripet administrativa sanktionsavgifter,\
            \ f\xF6r \xF6vertr\xE4delser av denna f\xF6rordning ut\xF6ver eller i\
            \ st\xE4llet f\xF6r de l\xE4mpliga \xE5tg\xE4rder som tillsynsmyndigheten\
            \ vidtar i enlighet med denna f\xF6rordning. Vid en mindre \xF6vertr\xE4\
            delse eller om den sanktionsavgift som sannolikt skulle utd\xF6mas skulle\
            \ inneb\xE4ra en oproportionell b\xF6rda f\xF6r en fysisk person f\xE5\
            r en reprimand utf\xE4rdas i\_st\xE4llet f\xF6r sanktionsavgifter. Vederb\xF6\
            rlig h\xE4nsyn b\xF6r dock tas till \xF6vertr\xE4delsens karakt\xE4r,\
            \ sv\xE5righetsgrad och varaktighet och huruvida den har skett upps\xE5\
            tligen, vilka \xE5tg\xE4rder som vidtagits f\xF6r att lindra skadan, graden\
            \ av ansvar eller eventuella tidigare \xF6vertr\xE4delser av relevans,\
            \ det s\xE4tt p\xE5 vilket \xF6vertr\xE4delsen kom till tillsynsmyndighetens\
            \ k\xE4nnedom, efterlevnad av \xE5tg\xE4rder som f\xF6rordnats mot den\
            \ personuppgiftsansvarige eller personuppgiftsbitr\xE4det, till\xE4mpning\
            \ av en uppf\xF6randekod och eventuella andra f\xF6rsv\xE5rande eller\
            \ f\xF6rmildrande faktorer. Utd\xF6mandet av sanktioner, inbegripet administrativa\
            \ sanktionsavgifter, b\xF6r underkastas adekvata r\xE4ttss\xE4kerhetsgarantier\
            \ i \xF6verensst\xE4mmelse med allm\xE4nna principer inom unionsr\xE4\
            tten och stadgan, vilket inbegriper ett effektivt r\xE4ttsligt skydd och\
            \ korrekt r\xE4ttsligt f\xF6rfarande."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-149
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 149
      description: Member States should be able to lay down the rules on criminal
        penalties for infringements of this Regulation, including for infringements
        of national rules adopted pursuant to and within the limits of this Regulation.
        Those criminal penalties may also allow for the deprivation of the profits
        obtained through infringements of this Regulation. However, the imposition
        of criminal penalties for infringements of such national rules and of administrative
        penalties should not lead to a breach of the principle of ne bis in idem,
        as interpreted by the Court of Justice.
      translations:
        sv:
          name: "Sk\xE4l 149"
          description: "Medlemsstaterna b\xF6r kunna fastst\xE4lla best\xE4mmelser\
            \ om straffr\xE4ttsliga p\xE5f\xF6ljder f\xF6r \xF6vertr\xE4delser av\
            \ denna f\xF6rordning, inbegripet f\xF6r \xF6vertr\xE4delser av nationella\
            \ best\xE4mmelser som antagits i enlighet med och inom ramen f\xF6r denna\
            \ f\xF6rordning. Dessa straffr\xE4ttsliga p\xE5f\xF6ljder kan \xE4ven\
            \ inbegripa en m\xF6jlighet att f\xF6rverka den vinning som gjorts genom\
            \ \xF6vertr\xE4delser av denna f\xF6rordning. Utd\xF6mandet av straffr\xE4\
            ttsliga p\xE5f\xF6ljder f\xF6r \xF6vertr\xE4delser av s\xE5dana nationella\
            \ best\xE4mmelser och administrativa sanktioner b\xF6r dock inte medf\xF6\
            ra ett \xE5sidos\xE4ttande av principen ne bis in idem enligt domstolens\
            \ tolkning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-150
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 150
      description: In order to strengthen and harmonise administrative penalties for
        infringements of this Regulation, each supervisory authority should have the
        power to impose administrative fines. This Regulation should indicate infringements
        and the upper limit and criteria for setting the related administrative fines,
        which should be determined by the competent supervisory authority in each
        individual case, taking into account all relevant circumstances of the specific
        situation, with due regard in particular to the nature, gravity and duration
        of the infringement and of its consequences and the measures taken to ensure
        compliance with the obligations under this Regulation and to prevent or mitigate
        the consequences of the infringement. Where administrative fines are imposed
        on an undertaking, an undertaking should be understood to be an undertaking
        in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative
        fines are imposed on persons that are not an undertaking, the supervisory
        authority should take account of the general level of income in the Member
        State as well as the economic situation of the person in considering the appropriate
        amount of the fine. The consistency mechanism may also be used to promote
        a consistent application of administrative fines. It should be for the Member
        States to determine whether and to which extent public authorities should
        be subject to administrative fines. Imposing an administrative fine or giving
        a warning does not affect the application of other powers of the supervisory
        authorities or of other penalties under this Regulation.
      translations:
        sv:
          name: "Sk\xE4l 150"
          description: "Medlemsstaterna b\xF6r kunna fastst\xE4lla best\xE4mmelser\
            \ om straffr\xE4ttsliga p\xE5f\xF6ljder f\xF6r \xF6vertr\xE4delser av\
            \ denna f\xF6rordning, inbegripet f\xF6r \xF6vertr\xE4delser av nationella\
            \ best\xE4mmelser som antagits i enlighet med och inom ramen f\xF6r denna\
            \ f\xF6rordning. Dessa straffr\xE4ttsliga p\xE5f\xF6ljder kan \xE4ven\
            \ inbegripa en m\xF6jlighet att f\xF6rverka den vinning som gjorts genom\
            \ \xF6vertr\xE4delser av denna f\xF6rordning. Utd\xF6mandet av straffr\xE4\
            ttsliga p\xE5f\xF6ljder f\xF6r \xF6vertr\xE4delser av s\xE5dana nationella\
            \ best\xE4mmelser och administrativa sanktioner b\xF6r dock inte medf\xF6\
            ra ett \xE5sidos\xE4ttande av principen ne bis in idem enligt domstolens\
            \ tolkning."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-151
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 151
      description: The legal systems of Denmark and Estonia do not allow for administrative
        fines as set out in this Regulation. The rules on administrative fines may
        be applied in such a manner that in Denmark the fine is imposed by competent
        national courts as a criminal penalty and in Estonia the fine is imposed by
        the supervisory authority in the framework of a misdemeanour procedure, provided
        that such an application of the rules in those Member States has an equivalent
        effect to administrative fines imposed by supervisory authorities. Therefore
        the competent national courts should take into account the recommendation
        by the supervisory authority initiating the fine. In any event, the fines
        imposed should be effective, proportionate and dissuasive.
      translations:
        sv:
          name: "Sk\xE4l 151"
          description: "Danmarks och Estlands r\xE4ttssystem till\xE5ter inte administrativa\
            \ sanktionsavgifter i enlighet med denna f\xF6rordning. Best\xE4mmelserna\
            \ om administrativa sanktionsavgifter kan till\xE4mpas s\xE5 att sanktionsavgiften\
            \ i\_Danmark utd\xF6ms som en straffr\xE4ttslig p\xE5f\xF6ljd av en beh\xF6\
            rig nationell domstol och att den i Estland utd\xF6ms av tillsynsmyndigheten\
            \ inom ramen f\xF6r ett f\xF6rseelsef\xF6rfarande, under f\xF6ruts\xE4\
            ttning att en s\xE5dan till\xE4mpning av best\xE4mmelserna i dessa medlemsstater\
            \ har en effekt som \xE4r likv\xE4rdig med administrativa sanktionsavgifter\
            \ som utd\xF6ms av tillsynsmyndigheter. De beh\xF6riga nationella domstolarna\
            \ b\xF6r d\xE4rf\xF6r beakta rekommendationen fr\xE5n den tillsynsmyndighet\
            \ som initierar sanktionsavgiften. De sanktionsavgifter som utd\xF6ms\
            \ b\xF6r i alla h\xE4ndelser vara effektiva,\_proportionella och avskr\xE4\
            ckande."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-152
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 152
      description: Where this Regulation does not harmonise administrative penalties
        or where necessary in other cases, for example in cases of serious infringements
        of this Regulation, Member States should implement a system which provides
        for effective, proportionate and dissuasive penalties. The nature of such
        penalties, criminal or administrative, should be determined by Member State
        law.
      translations:
        sv:
          name: "Sk\xE4l 152"
          description: "Om denna f\xF6rordning inte harmoniserar administrativa sanktioner\
            \ eller om n\xF6dv\xE4ndigt i\_andra fall, till exempel vid fall av allvarliga\
            \ \xF6vertr\xE4delser av denna f\xF6rordning, b\xF6r medlemsstaterna genomf\xF6\
            ra ett system med effektiva, proportionella och avskr\xE4ckande sanktioner.\
            \ Dessa sanktioners art, straffr\xE4ttsliga eller administrativa, b\xF6\
            r fastst\xE4llas i\_medlemsstaternas nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-153
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 153
      description: Member States law should reconcile the rules governing freedom
        of expression and information, including journalistic, academic, artistic
        and or literary expression with the right to the protection of personal data
        pursuant to this Regulation. The processing of personal data solely for journalistic
        purposes, or for the purposes of academic, artistic or literary expression
        should be subject to derogations or exemptions from certain provisions of
        this Regulation if necessary to reconcile the right to the protection of personal
        data with the right to freedom of expression and information, as enshrined
        in Article 11 of the Charter. This should apply in particular to the processing
        of personal data in the audiovisual field and in news archives and press libraries.
        Therefore, Member States should adopt legislative measures which lay down
        the exemptions and derogations necessary for the purpose of balancing those
        fundamental rights. Member States should adopt such exemptions and derogations
        on general principles, the rights of the data subject, the controller and
        the processor, the transfer of personal data to third countries or international
        organisations, the independent supervisory authorities, cooperation and consistency,
        and specific data-processing situations. Where such exemptions or derogations
        differ from one Member State to another, the law of the Member State to which
        the controller is subject should apply. In order to take account of the importance
        of the right to freedom of expression in every democratic society, it is necessary
        to interpret notions relating to that freedom, such as journalism, broadly.
      translations:
        sv:
          name: "Sk\xE4l 153"
          description: "Medlemsstaterna b\xF6r i sin lagstiftning sammanj\xE4mka best\xE4\
            mmelserna om yttrandefrihet och informationsfrihet, vilket inbegriper\
            \ journalistiska, akademiska, konstn\xE4rliga och/eller litter\xE4ra uttrycksformer,\
            \ med r\xE4tten till skydd av personuppgifter i enlighet med denna f\xF6\
            rordning. Behandling av personuppgifter enbart f\xF6r journalistiska,\
            \ akademiska, konstn\xE4rliga eller litter\xE4ra \xE4ndam\xE5l b\xF6r\
            \ undantas fr\xE5n vissa av kraven i denna f\xF6rordning, s\xE5 att r\xE4\
            tten till skydd av personuppgifter vid behov kan f\xF6renas med r\xE4\
            tten till yttrandefrihet och informationsfrihet, som f\xF6ljer av artikel\
            \ 11 i stadgan. Detta b\xF6r s\xE4rskilt g\xE4lla vid behandling av personuppgifter\
            \ inom det audiovisuella omr\xE5det och i nyhetsarkiv och pressbibliotek.\
            \ Medlemsstaterna b\xF6r d\xE4rf\xF6r anta lagstiftnings\xE5tg\xE4rder\
            \ som fastst\xE4ller de olika undantag som beh\xF6vs f\xF6r att skapa\
            \ en balans mellan dessa grundl\xE4ggande r\xE4ttigheter. Medlemsstaterna\
            \ b\xF6r fastst\xE4lla s\xE5dana undantag med avseende p\xE5 allm\xE4\
            nna principer, de registrerades r\xE4ttigheter, personuppgiftsansvariga\
            \ och personuppgiftsbitr\xE4den, \xF6verf\xF6ring av uppgifter till tredjel\xE4\
            nder eller internationella organisationer, de oberoende tillsynsmyndigheterna,\
            \ samarbete och enhetlighet samt specifika situationer d\xE4r personuppgifter\
            \ behandlas. Om s\xE5dana undantag varierar fr\xE5n en medlemsstat till\
            \ en annan, ska den nationella r\xE4tten i den medlemsstat vars lag den\
            \ personuppgiftsansvarige omfattas av till\xE4mpas. F\xF6r att beakta\
            \ vikten av r\xE4tten till yttrandefrihet i varje demokratiskt samh\xE4\
            lle m\xE5ste det g\xF6ras en bred tolkning av vad som innefattas i denna\
            \ frihet, som till exempel journalistik."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-154
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 154
      description: This Regulation allows the principle of public access to official
        documents to be taken into account when applying this Regulation. Public access
        to official documents may be considered to be in the public interest. Personal
        data in documents held by a public authority or a public body should be able
        to be publicly disclosed by that authority or body if the disclosure is provided
        for by Union or Member State law to which the public authority or public body
        is subject. Such laws should reconcile public access to official documents
        and the reuse of public sector information with the right to the protection
        of personal data and may therefore provide for the necessary reconciliation
        with the right to the protection of personal data pursuant to this Regulation.
        The reference to public authorities and bodies should in that context include
        all authorities or other bodies covered by Member State law on public access
        to documents. Directive 2003/98/EC of the European Parliament and of the Council
        (1) leaves intact and in no way affects the level of protection of natural
        persons with regard to the processing of personal data under the provisions
        of Union and Member State law, and in particular does not alter the obligations
        and rights set out in this Regulation. In particular, that Directive should
        not apply to documents to which access is excluded or restricted by virtue
        of the access regimes on the grounds of protection of personal data, and parts
        of documents accessible by virtue of those regimes which contain personal
        data the re-use of which has been provided for by law as being incompatible
        with the law concerning the protection of natural persons with regard to the
        processing of personal data.
      translations:
        sv:
          name: "Sk\xE4l 154"
          description: "Denna f\xF6rordning g\xF6r det m\xF6jligt att vid till\xE4\
            mpningen av den ta h\xE4nsyn till principen om allm\xE4nhetens r\xE4tt\
            \ att f\xE5 tillg\xE5ng till allm\xE4nna handlingar. Allm\xE4nhetens r\xE4\
            tt att f\xE5 tillg\xE5ng till allm\xE4nna handlingar kan betraktas som\
            \ ett allm\xE4nt intresse. Personuppgifter i\_handlingar som innehas av\
            \ en myndighet eller ett offentligt organ b\xF6r kunna l\xE4mnas ut offentligt\
            \ av denna myndighet eller detta organ, om utl\xE4mning stadgas i\_unionsr\xE4\
            tten eller i\_medlemsstatens nationella r\xE4tt som \xE4r till\xE4mplig\
            \ p\xE5 myndigheten eller det offentliga organet. Denna r\xE4tt b\xF6\
            r sammanj\xE4mka allm\xE4nhetens r\xE4tt att f\xE5 tillg\xE5ng till allm\xE4\
            nna handlingar och vidareutnyttjande av information fr\xE5n den offentliga\
            \ sektorn med r\xE4tten till skydd av personuppgifter och f\xE5r d\xE4\
            rf\xF6r inneh\xE5lla f\xF6reskrifter om den n\xF6dv\xE4ndiga sammanj\xE4\
            mkningen med r\xE4tten till skydd av personuppgifter enligt denna f\xF6\
            rordning. H\xE4nvisningen till offentliga myndigheter och organ b\xF6\
            r i detta sammanhang omfatta samtliga myndigheter eller andra organ som\
            \ omfattas av medlemsstaternas nationella r\xE4tt om allm\xE4nhetens tillg\xE5\
            ng till handlingar. Europaparlamentets och r\xE5dets direktiv\_2003/98/EG\_\
            (14)\_ska inte p\xE5 n\xE5got s\xE4tt p\xE5verka skyddsniv\xE5n f\xF6\
            r fysiska personer med avseende p\xE5 behandling av personuppgifter enligt\
            \ best\xE4mmelserna i unionsr\xE4tten och i\_medlemsstaternas nationella\
            \ r\xE4tt och i\_synnerhet \xE4ndras inte de skyldigheter och r\xE4ttigheter\
            \ som anges i denna f\xF6rordning genom det direktivet. I synnerhet ska\
            \ direktivet inte vara till\xE4mpligt p\xE5 handlingar till vilka, med\
            \ h\xE4nsyn till skyddet av personuppgifter, tillg\xE5ng enligt tillg\xE5\
            ngsbest\xE4mmelserna \xE4r utesluten eller begr\xE4nsad eller p\xE5 delar\
            \ av handlingar som \xE4r tillg\xE4ngliga enligt dessa best\xE4mmelser\
            \ men som inneh\xE5ller personuppgifter vilkas vidareutnyttjande i lag\
            \ har fastst\xE4llts som of\xF6renligt med lagstiftningen om skydd f\xF6\
            r fysiska personer vid behandling av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-155
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 155
      description: "Member State law or collective agreements, including \u2018works\
        \ agreements\u2019, may provide for specific rules on the processing of employees'\
        \ personal data in the employment context, in particular for the conditions\
        \ under which personal data in the employment context may be processed on\
        \ the basis of the consent of the employee, the purposes of the recruitment,\
        \ the performance of the contract of employment, including discharge of obligations\
        \ laid down by law or by collective agreements, management, planning and organisation\
        \ of work, equality and diversity in the workplace, health and safety at work,\
        \ and for the purposes of the exercise and enjoyment, on an individual or\
        \ collective basis, of rights and benefits related to employment, and for\
        \ the purpose of the termination of the employment relationship."
      translations:
        sv:
          name: "Sk\xE4l 155"
          description: "En medlemsstatsnationella r\xE4tt eller kollektivavtal, inbegripet\
            \ \u201Dverksamhets\xF6verenskommelser\u201D, f\xE5r f\xF6reskriva s\xE4\
            rskilda best\xE4mmelser om behandling av anst\xE4lldas personuppgifter\
            \ i anst\xE4llningsf\xF6rh\xE5llanden, s\xE4rskilt n\xE4r det g\xE4ller\
            \ villkoren f\xF6r hur personuppgifter i\_anst\xE4llningsf\xF6rh\xE5llanden\
            \ f\xE5r behandlas p\xE5 grundval av samtycke fr\xE5n den anst\xE4llde,\
            \ rekrytering, genomf\xF6rande av anst\xE4llningsavtalet, inklusive befrielse\
            \ fr\xE5n i\_lag eller kollektivavtal stadgade skyldigheter, ledning,\
            \ planering och organisering av arbetet samt h\xE4lsa och s\xE4kerhet\
            \ p\xE5 arbetsplatsen, men ocks\xE5 n\xE4r det g\xE4ller att s\xE5v\xE4\
            l kollektivt som individuellt ut\xF6va och komma i \xE5tnjutande av r\xE4\
            ttigheter och f\xF6rm\xE5ner som \xE4r knutna till anst\xE4llningen samt\
            \ att avsluta anst\xE4llningsf\xF6rh\xE5llandet."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-156
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 156
      description: The processing of personal data for archiving purposes in the public
        interest, scientific or historical research purposes or statistical purposes
        should be subject to appropriate safeguards for the rights and freedoms of
        the data subject pursuant to this Regulation. Those safeguards should ensure
        that technical and organisational measures are in place in order to ensure,
        in particular, the principle of data minimisation. The further processing
        of personal data for archiving purposes in the public interest, scientific
        or historical research purposes or statistical purposes is to be carried out
        when the controller has assessed the feasibility to fulfil those purposes
        by processing data which do not permit or no longer permit the identification
        of data subjects, provided that appropriate safeguards exist (such as, for
        instance, pseudonymisation of the data). Member States should provide for
        appropriate safeguards for the processing of personal data for archiving purposes
        in the public interest, scientific or historical research purposes or statistical
        purposes. Member States should be authorised to provide, under specific conditions
        and subject to appropriate safeguards for data subjects, specifications and
        derogations with regard to the information requirements and rights to rectification,
        to erasure, to be forgotten, to restriction of processing, to data portability,
        and to object when processing personal data for archiving purposes in the
        public interest, scientific or historical research purposes or statistical
        purposes. The conditions and safeguards in question may entail specific procedures
        for data subjects to exercise those rights if this is appropriate in the light
        of the purposes sought by the specific processing along with technical and
        organisational measures aimed at minimising the processing of personal data
        in pursuance of the proportionality and necessity principles. The processing
        of personal data for scientific purposes should also comply with other relevant
        legislation such as on clinical trials.
      translations:
        sv:
          name: "Sk\xE4l 156"
          description: "Behandlingen av personuppgifter f\xF6r arkiv\xE4ndam\xE5l\
            \ av allm\xE4nt intresse, vetenskapliga eller historiska forsknings\xE4\
            ndam\xE5l eller statistiska \xE4ndam\xE5l b\xF6r omfattas av l\xE4mpliga\
            \ skydds\xE5tg\xE4rder f\xF6r de registrerades r\xE4ttigheter och friheter\
            \ enligt denna f\xF6rordning. Skydds\xE5tg\xE4rderna b\xF6r s\xE4kerst\xE4\
            lla att tekniska och organisatoriska \xE5tg\xE4rder har inf\xF6rts f\xF6\
            r att se till att s\xE4rskilt principen om uppgiftsminimering iakttas.\
            \ Ytterligare behandling av personuppgifter f\xF6r arkiv\xE4ndam\xE5l\
            \ av allm\xE4nintresse, vetenskapliga eller historiska forsknings\xE4\
            ndam\xE5l eller statistiska \xE4ndam\xE5l b\xF6r genomf\xF6ras, n\xE4\
            r den personuppgiftsansvarige har bed\xF6mt m\xF6jligheten att uppn\xE5\
            \ dessa \xE4ndam\xE5l genom behandling av personuppgifter som inte medger\
            \ eller inte l\xE4ngre medger identifiering av de registrerade, f\xF6\
            rutsatt att det finns l\xE4mpliga skydds\xE5tg\xE4rder (t. ex. pseudonymisering\
            \ av personuppgifter). Medlemsstaterna b\xF6r inf\xF6ra l\xE4mpliga skydds\xE5\
            tg\xE4rder f\xF6r behandlingen av personuppgifter f\xF6r arkiv\xE4ndam\xE5\
            l av allm\xE4nt intresse, vetenskapliga eller historiska forsknings\xE4\
            ndam\xE5l eller statistiska \xE4ndam\xE5l. Medlemsstaterna b\xF6r p\xE5\
            \ s\xE4rskilda villkor med f\xF6rbeh\xE5ll f\xF6r l\xE4mpliga skydds\xE5\
            tg\xE4rder f\xF6r de registrerade ha r\xE4tt att specificera och g\xF6\
            ra undantag fr\xE5n kraven p\xE5 information, r\xE4tten till r\xE4ttelse\
            \ eller radering av personuppgifter, r\xE4tten att bli bortgl\xF6md, r\xE4\
            tten till begr\xE4nsning av behandlingen, r\xE4tten till dataportabilitet\
            \ och r\xE4tten att g\xF6ra inv\xE4ndning i samband med behandling av\
            \ personuppgifter f\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga\
            \ eller historiska forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5\
            l. Villkoren och s\xE4kerhets\xE5tg\xE4rderna i fr\xE5ga kan medf\xF6\
            ra att de registrerade m\xE5ste f\xF6lja s\xE4rskilda f\xF6rfaranden f\xF6\
            r att ut\xF6va dessa r\xE4ttigheter, om det \xE4r l\xE4mpligt med h\xE4\
            nsyn till den s\xE4rskilda behandlingens syfte tillsammans med tekniska\
            \ och organisatoriska \xE5tg\xE4rder som syftar till att minimera behandlingen\
            \ av personuppgifter i\_enlighet med principerna om proportionalitet och\
            \ n\xF6dv\xE4ndighet. Behandling av personuppgifter f\xF6r vetenskapliga\
            \ \xE4ndam\xE5l b\xF6r \xE4ven vara f\xF6renlig med annan relevant lagstiftning,\
            \ exempelvis om kliniska pr\xF6vningar."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-157
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 157
      description: By coupling information from registries, researchers can obtain
        new knowledge of great value with regard to widespread medical conditions
        such as cardiovascular disease, cancer and depression. On the basis of registries,
        research results can be enhanced, as they draw on a larger population. Within
        social science, research on the basis of registries enables researchers to
        obtain essential knowledge about the long-term correlation of a number of
        social conditions such as unemployment and education with other life conditions.
        Research results obtained through registries provide solid, high-quality knowledge
        which can provide the basis for the formulation and implementation of knowledge-based
        policy, improve the quality of life for a number of people and improve the
        efficiency of social services. In order to facilitate scientific research,
        personal data can be processed for scientific research purposes, subject to
        appropriate conditions and safeguards set out in Union or Member State law.
      translations:
        sv:
          name: "Sk\xE4l 157"
          description: "Genom att koppla samman information fr\xE5n olika register\
            \ kan forskare erh\xE5lla ny kunskap av stort v\xE4rde med avseende p\xE5\
            \ medicinska tillst\xE5nd som exempelvis hj\xE4rt-k\xE4rlsjukdomar, cancer\
            \ och depression. P\xE5 grundval av registren kan forskningsresultaten\
            \ f\xF6rb\xE4ttras, eftersom de bygger p\xE5 en st\xF6rre befolkningsgrupp.\
            \ Forskning inom samh\xE4llsvetenskap som bedrivs p\xE5 grundval av register\
            \ g\xF6r det m\xF6jligt f\xF6r forskare att f\xE5 grundl\xE4ggande kunskaper\
            \ om sambandet p\xE5 l\xE5ng sikt mellan ett antal sociala villkor, exempelvis\
            \ arbetsl\xF6shet och utbildning, och andra livsf\xF6rh\xE5llanden. Forskningsresultat\
            \ som erh\xE5llits p\xE5 grundval av register utg\xF6r en stabil, h\xF6\
            gkvalitativ kunskap, som kan ligga till grund f\xF6r utformningen och\
            \ genomf\xF6randet av kunskapsbaserad politik, f\xF6rb\xE4ttra livskvaliteten\
            \ f\xF6r ett antal personer och f\xF6rb\xE4ttra de sociala tj\xE4nsternas\
            \ effektivitet. F\xF6r att underl\xE4tta vetenskaplig forskning f\xE5\
            r personuppgifter behandlas f\xF6r vetenskapliga forsknings\xE4ndam\xE5\
            l, med f\xF6rbeh\xE5ll f\xF6r l\xE4mpliga villkor och skydds\xE5tg\xE4\
            rder i unionsr\xE4tten eller i medlemsstaternas nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-158
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 158
      description: Where personal data are processed for archiving purposes, this
        Regulation should also apply to that processing, bearing in mind that this
        Regulation should not apply to deceased persons. Public authorities or public
        or private bodies that hold records of public interest should be services
        which, pursuant to Union or Member State law, have a legal obligation to acquire,
        preserve, appraise, arrange, describe, communicate, promote, disseminate and
        provide access to records of enduring value for general public interest. Member
        States should also be authorised to provide for the further processing of
        personal data for archiving purposes, for example with a view to providing
        specific information related to the political behaviour under former totalitarian
        state regimes, genocide, crimes against humanity, in particular the Holocaust,
        or war crimes.
      translations:
        sv:
          name: "Sk\xE4l 158"
          description: "Om personuppgifter behandlas f\xF6r arkiv\xE4ndam\xE5l, b\xF6\
            r denna f\xF6rordning ocks\xE5 g\xE4lla denna behandling, med beaktande\
            \ av att denna f\xF6rordning inte b\xF6r g\xE4lla f\xF6r avlidna personer.\
            \ Offentliga myndigheter eller offentliga eller privata organ som innehar\
            \ uppgifter av allm\xE4nt intresse b\xF6r vara tillhandah\xE5llare som,\
            \ i enlighet med unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt, har en r\xE4ttslig skyldighet att f\xF6rv\xE4rva, bevara, bed\xF6\
            ma, organisera, beskriva, kommunicera, fr\xE4mja, sprida och ge tillg\xE5\
            ng till uppgifter av best\xE5ende v\xE4rde f\xF6r allm\xE4nintresset.\
            \ Medlemsstaterna b\xF6r ocks\xE5 ha r\xE4tt att f\xF6reskriva att personuppgifter\
            \ f\xE5r vidarebehandlas f\xF6r arkivering, exempelvis i syfte att tillhandah\xE5\
            lla specifik information om politiskt beteende under tidigare totalit\xE4\
            ra regimer, folkmord, brott mot m\xE4nskligheten, s\xE4rskilt F\xF6rintelsen,\
            \ eller krigsf\xF6rbrytelser."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-159
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 159
      description: Where personal data are processed for scientific research purposes,
        this Regulation should also apply to that processing. For the purposes of
        this Regulation, the processing of personal data for scientific research purposes
        should be interpreted in a broad manner including for example technological
        development and demonstration, fundamental research, applied research and
        privately funded research. In addition, it should take into account the Union's
        objective under Article 179(1) TFEU of achieving a European Research Area.
        Scientific research purposes should also include studies conducted in the
        public interest in the area of public health. To meet the specificities of
        processing personal data for scientific research purposes, specific conditions
        should apply in particular as regards the publication or otherwise disclosure
        of personal data in the context of scientific research purposes. If the result
        of scientific research in particular in the health context gives reason for
        further measures in the interest of the data subject, the general rules of
        this Regulation should apply in view of those measures.
      translations:
        sv:
          name: "Sk\xE4l 159"
          description: "Om personuppgifter behandlas f\xF6r vetenskapliga forsknings\xE4\
            ndam\xE5l, b\xF6r denna f\xF6rordning ocks\xE5 g\xE4lla denna behandling.\
            \ Behandling av personuppgifter f\xF6r vetenskapliga forsknings\xE4ndam\xE5\
            l b\xF6r i denna f\xF6rordning ges en vid tolkning och omfatta till exempel\
            \ teknisk utveckling och demonstration, grundforskning, till\xE4mpad forskning\
            \ och privatfinansierad forskning. Behandlingen av personuppgifter b\xF6\
            r dessutom ta h\xE4nsyn till unionens m\xE5l enligt artikel\_179.1 i\_\
            EUF-f\xF6rdraget ang\xE5ende \xE5stadkommandet av ett europeiskt forskningsomr\xE5\
            de. Vetenskapliga forsknings\xE4ndam\xE5l b\xF6r ocks\xE5 omfatta studier\
            \ som utf\xF6rs av ett allm\xE4nt intresse inom folkh\xE4lsoomr\xE5det.\
            \ F\xF6r att tillgodose de s\xE4rskilda kraven i samband med behandling\
            \ av personuppgifter f\xF6r vetenskapliga forsknings\xE4ndam\xE5l b\xF6\
            r s\xE4rskilda villkor g\xE4lla, s\xE4rskilt vad avser offentligg\xF6\
            rande eller annat utl\xE4mnande av personuppgifter inom ramen f\xF6r vetenskapliga\
            \ forsknings\xE4ndam\xE5l. Om resultatet av vetenskaplig forskning, s\xE4\
            rskilt f\xF6r h\xE4lso- och sjukv\xE5rds\xE4ndam\xE5l, ger anledning till\
            \ ytterligare \xE5tg\xE4rder i den registrerades intresse, b\xF6r de allm\xE4\
            nna reglerna i denna f\xF6rordning till\xE4mpas p\xE5 dessa \xE5tg\xE4\
            rder."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-160
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 160
      description: Where personal data are processed for historical research purposes,
        this Regulation should also apply to that processing. This should also include
        historical research and research for genealogical purposes, bearing in mind
        that this Regulation should not apply to deceased persons.
      translations:
        sv:
          name: "Sk\xE4l 160"
          description: "Om personuppgifter behandlas f\xF6r historiska forsknings\xE4\
            ndam\xE5l, b\xF6r denna f\xF6rordning ocks\xE5 g\xE4lla denna behandling.\
            \ Detta b\xF6r \xE4ven omfatta forskning f\xF6r historiska och genealogiska\
            \ \xE4ndam\xE5l, med beaktande av att denna f\xF6rordning inte b\xF6r\
            \ g\xE4lla f\xF6r avlidna personer."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-161
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 161
      description: For the purpose of consenting to the participation in scientific
        research activities in clinical trials, the relevant provisions of Regulation
        (EU) No 536/2014 of the European Parliament and of the Council (1) should
        apply.
      translations:
        sv:
          name: "Sk\xE4l 161"
          description: "N\xE4r det g\xE4ller samtycke till deltagande i vetenskaplig\
            \ forskning inom ramen f\xF6r kliniska pr\xF6vningar, b\xF6r de relevanta\
            \ best\xE4mmelserna i Europaparlamentets och r\xE5dets f\xF6rordning\_\
            (EU) nr\_536/2014\_(15)\_till\xE4mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-162
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 162
      description: Where personal data are processed for statistical purposes, this
        Regulation should apply to that processing. Union or Member State law should,
        within the limits of this Regulation, determine statistical content, control
        of access, specifications for the processing of personal data for statistical
        purposes and appropriate measures to safeguard the rights and freedoms of
        the data subject and for ensuring statistical confidentiality. Statistical
        purposes mean any operation of collection and the processing of personal data
        necessary for statistical surveys or for the production of statistical results.
        Those statistical results may further be used for different purposes, including
        a scientific research purpose. The statistical purpose implies that the result
        of processing for statistical purposes is not personal data, but aggregate
        data, and that this result or the personal data are not used in support of
        measures or decisions regarding any particular natural person.
      translations:
        sv:
          name: "Sk\xE4l 162"
          description: "Om personuppgifter behandlas f\xF6r statistiska \xE4ndam\xE5\
            l, b\xF6r denna f\xF6rordning g\xE4lla denna behandling. Unionsr\xE4tten\
            \ eller medlemsstaternas nationella r\xE4tt b\xF6r, inom ramen f\xF6r\
            \ denna f\xF6rordning, fastst\xE4lla statistiskt inneh\xE5ll, kontroll\
            \ av tillg\xE5ng, specifikationer f\xF6r behandling av personuppgifter\
            \ f\xF6r statistiska \xE4ndam\xE5l och l\xE4mpliga \xE5tg\xE4rder till\
            \ skydd f\xF6r den registrerades r\xE4ttigheter och friheter och f\xF6\
            r att s\xE4kerst\xE4lla insynsskydd f\xF6r statistiska uppgifter. Med\
            \ statistiska \xE4ndam\xE5l avses varje \xE5tg\xE4rd som vidtas f\xF6\
            r den insamling och behandling av personuppgifter som \xE4r n\xF6dv\xE4\
            ndig f\xF6r statistiska unders\xF6kningar eller f\xF6r framst\xE4llning\
            \ av statistiska resultat. Dessa statistiska resultat kan vidare anv\xE4\
            ndas f\xF6r olika \xE4ndam\xE5l, inbegripet vetenskapliga forsknings\xE4\
            ndam\xE5l. Ett statistiskt \xE4ndam\xE5l inneb\xE4r att resultatet av\
            \ behandlingen f\xF6r statistiska \xE4ndam\xE5l inte best\xE5r av personuppgifter,\
            \ utan av aggregerade personuppgifter, och att resultatet eller uppgifterna\
            \ inte anv\xE4nds till st\xF6d f\xF6r \xE5tg\xE4rder eller beslut som\
            \ avser en s\xE4rskild fysiskperson."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-163
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 163
      description: The confidential information which the Union and national statistical
        authorities collect for the production of official European and official national
        statistics should be protected. European statistics should be developed, produced
        and disseminated in accordance with the statistical principles as set out
        in Article 338(2) TFEU, while national statistics should also comply with
        Member State law. Regulation (EC) No 223/2009 of the European Parliament and
        of the Council (2) provides further specifications on statistical confidentiality
        for European statistics.
      translations:
        sv:
          name: "Sk\xE4l 163"
          description: "De konfidentiella uppgifter som unionens myndigheter och nationella\
            \ statistikansvariga myndigheter samlar in f\xF6r att framst\xE4lla officiell\
            \ europeisk och officiell nationell statistik b\xF6r skyddas. Europeisk\
            \ statistik b\xF6r utvecklas, framst\xE4llas och spridas i enlighet med\
            \ de statistiska principerna i artikel\_338.2 i EUF-f\xF6rdraget, medan\
            \ hanteringen av nationell statistik \xE4ven b\xF6r \xF6verensst\xE4mma\
            \ med medlemsstaternas nationella r\xE4tt. Europaparlamentets och r\xE5\
            dets f\xF6rordning (EG) nr\_223/2009\_(16)\_inneh\xE5ller ytterligare\
            \ preciseringar om statistisk konfidentialitet f\xF6r europeisk statistik."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-164
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 164
      description: As regards the powers of the supervisory authorities to obtain
        from the controller or processor access to personal data and access to their
        premises, Member States may adopt by law, within the limits of this Regulation,
        specific rules in order to safeguard the professional or other equivalent
        secrecy obligations, in so far as necessary to reconcile the right to the
        protection of personal data with an obligation of professional secrecy. This
        is without prejudice to existing Member State obligations to adopt rules on
        professional secrecy where required by Union law.
      translations:
        sv:
          name: "Sk\xE4l 164"
          description: "Vad betr\xE4ffar tillsynsmyndigheternas befogenheter att fr\xE5\
            n personuppgiftsansvariga eller personuppgiftsbitr\xE4den f\xE5 tillg\xE5\
            ng till personuppgifter och tilltr\xE4de till lokaler, f\xE5r medlemsstaterna,\
            \ inom gr\xE4nserna f\xF6r denna f\xF6rordning, genom lagstiftning anta\
            \ s\xE4rskilda regler f\xF6r att skydda yrkesm\xE4ssig eller annan motsvarande\
            \ tystnadsplikt, i den m\xE5n detta \xE4r n\xF6dv\xE4ndigt f\xF6r att\
            \ j\xE4mka samman r\xE4tten till skydd av personuppgifter med tystnadsplikten.\
            \ Detta p\xE5verkar inte till\xE4mpningen av medlemsstaternas befintliga\
            \ skyldigheter att anta best\xE4mmelser om tystnadsplikt, d\xE4r detta\
            \ kr\xE4vs enligt unionsr\xE4tten."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-165
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 165
      description: This Regulation respects and does not prejudice the status under
        existing constitutional law of churches and religious associations or communities
        in the Member States, as recognised in Article 17 TFEU.
      translations:
        sv:
          name: "Sk\xE4l 165"
          description: "Denna f\xF6rordning \xE4r f\xF6renlig med kravet p\xE5 att\
            \ respektera och inte p\xE5verka den st\xE4llning som kyrkor och religi\xF6\
            sa sammanslutningar eller samfund har i medlemsstaterna enligt g\xE4llande\
            \ grundlag i enlighet med artikel\_17 i EUF-f\xF6rdraget."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-166
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 166
      description: In order to fulfil the objectives of this Regulation, namely to
        protect the fundamental rights and freedoms of natural persons and in particular
        their right to the protection of personal data and to ensure the free movement
        of personal data within the Union, the power to adopt acts in accordance with
        Article 290 TFEU should be delegated to the Commission. In particular, delegated
        acts should be adopted in respect of criteria and requirements for certification
        mechanisms, information to be presented by standardised icons and procedures
        for providing such icons. It is of particular importance that the Commission
        carry out appropriate consultations during its preparatory work, including
        at expert level. The Commission, when preparing and drawing-up delegated acts,
        should ensure a simultaneous, timely and appropriate transmission of relevant
        documents to the European Parliament and to the Council.
      translations:
        sv:
          name: "Sk\xE4l 166"
          description: "I syfte att uppn\xE5 m\xE5len f\xF6r denna f\xF6rordning,\
            \ n\xE4mligen att skydda fysiska personers grundl\xE4ggande r\xE4ttigheter\
            \ och friheter och i synnerhet deras r\xE4tt till skydd av personuppgifter\
            \ och f\xF6r att s\xE4kra det fria fl\xF6det av personuppgifter inom unionen,\
            \ b\xF6r befogenheten att anta akter i enlighet med artikel 290 i EUF-f\xF6\
            rdraget delegeras till kommissionen. Delegerade akter b\xF6r framf\xF6\
            r allt antas n\xE4r det g\xE4ller kriterier och krav vad g\xE4ller certifieringsmekanismer,\
            \ information som ska ges med anv\xE4ndning av standardiserade symboler\
            \ och f\xF6rfaranden f\xF6r att tillhandah\xE5lla s\xE5dana symboler.\
            \ Det \xE4r s\xE4rskilt viktigt att kommissionen genomf\xF6r l\xE4mpliga\
            \ samr\xE5d under sitt f\xF6rberedande arbete, inklusive p\xE5 expertniv\xE5\
            . N\xE4r kommissionen f\xF6rbereder och utarbetar delegerade akter b\xF6\
            r den se till att relevanta handlingar \xF6vers\xE4nds samtidigt till\
            \ Europaparlamentet och r\xE5det och att detta sker s\xE5 snabbt som m\xF6\
            jligt och p\xE5 l\xE4mpligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-167
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 167
      description: In order to ensure uniform conditions for the implementation of
        this Regulation, implementing powers should be conferred on the Commission
        when provided for by this Regulation. Those powers should be exercised in
        accordance with Regulation (EU) No 182/2011. In that context, the Commission
        should consider specific measures for micro, small and medium-sized enterprises.
      translations:
        sv:
          name: "Sk\xE4l 167"
          description: "F\xF6r att s\xE4kerst\xE4lla enhetliga villkor f\xF6r till\xE4\
            mpningen av denna f\xF6rordning b\xF6r kommissionen ges genomf\xF6randebefogenheter\
            \ i enlighet med denna f\xF6rordning. Dessa befogenheter b\xF6r ut\xF6\
            vas i enlighet med f\xF6rordning\_(EU) nr\_182/2011. Kommissionen b\xF6\
            r d\xE4rvid \xF6verv\xE4ga s\xE4rskilda \xE5tg\xE4rder f\xF6r mikrof\xF6\
            retag och sm\xE5 och medelstora f\xF6retag."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-168
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 168
      description: The examination procedure should be used for the adoption of implementing
        acts on standard contractual clauses between controllers and processors and
        between processors; codes of conduct; technical standards and mechanisms for
        certification; the adequate level of protection afforded by a third country,
        a territory or a specified sector within that third country, or an international
        organisation; standard protection clauses; formats and procedures for the
        exchange of information by electronic means between controllers, processors
        and supervisory authorities for binding corporate rules; mutual assistance;
        and arrangements for the exchange of information by electronic means between
        supervisory authorities, and between supervisory authorities and the Board.
      translations:
        sv:
          name: "Sk\xE4l 168"
          description: "Granskningsf\xF6rfarandet b\xF6r anv\xE4ndas vid antagande\
            \ av genomf\xF6randeakter om standardavtalsklausuler mellan personuppgiftsansvariga\
            \ och personuppgiftsbitr\xE4den och mellan personuppgiftsbitr\xE4den,\
            \ uppf\xF6randekoder, tekniska standarder och mekanismer f\xF6r certifiering,\
            \ adekvat niv\xE5 p\xE5 det skydd som l\xE4mnas av ett tredjeland, ett\
            \ territorium eller av en specificerad sektor inom det tredjelandet eller\
            \ en internationell organisation, standardiserade skyddsbest\xE4mmelser,\
            \ format och f\xF6rfaranden f\xF6r elektroniskt utbyte av information\
            \ mellan personuppgiftsansvariga, personuppgiftsbitr\xE4den och tillsynsmyndigheter\
            \ f\xF6r bindande f\xF6retagsbest\xE4mmelser, \xF6msesidigt bist\xE5nd\
            \ och tillv\xE4gag\xE5ngss\xE4tt f\xF6r elektroniskt utbyte av information\
            \ mellan tillsynsmyndigheter samt mellan tillsynsmyndigheter och styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-169
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 169
      description: The Commission should adopt immediately applicable implementing
        acts where available evidence reveals that a third country, a territory or
        a specified sector within that third country, or an international organisation
        does not ensure an adequate level of protection, and imperative grounds of
        urgency so require.
      translations:
        sv:
          name: "Sk\xE4l 169"
          description: "Kommissionen b\xF6r n\xE4r det f\xF6religger tvingande sk\xE4\
            l till skyndsamhet anta omedelbart till\xE4mpliga genomf\xF6randeakter,\
            \ n\xE4r tillg\xE4ngliga bevis visar att ett tredjeland, ett territorium\
            \ eller en specificerad sektor inom det tredjelandet eller en internationell\
            \ organisation inte uppr\xE4tth\xE5ller en adekvat skyddsniv\xE5."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-170
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 170
      description: Since the objective of this Regulation, namely to ensure an equivalent
        level of protection of natural persons and the free flow of personal data
        throughout the Union, cannot be sufficiently achieved by the Member States
        and can rather, by reason of the scale or effects of the action, be better
        achieved at Union level, the Union may adopt measures, in accordance with
        the principle of subsidiarity as set out in Article 5 of the Treaty on European
        Union (TEU). In accordance with the principle of proportionality as set out
        in that Article, this Regulation does not go beyond what is necessary in order
        to achieve that objective.
      translations:
        sv:
          name: "Sk\xE4l 170"
          description: "Eftersom m\xE5let f\xF6r denna f\xF6rordning, n\xE4mligen\
            \ att s\xE4kerst\xE4lla en likv\xE4rdig niv\xE5 f\xF6r skyddet av fysiska\
            \ personer och det fria fl\xF6det av personuppgifter inom hela unionen,\
            \ inte i\_tillr\xE4cklig utstr\xE4ckning kan uppn\xE5s av medlemsstaterna\
            \ utan snarare, p\xE5 grund av \xE5tg\xE4rdens omfattning eller verkningar,\
            \ kan uppn\xE5s b\xE4ttre p\xE5 unionsniv\xE5, kan unionen vidta \xE5\
            tg\xE4rder i enlighet med subsidiaritetsprincipen i artikel 5 i f\xF6\
            rdraget om Europeiska unionen (EU-f\xF6rdraget). I\_enlighet med proportionalitetsprincipen\
            \ i samma artikel g\xE5r denna f\xF6rordning inte ut\xF6ver vad som \xE4\
            r n\xF6dv\xE4ndigt f\xF6r att uppn\xE5 detta m\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-171
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 171
      description: Directive 95/46/EC should be repealed by this Regulation. Processing
        already under way on the date of application of this Regulation should be
        brought into conformity with this Regulation within the period of two years
        after which this Regulation enters into force. Where processing is based on
        consent pursuant to Directive 95/46/EC, it is not necessary for the data subject
        to give his or her consent again if the manner in which the consent has been
        given is in line with the conditions of this Regulation, so as to allow the
        controller to continue such processing after the date of application of this
        Regulation. Commission decisions adopted and authorisations by supervisory
        authorities based on Directive 95/46/EC remain in force until amended, replaced
        or repealed.
      translations:
        sv:
          name: "Sk\xE4l 171"
          description: "Direktiv 95/46/EG b\xF6r upph\xE4vas genom denna f\xF6rordning.\
            \ Behandling som redan p\xE5g\xE5r den dag d\xE5 denna f\xF6rordning b\xF6\
            rjar till\xE4mpas b\xF6r bringas i \xF6verensst\xE4mmelse med denna f\xF6\
            rordning inom en period av tv\xE5 \xE5r fr\xE5n det att denna f\xF6rordning\
            \ tr\xE4der i kraft. Om behandlingen grundar sig p\xE5 samtycke enligt\
            \ direktiv 95/46/EG, \xE4r det inte n\xF6dv\xE4ndigt att den registrerade\
            \ p\xE5 nytt ger sitt samtycke f\xF6r att den personuppgiftsansvarige\
            \ ska kunna forts\xE4tta med behandlingen i fr\xE5ga efter det att denna\
            \ f\xF6rordning b\xF6rjar till\xE4mpas, om det s\xE4tt p\xE5 vilket samtycket\
            \ gavs \xF6verensst\xE4mmer med villkoren i denna f\xF6rordning. Beslut\
            \ av kommissionen som antagits och tillst\xE5nd fr\xE5n tillsynsmyndigheterna\
            \ som utf\xE4rdats p\xE5 grundval av direktiv\_95/46/EG ska fortsatt vara\
            \ giltiga tills de \xE4ndras, ers\xE4tts eller upph\xE4vs."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-172
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 172
      description: The European Data Protection Supervisor was consulted in accordance
        with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion
        on 7 March 2012 (1).
      translations:
        sv:
          name: "Sk\xE4l 172"
          description: "Europeiska datatillsynsmannen har h\xF6rts i enlighet med\
            \ artikel 28.2 i f\xF6rordning (EG) nr 45/2001 och avgav ett yttrande\
            \ den 7 mars 2012 (17)."
    - urn: urn:intuitem:risk:req_node:gdpr:recital-173
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:preambule
      ref_id: Recital 173
      description: "This Regulation should apply to all matters concerning the protection\
        \ of fundamental rights and freedoms vis-\xE0- vis the processing of personal\
        \ data which are not subject to specific obligations with the same objective\
        \ set out in Directive 2002/58/EC of the European Parliament and of the Council\
        \ (2), including the obligations on the controller and the rights of natural\
        \ persons. In order to clarify the relationship between this Regulation and\
        \ Directive 2002/58/EC, that Directive should be amended accordingly. Once\
        \ this Regulation is adopted, Directive 2002/58/EC should be reviewed in particular\
        \ in order to ensure consistency with this Regulation,"
      translations:
        sv:
          name: "Sk\xE4l 173"
          description: "Denna f\xF6rordning b\xF6r vara till\xE4mplig p\xE5 alla fr\xE5\
            gor som g\xE4ller skyddet av grundl\xE4ggande r\xE4ttigheter och friheter\
            \ i f\xF6rh\xE5llande till behandlingen av personuppgifter, vilka inte\
            \ omfattas av s\xE4rskilda skyldigheter med samma m\xE5l som anges i Europaparlamentets\
            \ och r\xE5dets direktiv\_2002/58/EG\_(18), d\xE4ribland den personuppgiftsansvariges\
            \ skyldigheter och fysiska personers r\xE4ttigheter. F\xF6r att klarg\xF6\
            ra f\xF6rh\xE5llandet mellan denna f\xF6rordning och direktiv 2002/58/EG\
            \ b\xF6r det direktivet \xE4ndras. N\xE4r denna f\xF6rordning har antagits,\
            \ b\xF6r direktiv 2002/58/EG ses \xF6ver, framf\xF6r allt f\xF6r att s\xE4\
            kerst\xE4lla konsekvens med denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-i
      assessable: false
      depth: 1
      ref_id: CHAPTER I
      description: General provisions
      translations:
        sv:
          name: KAPITEL I
          description: "Allm\xE4nna best\xE4mmelser"
    - urn: urn:intuitem:risk:req_node:gdpr:article-1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-i
      ref_id: Article 1
      description: Subject-matter and objectives
      translations:
        sv:
          name: Artikel 1
          description: Syfte
    - urn: urn:intuitem:risk:req_node:gdpr:1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-1
      ref_id: '1.1'
      description: This Regulation lays down rules relating to the protection of natural
        persons with regard to the processing of personal data and rules relating
        to the free movement of personal data.
      translations:
        sv:
          description: "I denna f\xF6rordning fastst\xE4lls best\xE4mmelser om skydd\
            \ f\xF6r fysiska personer med avseende p\xE5 behandlingen av personuppgifter\
            \ och om det fria fl\xF6det av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-1
      ref_id: '1.2'
      description: This Regulation protects fundamental rights and freedoms of natural
        persons and in particular their right to the protection of personal data.
      translations:
        sv:
          description: "Denna f\xF6rordning skyddar fysiska personers grundl\xE4ggande\
            \ r\xE4ttigheter och friheter, s\xE4rskilt deras r\xE4tt till skydd av\
            \ personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-1
      ref_id: '1.3'
      description: The free movement of personal data within the Union shall be neither
        restricted nor prohibited for reasons connected with the protection of natural
        persons with regard to the processing of personal data.
      translations:
        sv:
          description: "Det fria fl\xF6det av personuppgifter inom unionen f\xE5r\
            \ varken begr\xE4nsas eller f\xF6rbjudas av sk\xE4l som r\xF6r skyddet\
            \ f\xF6r fysiska personer med avseende p\xE5 behandlingen av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:article-2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-i
      ref_id: Article 2
      description: Material scope
      translations:
        sv:
          name: Artikel 2
          description: "Materiellt till\xE4mpningsomr\xE5de"
    - urn: urn:intuitem:risk:req_node:gdpr:2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-2
      ref_id: '2.1'
      description: This Regulation applies to the processing of personal data wholly
        or partly by automated means and to the processing other than by automated
        means of personal data which form part of a filing system or are intended
        to form part of a filing system.
      translations:
        sv:
          description: "Denna f\xF6rordning ska till\xE4mpas p\xE5 s\xE5dan behandling\
            \ av personuppgifter som helt eller delvis f\xF6retas p\xE5 automatisk\
            \ v\xE4g samt p\xE5 annan behandling \xE4n automatisk av personuppgifter\
            \ som ing\xE5r i eller kommer att ing\xE5 i ett register."
    - urn: urn:intuitem:risk:req_node:gdpr:2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-2
      ref_id: '2.2'
      description: 'This Regulation does not apply to the processing of personal data:'
      translations:
        sv:
          description: "Denna f\xF6rordning ska inte till\xE4mpas p\xE5 behandling\
            \ av personuppgifter som"
    - urn: urn:intuitem:risk:req_node:gdpr:2.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:2.2
      ref_id: 2.2.a
      description: in the course of an activity which falls outside the scope of Union
        law;
      translations:
        sv:
          description: "utg\xF6r ett led i en verksamhet som inte omfattas av unionsr\xE4\
            tten,"
    - urn: urn:intuitem:risk:req_node:gdpr:2.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:2.2
      ref_id: 2.2.b
      description: by the Member States when carrying out activities which fall within
        the scope of Chapter 2 of Title V of the TEU;
      translations:
        sv:
          description: "medlemsstaterna utf\xF6r n\xE4r de bedriver verksamhet som\
            \ omfattas av avdelning\_V kapitel 2 i EU-f\xF6rdraget,"
    - urn: urn:intuitem:risk:req_node:gdpr:2.2.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:2.2
      ref_id: 2.2.c
      description: by a natural person in the course of a purely personal or household
        activity;
      translations:
        sv:
          description: "en fysisk person utf\xF6r som ett led i verksamhet av rent\
            \ privat natur eller som har samband med hans eller hennes hush\xE5ll,"
    - urn: urn:intuitem:risk:req_node:gdpr:2.2.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:2.2
      ref_id: 2.2.d
      description: by competent authorities for the purposes of the prevention, investigation,
        detection or prosecution of criminal offences or the execution of criminal
        penalties, including the safeguarding against and the prevention of threats
        to public security.
      translations:
        sv:
          description: "beh\xF6riga myndigheter utf\xF6r i syfte att f\xF6rebygga,\
            \ f\xF6rhindra, utreda, avsl\xF6ja eller lagf\xF6ra brott eller verkst\xE4\
            lla straffr\xE4ttsliga p\xE5f\xF6ljder, i vilket \xE4ven ing\xE5r att\
            \ skydda mot samt f\xF6rebygga och f\xF6rhindra hot mot den allm\xE4nna\
            \ s\xE4kerheten."
    - urn: urn:intuitem:risk:req_node:gdpr:2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-2
      ref_id: '2.3'
      description: For the processing of personal data by the Union institutions,
        bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation
        (EC) No 45/2001 and other Union legal acts applicable to such processing of
        personal data shall be adapted to the principles and rules of this Regulation
        in accordance with Article 98.
      translations:
        sv:
          description: "F\xF6rordning (EG) nr\_45/2001 \xE4r till\xE4mplig p\xE5 den\
            \ behandling av personuppgifter som sker i\_EU:s institutioner, organ\
            \ och byr\xE5er. F\xF6rordning (EG) nr\_45/2001 och de av unionens \xF6\
            vriga r\xE4ttsakter som \xE4r till\xE4mpliga p\xE5 s\xE5dan behandling\
            \ av personuppgifter ska anpassas till principerna och best\xE4mmelserna\
            \ i denna f\xF6rordning i enlighet med artikel 98."
    - urn: urn:intuitem:risk:req_node:gdpr:2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-2
      ref_id: '2.4'
      description: This Regulation shall be without prejudice to the application of
        Directive 2000/31/EC, in particular of the liability rules of intermediary
        service providers in Articles 12 to 15 of that Directive.
      translations:
        sv:
          description: "Denna f\xF6rordning p\xE5verkar inte till\xE4mpningen av direktiv\
            \ 2000/31/EG, s\xE4rskilt best\xE4mmelserna om tj\xE4nstelevererande mellanh\xE4\
            nders ansvar i artiklarna 12\u201315 i det direktivet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-i
      ref_id: Article 3
      description: Territorial scope
      translations:
        sv:
          name: Artikel 3
          description: "Territoriellt till\xE4mpningsomr\xE5de"
    - urn: urn:intuitem:risk:req_node:gdpr:3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-3
      ref_id: '3.1'
      description: This Regulation applies to the processing of personal data in the
        context of the activities of an establishment of a controller or a processor
        in the Union, regardless of whether the processing takes place in the Union
        or not.
      translations:
        sv:
          description: "Denna f\xF6rordning ska till\xE4mpas p\xE5 behandlingen av\
            \ personuppgifter inom ramen f\xF6r den verksamhet som bedrivs av en personuppgiftsansvarig\
            \ eller ett personuppgiftsbitr\xE4de som \xE4r etablerad i unionen, oavsett\
            \ om behandlingen utf\xF6rs i unionen eller inte."
    - urn: urn:intuitem:risk:req_node:gdpr:3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-3
      ref_id: '3.2'
      description: 'This Regulation applies to the processing of personal data of
        data subjects who are in the Union by a controller or processor not established
        in the Union, where the processing activities are related to:'
      translations:
        sv:
          description: "Denna f\xF6rordning ska till\xE4mpas p\xE5 behandling av personuppgifter\
            \ som avser registrerade som befinner sig i unionen och som utf\xF6rs\
            \ av en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de som\
            \ inte \xE4r etablerad i\_unionen, om behandlingen har anknytning till"
    - urn: urn:intuitem:risk:req_node:gdpr:3.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:3.2
      ref_id: 3.2.a
      description: the offering of goods or services, irrespective of whether a payment
        of the data subject is required, to such data subjects in the Union; or
      translations:
        sv:
          description: "utbjudande av varor eller tj\xE4nster till s\xE5dana registrerade\
            \ i unionen, oavsett om dessa varor eller tj\xE4nster erbjuds kostnadsfritt\
            \ eller inte, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:3.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:3.2
      ref_id: 3.2.b
      description: the monitoring of their behaviour as far as their behaviour takes
        place within the Union.
      translations:
        sv:
          description: "\xF6vervakning av deras beteende s\xE5 l\xE4nge beteendet\
            \ sker inom unionen."
    - urn: urn:intuitem:risk:req_node:gdpr:3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-3
      ref_id: '3.3'
      description: This Regulation applies to the processing of personal data by a
        controller not established in the Union, but in a place where Member State
        law applies by virtue of public international law.
      translations:
        sv:
          description: "Denna f\xF6rordning ska till\xE4mpas p\xE5 behandling av personuppgifter\
            \ som utf\xF6rs av en personuppgiftsansvarig som inte \xE4r etablerad\
            \ i unionen, men p\xE5 en plats d\xE4r en medlemsstats nationella r\xE4\
            tt g\xE4ller enligt folkr\xE4tten."
    - urn: urn:intuitem:risk:req_node:gdpr:article-4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-i
      ref_id: Article 4
      description: Definitions
      translations:
        sv:
          name: Artikel 4
          description: Definitioner
    - urn: urn:intuitem:risk:req_node:gdpr:node202
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-4
      description: 'For the purposes of this Regulation:'
      translations:
        sv:
          description: "I denna f\xF6rordning avses med"
    - urn: urn:intuitem:risk:req_node:gdpr:4.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.1'
      description: "\u2018personal data\u2019 means any information relating to an\
        \ identified or identifiable natural person (\u2018data subject\u2019); an\
        \ identifiable natural person is one who can be identified, directly or indirectly,\
        \ in particular by reference to an identifier such as a name, an identification\
        \ number, location data, an online identifier or to one or more factors specific\
        \ to the physical, physiological, genetic, mental, economic, cultural or social\
        \ identity of that natural person;"
      translations:
        sv:
          description: "personuppgifter: varje upplysning som avser en identifierad\
            \ eller identifierbar fysisk person (nedan kallad\_en registrerad), varvid\
            \ en identifierbarfysisk person \xE4r en person som direkt eller indirekt\
            \ kan identifieras s\xE4rskilt med h\xE4nvisning till en identifierare\
            \ som ett namn, ett identifikationsnummer, en lokaliseringsuppgift eller\
            \ onlineidentifikatorer eller en eller flera faktorer som \xE4r specifika\
            \ f\xF6r den fysiska personens fysiska, fysiologiska, genetiska, psykiska,\
            \ ekonomiska, kulturella eller sociala identitet,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.2'
      description: "\u2018processing\u2019 means any operation or set of operations\
        \ which is performed on personal data or on sets of personal data, whether\
        \ or not by automated means, such as collection, recording, organisation,\
        \ structuring, storage, adaptation or alteration, retrieval, consultation,\
        \ use, disclosure by transmission, dissemination or otherwise making available,\
        \ alignment or combination, restriction, erasure or destruction;"
      translations:
        sv:
          description: "behandling: en \xE5tg\xE4rd eller kombination av \xE5tg\xE4\
            rder betr\xE4ffande personuppgifter eller upps\xE4ttningar av personuppgifter,\
            \ oberoende av om de utf\xF6rs automatiserat eller ej, s\xE5som insamling,\
            \ registrering, organisering, strukturering, lagring, bearbetning eller\
            \ \xE4ndring, framtagning, l\xE4sning, anv\xE4ndning, utl\xE4mning genom\
            \ \xF6verf\xF6ring, spridning eller tillhandah\xE5llande p\xE5 annat s\xE4\
            tt, justering eller sammanf\xF6rande, begr\xE4nsning, radering eller f\xF6\
            rst\xF6ring,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.3'
      description: "\u2018restriction of processing\u2019 means the marking of stored\
        \ personal data with the aim of limiting their processing in the future;"
      translations:
        sv:
          description: "begr\xE4nsning av behandling: markering av lagrade personuppgifter\
            \ med syftet att begr\xE4nsa behandlingen av dessa i framtiden,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.4'
      description: "\u2018profiling\u2019 means any form of automated processing of\
        \ personal data consisting of the use of personal data to evaluate certain\
        \ personal aspects relating to a natural person, in particular to analyse\
        \ or predict aspects concerning that natural person's performance at work,\
        \ economic situation, health, personal preferences, interests, reliability,\
        \ behaviour, location or movements;"
      translations:
        sv:
          description: "profilering: varje form av automatisk behandling av personuppgifter\
            \ som best\xE5r i att dessa personuppgifter anv\xE4nds f\xF6r att bed\xF6\
            ma vissa personliga egenskaper hos en fysisk person, i\_synnerhet f\xF6\
            r att analysera eller f\xF6ruts\xE4ga denna fysiska persons arbetsprestationer,\
            \ ekonomiska situation, h\xE4lsa, personliga preferenser, intressen, p\xE5\
            litlighet, beteende, vistelseort eller f\xF6rflyttningar,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.5'
      description: "\u2018pseudonymisation\u2019 means the processing of personal\
        \ data in such a manner that the personal data can no longer be attributed\
        \ to a specific data subject without the use of additional information, provided\
        \ that such additional information is kept separately and is subject to technical\
        \ and organisational measures to ensure that the personal data are not attributed\
        \ to an identified or identifiable natural person;"
      translations:
        sv:
          description: "pseudonymisering: behandling av personuppgifter p\xE5 ett\
            \ s\xE4tt som inneb\xE4r att personuppgifterna inte l\xE4ngre kan tillskrivas\
            \ en specifik registrerad utan att kompletterande uppgifter anv\xE4nds,\
            \ under f\xF6ruts\xE4ttning att dessa kompletterande uppgifter f\xF6rvaras\
            \ separat och \xE4r f\xF6rem\xE5l f\xF6r tekniska och organisatoriska\
            \ \xE5tg\xE4rder som s\xE4kerst\xE4ller att personuppgifterna inte tillskrivs\
            \ en identifierad eller identifierbar fysisk person,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.6'
      description: "\u2018filing system\u2019 means any structured set of personal\
        \ data which are accessible according to specific criteria, whether centralised,\
        \ decentralised or dispersed on a functional or geographical basis;"
      translations:
        sv:
          description: "register: en strukturerad samling av personuppgifter som \xE4\
            r tillg\xE4nglig enligt s\xE4rskilda kriterier, oavsett om samlingen \xE4\
            r centraliserad, decentraliserad eller spridd p\xE5 grundval av funktionella\
            \ eller geografiska f\xF6rh\xE5llanden,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.7'
      description: "\u2018controller\u2019 means the natural or legal person, public\
        \ authority, agency or other body which, alone or jointly with others, determines\
        \ the purposes and means of the processing of personal data; where the purposes\
        \ and means of such processing are determined by Union or Member State law,\
        \ the controller or the specific criteria for its nomination may be provided\
        \ for by Union or Member State law;"
      translations:
        sv:
          description: "personuppgiftsansvarig: en fysisk eller juridisk person, offentlig\
            \ myndighet, institution eller annat organ som ensamt eller tillsammans\
            \ med andra best\xE4mmer \xE4ndam\xE5len och medlen f\xF6r behandlingen\
            \ av personuppgifter; om \xE4ndam\xE5len och medlen f\xF6r behandlingen\
            \ best\xE4ms av unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt kan den personuppgiftsansvarige eller de s\xE4rskilda kriterierna f\xF6\
            r hur denne ska utses f\xF6reskrivas i\_unionsr\xE4tten eller i medlemsstaternas\
            \ nationella r\xE4tt,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.8'
      description: "\u2018processor\u2019 means a natural or legal person, public\
        \ authority, agency or other body which processes personal data on behalf\
        \ of the controller;"
      translations:
        sv:
          description: "personuppgiftsbitr\xE4de: en fysisk eller juridisk person,\
            \ offentlig myndighet, institution eller annat organ som behandlar personuppgifter\
            \ f\xF6r den personuppgiftsansvariges r\xE4kning,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.9'
      description: "\u2018recipient\u2019 means a natural or legal person, public\
        \ authority, agency or another body, to which the personal data are disclosed,\
        \ whether a third party or not. However, public authorities which may receive\
        \ personal data in the framework of a particular inquiry in accordance with\
        \ Union or Member State law shall not be regarded as recipients; the processing\
        \ of those data by those public authorities shall be in compliance with the\
        \ applicable data protection rules according to the purposes of the processing;"
      translations:
        sv:
          description: "mottagare: en fysisk eller juridisk person, offentlig myndighet,\
            \ institution eller annat organ till vilket personuppgifterna utl\xE4\
            mnas, vare sig det \xE4r en tredje part eller inte; offentliga myndigheter\
            \ som kan komma att motta personuppgifter inom ramen f\xF6r ett s\xE4\
            rskilt uppdrag i enlighet med unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt ska dock inte betraktas som mottagare; offentliga myndigheters\
            \ behandling av dessa uppgifter ska vara f\xF6renlig med till\xE4mpliga\
            \ best\xE4mmelser f\xF6r dataskydd beroende p\xE5 behandlingens syfte,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.10
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.10'
      description: "\u2018third party\u2019 means a natural or legal person, public\
        \ authority, agency or body other than the data subject, controller, processor\
        \ and persons who, under the direct authority of the controller or processor,\
        \ are authorised to process personal data;"
      translations:
        sv:
          description: "tredje part: en fysisk eller juridisk person, offentlig myndighet,\
            \ institution eller organ som inte \xE4r den registrerade, den personuppgiftsansvarige,\
            \ personuppgiftsbitr\xE4det eller de personer som under den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets direkta ansvar \xE4r beh\xF6riga att\
            \ behandla personuppgifterna,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.11
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.11'
      description: "\u2018consent\u2019 of the data subject means any freely given,\
        \ specific, informed and unambiguous indication of the data subject's wishes\
        \ by which he or she, by a statement or by a clear affirmative action, signifies\
        \ agreement to the processing of personal data relating to him or her;"
      translations:
        sv:
          description: "samtycke\_av den registrerade: varje slag av frivillig, specifik,\
            \ informerad och otvetydig viljeyttring, genom vilken den registrerade,\
            \ antingen genom ett uttalande eller genom en entydig bekr\xE4ftande handling,\
            \ godtar behandling av personuppgifter som r\xF6r honom eller henne,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.12
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.12'
      description: "\u2018personal data breach\u2019 means a breach of security leading\
        \ to the accidental or unlawful destruction, loss, alteration, unauthorised\
        \ disclosure of, or access to, personal data transmitted, stored or otherwise\
        \ processed;"
      translations:
        sv:
          description: "personuppgiftsincident: en s\xE4kerhetsincident som leder\
            \ till oavsiktlig eller olaglig f\xF6rst\xF6ring, f\xF6rlust eller \xE4\
            ndring eller till obeh\xF6rigt r\xF6jande av eller obeh\xF6rig \xE5tkomst\
            \ till de personuppgifter som \xF6verf\xF6rts, lagrats eller p\xE5 annat\
            \ s\xE4tt behandlats,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.13
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.13'
      description: "\u2018genetic data\u2019 means personal data relating to the inherited\
        \ or acquired genetic characteristics of a natural person which give unique\
        \ information about the physiology or the health of that natural person and\
        \ which result, in particular, from an analysis of a biological sample from\
        \ the natural person in question;"
      translations:
        sv:
          description: "genetiska uppgifter: alla personuppgifter som r\xF6r ned\xE4\
            rvda eller f\xF6rv\xE4rvade genetiska k\xE4nnetecken f\xF6r en fysisk\
            \ person, vilka ger unik information om denna fysiska persons fysiologi\
            \ eller h\xE4lsa och vilka framf\xF6r allt h\xE4rr\xF6r fr\xE5n en analys\
            \ av ett biologiskt prov fr\xE5n den fysiska personen i fr\xE5ga,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.14
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.14'
      description: "\u2018biometric data\u2019 means personal data resulting from\
        \ specific technical processing relating to the physical, physiological or\
        \ behavioural characteristics of a natural person, which allow or confirm\
        \ the unique identification of that natural person, such as facial images\
        \ or dactyloscopic data;"
      translations:
        sv:
          description: "biometriska uppgifter: personuppgifter som erh\xE5llits genom\
            \ en s\xE4rskild teknisk behandling som r\xF6r en fysisk persons fysiska,\
            \ fysiologiska eller beteendem\xE4ssiga k\xE4nnetecken och som m\xF6jligg\xF6\
            r eller bekr\xE4ftar identifieringen av denna fysiska person, s\xE5som\
            \ ansiktsbilder eller fingeravtrycksuppgifter,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.15
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.15'
      description: "\u2018data concerning health\u2019 means personal data related\
        \ to the physical or mental health of a natural person, including the provision\
        \ of health care services, which reveal information about his or her health\
        \ status;"
      translations:
        sv:
          description: "uppgifter om h\xE4lsa: personuppgifter som r\xF6r en fysisk\
            \ persons fysiska eller psykiska h\xE4lsa, inbegripet tillhandah\xE5llande\
            \ av h\xE4lso- och sjukv\xE5rdstj\xE4nster, vilka ger information om dennes\
            \ h\xE4lsostatus,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.16
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.16'
      description: "\u2018main establishment\u2019 means:"
      translations:
        sv:
          description: "huvudsakligt verksamhetsst\xE4lle:"
    - urn: urn:intuitem:risk:req_node:gdpr:4.16.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.16
      ref_id: 4.16.a
      description: as regards a controller with establishments in more than one Member
        State, the place of its central administration in the Union, unless the decisions
        on the purposes and means of the processing of personal data are taken in
        another establishment of the controller in the Union and the latter establishment
        has the power to have such decisions implemented, in which case the establishment
        having taken such decisions is to be considered to be the main establishment;
      translations:
        sv:
          description: "n\xE4r det g\xE4ller en personuppgiftsansvarig med verksamhetsst\xE4\
            llen i mer \xE4n en medlemsstat, den plats i unionen d\xE4r vederb\xF6\
            rande har sin centrala f\xF6rvaltning, om inte besluten om \xE4ndam\xE5\
            len och medlen f\xF6r behandlingen av personuppgifter fattas vid ett annat\
            \ av den personuppgiftsansvariges verksamhetsst\xE4llen i unionen och\
            \ det sistn\xE4mnda verksamhetsst\xE4llet har befogenhet att f\xE5 s\xE5\
            dana beslut genomf\xF6rda, i\_vilket fall det verksamhetsst\xE4lle som\
            \ har fattat s\xE5dana beslut ska betraktas som det huvudsakliga verksamhetsst\xE4\
            llet,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.16.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.16
      ref_id: 4.16.b
      description: as regards a processor with establishments in more than one Member
        State, the place of its central administration in the Union, or, if the processor
        has no central administration in the Union, the establishment of the processor
        in the Union where the main processing activities in the context of the activities
        of an establishment of the processor take place to the extent that the processor
        is subject to specific obligations under this Regulation;
      translations:
        sv:
          description: "n\xE4r det g\xE4ller ett personuppgiftsbitr\xE4de med verksamhetsst\xE4\
            llen i mer \xE4n en medlemsstat, den plats i unionen d\xE4r vederb\xF6\
            rande har sin centrala f\xF6rvaltning eller, om personuppgiftsbitr\xE4\
            det inte har n\xE5gon central f\xF6rvaltning i unionen, det av personuppgiftsbitr\xE4\
            dets verksamhetsst\xE4llen i unionen d\xE4r den huvudsakliga behandlingen\
            \ inom ramen f\xF6r verksamheten vid ett av personuppgiftsbitr\xE4dets\
            \ verksamhetsst\xE4llen sker, i den utstr\xE4ckning som personuppgiftsbitr\xE4\
            det omfattas av s\xE4rskilda skyldigheter enligt denna f\xF6rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.17
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.17'
      description: "\u2018representative\u2019 means a natural or legal person established\
        \ in the Union who, designated by the controller or processor in writing pursuant\
        \ to Article 27, represents the controller or processor with regard to their\
        \ respective obligations under this Regulation;"
      translations:
        sv:
          description: "f\xF6retr\xE4dare: en i unionen etablerad fysisk eller juridisk\
            \ person som skriftligen har utsetts av den personuppgiftsansvarige eller\
            \ personuppgiftsbitr\xE4det i enlighet med artikel 27 och f\xF6retr\xE4\
            der denne i fr\xE5gor som g\xE4ller dennes skyldigheter enligt denna f\xF6\
            rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.18
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.18'
      description: "\u2018enterprise\u2019 means a natural or legal person engaged\
        \ in an economic activity, irrespective of its legal form, including partnerships\
        \ or associations regularly engaged in an economic activity;"
      translations:
        sv:
          description: "f\xF6retag: en fysisk eller juridisk person som bedriver ekonomisk\
            \ verksamhet, oavsett dess juridiska form, vilket inbegriper partnerskap\
            \ eller f\xF6reningar som regelbundet bedriver ekonomisk verksamhet,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.19
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.19'
      description: "\u2018group of undertakings\u2019 means a controlling undertaking\
        \ and its controlled undertakings;"
      translations:
        sv:
          description: "koncern: ett kontrollerande f\xF6retag och dess kontrollerade\
            \ f\xF6retag,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.20
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.20'
      description: "\u2018binding corporate rules\u2019 means personal data protection\
        \ policies which are adhered to by a controller or processor established on\
        \ the territory of a Member State for transfers or a set of transfers of personal\
        \ data to a controller or processor in one or more third countries within\
        \ a group of undertakings, or group of enterprises engaged in a joint economic\
        \ activity;"
      translations:
        sv:
          description: "bindande f\xF6retagsbest\xE4mmelser: strategier f\xF6r skydd\
            \ av personuppgifter som en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de som \xE4r etablerad p\xE5 en medlemsstats territorium anv\xE4nder sig\
            \ av vid \xF6verf\xF6ringar eller en upps\xE4ttning av \xF6verf\xF6ringar\
            \ av personuppgifter till en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de i ett eller flera tredjel\xE4nder inom en koncern eller en grupp av\
            \ f\xF6retag som deltar i gemensam ekonomisk verksamhet,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.21
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.21'
      description: "\u2018supervisory authority\u2019 means an independent public\
        \ authority which is established by a Member State pursuant to Article 51;"
      translations:
        sv:
          description: "tillsynsmyndighet: en oberoende offentlig myndighet som \xE4\
            r utsedd av en medlemsstat i\_enlighet med artikel 51,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.22
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.22'
      description: "\u2018supervisory authority concerned\u2019 means a supervisory\
        \ authority which is concerned by the processing of personal data because:"
      translations:
        sv:
          description: "ber\xF6rd tillsynsmyndighet: en tillsynsmyndighet som ber\xF6\
            rs av behandlingen av personuppgifter p\xE5 grund av att"
    - urn: urn:intuitem:risk:req_node:gdpr:4.22.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.22
      ref_id: 4.22.a
      description: the controller or processor is established on the territory of
        the Member State of that supervisory authority;
      translations:
        sv:
          description: "den personuppgiftsansvarige eller personuppgiftsbitr\xE4det\
            \ \xE4r etablerad p\xE5 tillsynsmyndighetens medlemsstats territorium,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.22.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.22
      ref_id: 4.22.b
      description: data subjects residing in the Member State of that supervisory
        authority are substantially affected or likely to be substantially affected
        by the processing; or
      translations:
        sv:
          description: "registrerade som \xE4r bosatta i den tillsynsmyndighetens\
            \ medlemsstat i v\xE4sentlig grad p\xE5verkas eller sannolikt i v\xE4\
            sentlig grad kommer att p\xE5verkas av behandlingen, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:4.22.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.22
      ref_id: 4.22.c
      description: a complaint has been lodged with that supervisory authority;
      translations:
        sv:
          description: "ett klagom\xE5l har l\xE4mnats in till denna tillsynsmyndighet,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.23
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.23'
      description: "\u2018cross-border processing\u2019 means either:"
      translations:
        sv:
          description: "gr\xE4ns\xF6verskridande behandling:"
    - urn: urn:intuitem:risk:req_node:gdpr:4.23.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.23
      ref_id: 4.23.a
      description: processing of personal data which takes place in the context of
        the activities of establishments in more than one Member State of a controller
        or processor in the Union where the controller or processor is established
        in more than one Member State; or
      translations:
        sv:
          description: "behandling av personuppgifter som \xE4ger rum inom ramen f\xF6\
            r verksamhet vid verksamhetsst\xE4llen i\_mer \xE4n en medlemsstat tillh\xF6\
            rande en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de i\_\
            unionen, n\xE4r den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det \xE4r etablerad i mer \xE4n en medlemsstat, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:4.23.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:4.23
      ref_id: 4.23.b
      description: processing of personal data which takes place in the context of
        the activities of a single establishment of a controller or processor in the
        Union but which substantially affects or is likely to substantially affect
        data subjects in more than one Member State.
      translations:
        sv:
          description: "behandling av personuppgifter som \xE4ger rum inom ramen f\xF6\
            r verksamhet vid ett enda verksamhetsst\xE4lle tillh\xF6rande en personuppgiftsansvarig\
            \ eller ett personuppgiftsbitr\xE4de i unionen men som i v\xE4sentlig\
            \ grad p\xE5verkar eller sannolikt i\_v\xE4sentlig grad kommer att p\xE5\
            verka registrerade i mer \xE4n en medlemsstat,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.24
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.24'
      description: "\u2018relevant and reasoned objection\u2019 means an objection\
        \ to a draft decision as to whether there is an infringement of this Regulation,\
        \ or whether envisaged action in relation to the controller or processor complies\
        \ with this Regulation, which clearly demonstrates the significance of the\
        \ risks posed by the draft decision as regards the fundamental rights and\
        \ freedoms of data subjects and, where applicable, the free flow of personal\
        \ data within the Union;"
      translations:
        sv:
          description: "relevant och motiverad inv\xE4ndning: en inv\xE4ndning mot\
            \ ett f\xF6rslag till beslut avseende fr\xE5gan huruvida det f\xF6religger\
            \ en \xF6vertr\xE4delse av denna f\xF6rordning eller huruvida den planerade\
            \ \xE5tg\xE4rden i\_f\xF6rh\xE5llande till den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det \xE4r f\xF6renlig med denna f\xF6rordning,\
            \ av vilken inv\xE4ndning det tydligt framg\xE5r hur stora risker utkastet\
            \ till beslut medf\xF6r n\xE4r det g\xE4ller registrerades grundl\xE4\
            ggande r\xE4ttigheter och friheter samt i\_till\xE4mpliga fall det fria\
            \ fl\xF6det av personuppgifter inom unionen,"
    - urn: urn:intuitem:risk:req_node:gdpr:4.25
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.25'
      description: "\u2018information society service\u2019 means a service as defined\
        \ in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European\
        \ Parliament and of the Council (1);"
      translations:
        sv:
          description: "informationssamh\xE4llets tj\xE4nster: alla tj\xE4nster enligt\
            \ definitionen i artikel 1.1 b i\_Europaparlamentets och r\xE5dets direktiv\
            \ (EU) 2015/1535\_(19),"
    - urn: urn:intuitem:risk:req_node:gdpr:4.26
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node202
      ref_id: '4.26'
      description: "\u2018international organisation\u2019 means an organisation and\
        \ its subordinate bodies governed by public international law, or any other\
        \ body which is set up by, or on the basis of, an agreement between two or\
        \ more countries."
      translations:
        sv:
          description: "internationell organisation: en organisation och dess underst\xE4\
            llda organ som lyder under folkr\xE4tten, eller ett annat organ som inr\xE4\
            ttats genom eller p\xE5 grundval av en \xF6verenskommelse mellan tv\xE5\
            \ eller flera l\xE4nder."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      assessable: false
      depth: 1
      ref_id: CHAPTER II
      description: Principles
      translations:
        sv:
          name: KAPITEL II
          description: Principer
    - urn: urn:intuitem:risk:req_node:gdpr:article-5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 5
      description: Principles relating to processing of personal data
      translations:
        sv:
          name: Artikel 5
          description: "Principer f\xF6r behandling av personuppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:5.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-5
      ref_id: '5.1'
      description: 'Personal data shall be:'
      translations:
        sv:
          description: "Vid behandling av personuppgifter ska f\xF6ljande g\xE4lla:"
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.a
      description: "processed lawfully, fairly and in a transparent manner in relation\
        \ to the data subject (\u2018lawfulness, fairness and transparency\u2019);"
      translations:
        sv:
          description: "Uppgifterna ska behandlas p\xE5 ett lagligt, korrekt och \xF6\
            ppet s\xE4tt i f\xF6rh\xE5llande till den registrerade (laglighet, korrekthet\
            \ och \xF6ppenhet)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.b
      description: "collected for specified, explicit and legitimate purposes and\
        \ not further processed in a manner that is incompatible with those purposes;\
        \ further processing for archiving purposes in the public interest, scientific\
        \ or historical research purposes or statistical purposes shall, in accordance\
        \ with Article 89(1), not be considered to be incompatible with the initial\
        \ purposes (\u2018purpose limitation\u2019);"
      annotation: The processing of data can be used subsequently if the new purpose
        is compatible with the original one (Recital 50). This is particularly the
        case for statistical studies, where the results are aggregated and non-personal
        data (Recital 162).
      translations:
        sv:
          description: "De ska samlas in f\xF6r s\xE4rskilda, uttryckligt angivna\
            \ och ber\xE4ttigade \xE4ndam\xE5l och inte senare behandlas p\xE5 ett\
            \ s\xE4tt som \xE4r of\xF6renligt med dessa \xE4ndam\xE5l. Ytterligare\
            \ behandling f\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga\
            \ eller historiska forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5\
            l i enlighet med artikel 89.1 ska inte anses vara of\xF6renlig med de\
            \ ursprungliga \xE4ndam\xE5len (\xE4ndam\xE5lsbegr\xE4nsning)."
          annotation: "The processing of data can be used subsequently if the new\
            \ purpose is compatible with the original one (Sk\xE4l 50). This is particularly\
            \ the case for statistical studies, where the results are aggregated and\
            \ non-personal data (Sk\xE4l 162)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.c
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.c
      description: "adequate, relevant and limited to what is necessary in relation\
        \ to the purposes for which they are processed (\u2018data minimisation\u2019\
        );"
      translations:
        sv:
          description: "De ska vara adekvata, relevanta och inte f\xF6r omfattande\
            \ i f\xF6rh\xE5llande till de \xE4ndam\xE5l f\xF6r vilka de behandlas\
            \ (uppgiftsminimering)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.d
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.d
      description: "accurate and, where necessary, kept up to date; every reasonable\
        \ step must be taken to ensure that personal data that are inaccurate, having\
        \ regard to the purposes for which they are processed, are erased or rectified\
        \ without delay (\u2018accuracy\u2019);"
      translations:
        sv:
          description: "De ska vara korrekta och om n\xF6dv\xE4ndigt uppdaterade.\
            \ Alla rimliga \xE5tg\xE4rder m\xE5ste vidtas f\xF6r att s\xE4kerst\xE4\
            lla att personuppgifter som \xE4r felaktiga i f\xF6rh\xE5llande till de\
            \ \xE4ndam\xE5l f\xF6r vilka de behandlas raderas eller r\xE4ttas utan\
            \ dr\xF6jsm\xE5l (korrekthet)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.e
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.e
      description: "kept in a form which permits identification of data subjects for\
        \ no longer than is necessary for the purposes for which the personal data\
        \ are processed; personal data may be stored for longer periods insofar as\
        \ the personal data will be processed solely for archiving purposes in the\
        \ public interest, scientific or historical research purposes or statistical\
        \ purposes in accordance with Article 89(1) subject to implementation of the\
        \ appropriate technical and organisational measures required by this Regulation\
        \ in order to safeguard the rights and freedoms of the data subject (\u2018\
        storage limitation\u2019);"
      translations:
        sv:
          description: "De f\xE5r inte f\xF6rvaras i en form som m\xF6jligg\xF6r identifiering\
            \ av den registrerade under en l\xE4ngre tid \xE4n vad som \xE4r n\xF6\
            dv\xE4ndigt f\xF6r de \xE4ndam\xE5l f\xF6r vilka personuppgifterna behandlas.\
            \ Personuppgifter f\xE5r lagras under l\xE4ngre perioder i den m\xE5n\
            \ som personuppgifterna enbart behandlas f\xF6r arkiv\xE4ndam\xE5l av\
            \ allm\xE4nt intresse, vetenskapliga eller historiska forsknings\xE4ndam\xE5\
            l eller statistiska \xE4ndam\xE5l i enlighet med artikel 89.1, under f\xF6\
            ruts\xE4ttning att de l\xE4mpliga tekniska och organisatoriska \xE5tg\xE4\
            rder som kr\xE4vs enligt denna f\xF6rordning genomf\xF6rs f\xF6r att s\xE4\
            kerst\xE4lla den registrerades r\xE4ttigheter och friheter (lagringsminimering)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.1.f
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:5.1
      ref_id: 5.1.f
      description: "processed in a manner that ensures appropriate security of the\
        \ personal data, including protection against unauthorised or unlawful processing\
        \ and against accidental loss, destruction or damage, using appropriate technical\
        \ or organisational measures (\u2018integrity and confidentiality\u2019)."
      translations:
        sv:
          description: "De ska behandlas p\xE5 ett s\xE4tt som s\xE4kerst\xE4ller\
            \ l\xE4mplig s\xE4kerhet f\xF6r personuppgifterna, inbegripet skydd mot\
            \ obeh\xF6rig eller otill\xE5ten behandling och mot f\xF6rlust, f\xF6\
            rst\xF6ring eller skada genom olycksh\xE4ndelse, med anv\xE4ndning av\
            \ l\xE4mpliga tekniska eller organisatoriska \xE5tg\xE4rder (integritet\
            \ och konfidentialitet)."
    - urn: urn:intuitem:risk:req_node:gdpr:5.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-5
      ref_id: '5.2'
      description: "The controller shall be responsible for, and be able to demonstrate\
        \ compliance with, paragraph 1 (\u2018accountability\u2019)."
      translations:
        sv:
          description: "2.\_\_\_Den personuppgiftsansvarige ska ansvara f\xF6r och\
            \ kunna visa att punkt 1 efterlevs (ansvarsskyldighet)."
    - urn: urn:intuitem:risk:req_node:gdpr:article-6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 6
      description: Lawfulness of processing
      translations:
        sv:
          name: Artikel 6
          description: Laglig behandling av personuppgifter
    - urn: urn:intuitem:risk:req_node:gdpr:6.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-6
      ref_id: '6.1'
      description: 'Processing shall be lawful only if and to the extent that at least
        one of the following applies:'
      translations:
        sv:
          description: "Behandling \xE4r endast laglig om och i den m\xE5n som \xE5\
            tminstone ett av f\xF6ljande villkor \xE4r uppfyllt:"
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.a
      description: the data subject has given consent to the processing of his or
        her personal data for one or more specific purposes;
      translations:
        sv:
          description: "Den registrerade har l\xE4mnat sitt samtycke till att dennes\
            \ personuppgifter behandlas f\xF6r ett eller flera specifika \xE4ndam\xE5\
            l."
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.b
      description: processing is necessary for the performance of a contract to which
        the data subject is party or in order to take steps at the request of the
        data subject prior to entering into a contract;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att fullg\xF6ra\
            \ ett avtal i vilket den registrerade \xE4r part eller f\xF6r att vidta\
            \ \xE5tg\xE4rder p\xE5 beg\xE4ran av den registrerade innan ett s\xE5\
            dant avtal ing\xE5s."
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.c
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.c
      description: processing is necessary for compliance with a legal obligation
        to which the controller is subject;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att fullg\xF6ra\
            \ en r\xE4ttslig f\xF6rpliktelse som \xE5vilar den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.d
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.d
      description: processing is necessary in order to protect the vital interests
        of the data subject or of another natural person;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att skydda intressen\
            \ som \xE4r av grundl\xE4ggande betydelse f\xF6r den registrerade eller\
            \ f\xF6r en annan fysisk person."
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.e
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.e
      description: processing is necessary for the performance of a task carried out
        in the public interest or in the exercise of official authority vested in
        the controller;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att utf\xF6ra en\
            \ uppgift av allm\xE4nt intresse eller som ett led i den personuppgiftsansvariges\
            \ myndighetsut\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:6.1.f
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      ref_id: 6.1.f
      description: processing is necessary for the purposes of the legitimate interests
        pursued by the controller or by a third party, except where such interests
        are overridden by the interests or fundamental rights and freedoms of the
        data subject which require protection of personal data, in particular where
        the data subject is a child.
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r \xE4ndam\xE5l som\
            \ r\xF6r den personuppgiftsansvariges eller en tredje parts ber\xE4ttigade\
            \ intressen, om inte den registrerades intressen eller grundl\xE4ggande\
            \ r\xE4ttigheter och friheter v\xE4ger tyngre och kr\xE4ver skydd av personuppgifter,\
            \ s\xE4rskilt n\xE4r den registrerade \xE4r ett barn."
    - urn: urn:intuitem:risk:req_node:gdpr:node254
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.1
      description: Point (f) of the first subparagraph shall not apply to processing
        carried out by public authorities in the performance of their tasks.
      translations:
        sv:
          description: "Led f i f\xF6rsta stycket ska inte g\xE4lla f\xF6r behandling\
            \ som utf\xF6rs av offentliga myndigheter n\xE4r de fullg\xF6r sina uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:6.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-6
      ref_id: '6.2'
      description: Member States may maintain or introduce more specific provisions
        to adapt the application of the rules of this Regulation with regard to processing
        for compliance with points (c) and (e) of paragraph 1 by determining more
        precisely specific requirements for the processing and other measures to ensure
        lawful and fair processing including for other specific processing situations
        as provided for in Chapter IX.
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r beh\xE5lla eller inf\xF6ra mer specifika\
            \ best\xE4mmelser f\xF6r att anpassa till\xE4mpningen av best\xE4mmelserna\
            \ i denna f\xF6rordning med h\xE4nsyn till behandling f\xF6r att efterleva\
            \ punkt 1\_c och e genom att n\xE4rmare fastst\xE4lla specifika krav f\xF6\
            r uppgiftsbehandlingen och andra \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4\
            lla en laglig och r\xE4ttvis behandling, inbegripet f\xF6r andra specifika\
            \ situationer d\xE5 uppgifter behandlas i enlighet med kapitel IX."
    - urn: urn:intuitem:risk:req_node:gdpr:6.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-6
      ref_id: '6.3'
      description: 'The basis for the processing referred to in point (c) and (e)
        of paragraph 1 shall be laid down by:'
      translations:
        sv:
          description: "Den grund f\xF6r behandlingen som avses i punkt 1 c och e\
            \ ska fastst\xE4llas i enlighet med"
    - urn: urn:intuitem:risk:req_node:gdpr:6.3.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.3
      ref_id: 6.3.a
      description: Union law; or
      translations:
        sv:
          description: "unionsr\xE4tten, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:6.3.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.3
      ref_id: 6.3.b
      description: Member State law to which the controller is subject.
      translations:
        sv:
          description: "en medlemsstats nationella r\xE4tt som den personuppgiftsansvarige\
            \ omfattas av."
    - urn: urn:intuitem:risk:req_node:gdpr:node259
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.3
      description: 'The purpose of the processing shall be determined in that legal
        basis or, as regards the processing referred to in point (e) of paragraph
        1, shall be necessary for the performance of a task carried out in the public
        interest or in the exercise of official authority vested in the controller.
        That legal basis may contain specific provisions to adapt the application
        of rules of this Regulation, inter alia: the general conditions governing
        the lawfulness of processing by the controller; the types of data which are
        subject to the processing; the data subjects concerned; the entities to, and
        the purposes for which, the personal data may be disclosed; the purpose limitation;
        storage periods; and processing operations and processing procedures, including
        measures to ensure lawful and fair processing such as those for other specific
        processing situations as provided for in Chapter IX. The Union or the Member
        State law shall meet an objective of public interest and be proportionate
        to the legitimate aim pursued.'
      translations:
        sv:
          description: "Syftet med behandlingen ska fastst\xE4llas i den r\xE4ttsliga\
            \ grunden eller, i fr\xE5ga om behandling enligt punkt 1 e, ska vara n\xF6\
            dv\xE4ndigt f\xF6r att utf\xF6ra en uppgift av allm\xE4nt intresse eller\
            \ som ett led i den personuppgiftsansvariges myndighetsut\xF6vning. Den\
            \ r\xE4ttsliga grunden kan inneh\xE5lla s\xE4rskilda best\xE4mmelser f\xF6\
            r att anpassa till\xE4mpningen av best\xE4mmelserna i denna f\xF6rordning,\
            \ bland annat: de allm\xE4nna villkor som ska g\xE4lla f\xF6r den personuppgiftsansvariges\
            \ behandling, vilken typ av uppgifter som ska behandlas, vilka registrerade\
            \ som ber\xF6rs, de enheter till vilka personuppgifterna f\xE5r l\xE4\
            mnas ut och f\xF6r vilka \xE4ndam\xE5l, \xE4ndam\xE5lsbegr\xE4nsningar,\
            \ lagringstid samt typer av behandling och f\xF6rfaranden f\xF6r behandling,\
            \ inbegripet \xE5tg\xE4rder f\xF6r att tillf\xF6rs\xE4kra en laglig och\
            \ r\xE4ttvis behandling, d\xE4ribland f\xF6r behandling i andra s\xE4\
            rskilda situationer enligt kapitel IX. Unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt ska uppfylla ett m\xE5l av allm\xE4nt intresse och\
            \ vara proportionell mot det legitima m\xE5l som efterstr\xE4vas."
    - urn: urn:intuitem:risk:req_node:gdpr:6.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.3
      ref_id: '6.4'
      description: 'Where the processing for a purpose other than that for which the
        personal data have been collected is not based on the data subject''s consent
        or on a Union or Member State law which constitutes a necessary and proportionate
        measure in a democratic society to safeguard the objectives referred to in
        Article 23(1), the controller shall, in order to ascertain whether processing
        for another purpose is compatible with the purpose for which the personal
        data are initially collected, take into account, inter alia:'
      translations:
        sv:
          description: "Om en behandling f\xF6r andra \xE4ndam\xE5l \xE4n det \xE4\
            ndam\xE5l f\xF6r vilket personuppgifterna samlades in inte grundar sig\
            \ p\xE5 den registrerades samtycke eller p\xE5 unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt som utg\xF6r en n\xF6dv\xE4ndig och proportionell\
            \ \xE5tg\xE4rd i ett demokratiskt samh\xE4lle f\xF6r att skydda de m\xE5\
            l som avses i artikel 23.1, ska den personuppgiftsansvarige f\xF6r att\
            \ fastst\xE4lla huruvida behandling f\xF6r andra \xE4ndam\xE5l \xE4r f\xF6\
            renlig med det \xE4ndam\xE5l f\xF6r vilket personuppgifterna ursprungligen\
            \ samlades in bland annat beakta f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:6.4.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.4
      ref_id: 6.4.a
      description: any link between the purposes for which the personal data have
        been collected and the purposes of the intended further processing;
      translations:
        sv:
          description: "Kopplingar mellan de \xE4ndam\xE5l f\xF6r vilka personuppgifterna\
            \ har samlats in och \xE4ndam\xE5len med den avsedda ytterligare behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:6.4.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.4
      ref_id: 6.4.b
      description: the context in which the personal data have been collected, in
        particular regarding the relationship between data subjects and the controller;
      translations:
        sv:
          description: "Det sammanhang inom vilket personuppgifterna har samlats in,\
            \ s\xE4rskilt f\xF6rh\xE5llandet mellan de registrerade och den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:6.4.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.4
      ref_id: 6.4.c
      description: the nature of the personal data, in particular whether special
        categories of personal data are processed, pursuant to Article 9, or whether
        personal data related to criminal convictions and offences are processed,
        pursuant to Article 10;
      translations:
        sv:
          description: "Personuppgifternas art, s\xE4rskilt huruvida s\xE4rskilda\
            \ kategorier av personuppgifter behandlas i enlighet med artikel\_9 eller\
            \ huruvida personuppgifter om f\xE4llande domar i brottm\xE5l och \xF6\
            vertr\xE4delser behandlas i enlighet med artikel\_10."
    - urn: urn:intuitem:risk:req_node:gdpr:6.4.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.4
      ref_id: 6.4.d
      description: the possible consequences of the intended further processing for
        data subjects;
      translations:
        sv:
          description: "Eventuella konsekvenser f\xF6r registrerade av den planerade\
            \ fortsatta behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:6.4.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:6.4
      ref_id: 6.4.e
      description: the existence of appropriate safeguards, which may include encryption
        or pseudonymisation.
      translations:
        sv:
          description: "F\xF6rekomsten av l\xE4mpliga skydds\xE5tg\xE4rder, vilket\
            \ kan inbegripa kryptering eller pseudonymisering."
    - urn: urn:intuitem:risk:req_node:gdpr:article-7
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 7
      description: Conditions for consent
      translations:
        sv:
          name: Artikel 7
          description: "Villkor f\xF6r samtycke"
    - urn: urn:intuitem:risk:req_node:gdpr:7.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-7
      ref_id: '7.1'
      description: Where processing is based on consent, the controller shall be able
        to demonstrate that the data subject has consented to processing of his or
        her personal data.
      translations:
        sv:
          description: "Om behandlingen grundar sig p\xE5 samtycke, ska den personuppgiftsansvarige\
            \ kunna visa att den registrerade har samtyckt till behandling av sina\
            \ personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:7.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-7
      ref_id: '7.2'
      description: If the data subject's consent is given in the context of a written
        declaration which also concerns other matters, the request for consent shall
        be presented in a manner which is clearly distinguishable from the other matters,
        in an intelligible and easily accessible form, using clear and plain language.
        Any part of such a declaration which constitutes an infringement of this Regulation
        shall not be binding.
      annotation: To maintain adequate records of obtained consents.
      translations:
        sv:
          description: "Om den registrerades samtycke l\xE4mnas i en skriftlig f\xF6\
            rklaring som ocks\xE5 r\xF6r andra fr\xE5gor, ska beg\xE4ran om samtycke\
            \ l\xE4ggas fram p\xE5 ett s\xE4tt som klart och tydligt kan s\xE4rskiljas\
            \ fr\xE5n de andra fr\xE5gorna i en begriplig och l\xE4tt tillg\xE4nglig\
            \ form, med anv\xE4ndning av klart och tydligt spr\xE5k. Om en del av\
            \ f\xF6rklaringen inneb\xE4r en \xF6vertr\xE4delse av denna f\xF6rordning,\
            \ ska denna del inte vara bindande."
          annotation: To maintain adequate records of obtained consents.
    - urn: urn:intuitem:risk:req_node:gdpr:7.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-7
      ref_id: '7.3'
      description: The data subject shall have the right to withdraw his or her consent
        at any time. The withdrawal of consent shall not affect the lawfulness of
        processing based on consent before its withdrawal. Prior to giving consent,
        the data subject shall be informed thereof. It shall be as easy to withdraw
        as to give consent.
      annotation: To implement simple and accessible mechanisms to allow individuals
        to withdraw their consent
      translations:
        sv:
          description: "De registrerade ska ha r\xE4tt att n\xE4r som helst \xE5terkalla\
            \ sitt samtycke. \xC5terkallandet av samtycket ska inte p\xE5verka lagligheten\
            \ av behandling som grundar sig p\xE5 samtycke, innan detta \xE5terkallas.\
            \ Innan samtycke l\xE4mnas ska den registrerade informeras om detta. Det\
            \ ska vara lika l\xE4tt att \xE5terkalla som att ge sitt samtycke."
          annotation: To implement simple and accessible mechanisms to allow individuals
            to withdraw their consent
    - urn: urn:intuitem:risk:req_node:gdpr:7.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-7
      ref_id: '7.4'
      description: When assessing whether consent is freely given, utmost account
        shall be taken of whether, inter alia, the performance of a contract, including
        the provision of a service, is conditional on consent to the processing of
        personal data that is not necessary for the performance of that contract.
      annotation: To present each purpose separately and obtain specific consent for
        each one
      translations:
        sv:
          description: "Vid bed\xF6mning av huruvida samtycke \xE4r frivilligt ska\
            \ st\xF6rsta h\xE4nsyn bland annat tas till huruvida genomf\xF6randet\
            \ av ett avtal, inbegripet tillhandah\xE5llandet av en tj\xE4nst, har\
            \ gjorts beroende av samtycke till s\xE5dan behandling av personuppgifter\
            \ som inte \xE4r n\xF6dv\xE4ndig f\xF6r genomf\xF6randet av det avtalet."
          annotation: To present each purpose separately and obtain specific consent
            for each one
    - urn: urn:intuitem:risk:req_node:gdpr:article-8
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 8
      description: Conditions applicable to child's consent in relation to information
        society services
      translations:
        sv:
          name: Artikel 8
          description: "Villkor som g\xE4ller barns samtycke avseende informationssamh\xE4\
            llets tj\xE4nster"
    - urn: urn:intuitem:risk:req_node:gdpr:8.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-8
      ref_id: '8.1'
      description: Where point (a) of Article 6(1) applies, in relation to the offer
        of information society services directly to a child, the processing of the
        personal data of a child shall be lawful where the child is at least 16 years
        old. Where the child is below the age of 16 years, such processing shall be
        lawful only if and to the extent that consent is given or authorised by the
        holder of parental responsibility over the child.
      translations:
        sv:
          description: "Vid erbjudande av informationssamh\xE4llets tj\xE4nster direkt\
            \ till ett barn, ska vid till\xE4mpningen av artikel 6.1 a behandling\
            \ av personuppgifter som r\xF6r ett barn vara till\xE5ten om barnet \xE4\
            r minst 16 \xE5r. Om barnet \xE4r under 16 \xE5r ska s\xE5dan behandling\
            \ vara till\xE5ten endast om och i\_den m\xE5n samtycke ges eller godk\xE4\
            nns av den person som har f\xF6r\xE4ldraansvar f\xF6r barnet."
    - urn: urn:intuitem:risk:req_node:gdpr:node273
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-8
      description: Member States may provide by law for a lower age for those purposes
        provided that such lower age is not below 13 years.
      annotation: The age of consent is 13 years in Estonia, Denmark, Belgium, Ireland,
        Finland, Poland, Latvia, Spain, Portugal, the United Kingdom, and Sweden,
        15 years in France, 16 years in Germany, and 14 years in Italy
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r i sin nationella r\xE4tt f\xF6reskriva\
            \ en l\xE4gre \xE5lder i detta syfte, under f\xF6ruts\xE4ttning att denna\
            \ l\xE4gre \xE5lder inte \xE4r under 13 \xE5r."
          annotation: The age of consent is 13 years in Estonia, Denmark, Belgium,
            Ireland, Finland, Poland, Latvia, Spain, Portugal, the United Kingdom,
            and Sweden, 15 years in France, 16 years in Germany, and 14 years in Italy
    - urn: urn:intuitem:risk:req_node:gdpr:8.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-8
      ref_id: '8.2'
      description: The controller shall make reasonable efforts to verify in such
        cases that consent is given or authorised by the holder of parental responsibility
        over the child, taking into consideration available technology.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska g\xF6ra rimliga anstr\xE4\
            ngningar f\xF6r att i s\xE5dana fall kontrollera att samtycke ges eller\
            \ godk\xE4nns av den person som har f\xF6r\xE4ldraansvar f\xF6r barnet,\
            \ med h\xE4nsyn tagen till tillg\xE4nglig teknik."
    - urn: urn:intuitem:risk:req_node:gdpr:8.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-8
      ref_id: '8.3'
      description: Paragraph 1 shall not affect the general contract law of Member
        States such as the rules on the validity, formation or effect of a contract
        in relation to a child.
      translations:
        sv:
          description: "Punkt 1 ska inte p\xE5verka till\xE4mpningen av allm\xE4n\
            \ avtalsr\xE4tt i medlemsstaterna, s\xE5som best\xE4mmelser om giltigheten,\
            \ uppr\xE4ttandet eller effekten av ett avtal som g\xE4ller ett barn."
    - urn: urn:intuitem:risk:req_node:gdpr:article-9
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 9
      description: Processing of special categories of personal data
      translations:
        sv:
          name: Artikel 9
          description: "Behandling av s\xE4rskilda kategorier av personuppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:9.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-9
      ref_id: '9.1'
      description: Processing of personal data revealing racial or ethnic origin,
        political opinions, religious or philosophical beliefs, or trade union membership,
        and the processing of genetic data, biometric data for the purpose of uniquely
        identifying a natural person, data concerning health or data concerning a
        natural person's sex life or sexual orientation shall be prohibited.
      translations:
        sv:
          description: "Behandling av personuppgifter som avsl\xF6jar ras eller etniskt\
            \ ursprung, politiska \xE5sikter, religi\xF6s eller filosofisk \xF6vertygelse\
            \ eller medlemskap i fackf\xF6rening och behandling av genetiska uppgifter,\
            \ biometriska uppgifter f\xF6r att entydigt identifiera en fysisk person,\
            \ uppgifter om h\xE4lsa eller uppgifter om en fysisk persons sexualliv\
            \ eller sexuella l\xE4ggning ska vara f\xF6rbjuden."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-9
      ref_id: '9.2'
      description: 'Paragraph 1 shall not apply if one of the following applies:'
      translations:
        sv:
          description: "Punkt\_1 ska inte till\xE4mpas om n\xE5got av f\xF6ljande\
            \ g\xE4ller:"
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.a
      description: the data subject has given explicit consent to the processing of
        those personal data for one or more specified purposes, except where Union
        or Member State law provide that the prohibition referred to in paragraph
        1 may not be lifted by the data subject;
      translations:
        sv:
          description: "Den registrerade har uttryckligen l\xE4mnat sitt samtycke\
            \ till behandlingen av dessa personuppgifter f\xF6r ett eller flera specifika\
            \ \xE4ndam\xE5l, utom d\xE5 unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt f\xF6reskriver att f\xF6rbudet i punkt\_1 inte kan upph\xE4\
            vas av den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.b
      description: processing is necessary for the purposes of carrying out the obligations
        and exercising specific rights of the controller or of the data subject in
        the field of employment and social security and social protection law in so
        far as it is authorised by Union or Member State law or a collective agreement
        pursuant to Member State law providing for appropriate safeguards for the
        fundamental rights and the interests of the data subject;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att den personuppgiftsansvarige\
            \ eller den registrerade ska kunna fullg\xF6ra sina skyldigheter och ut\xF6\
            va sina s\xE4rskilda r\xE4ttigheter inom arbetsr\xE4tten och p\xE5 omr\xE5\
            dena social trygghet och socialt skydd, i den omfattning detta \xE4r till\xE5\
            tet enligt unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt eller\
            \ ett kollektivavtal som antagits med st\xF6d av medlemsstaternas nationella\
            \ r\xE4tt, d\xE4r l\xE4mpliga skydds\xE5tg\xE4rder som s\xE4kerst\xE4\
            ller den registrerades grundl\xE4ggande r\xE4ttigheter och intressen fastst\xE4\
            lls."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.c
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.c
      description: processing is necessary to protect the vital interests of the data
        subject or of another natural person where the data subject is physically
        or legally incapable of giving consent;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att skydda den registrerades\
            \ eller n\xE5gon annan fysisk persons grundl\xE4ggande intressen n\xE4\
            r den registrerade \xE4r fysiskt eller r\xE4ttsligt f\xF6rhindrad att\
            \ ge sitt samtycke."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.d
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.d
      description: processing is carried out in the course of its legitimate activities
        with appropriate safeguards by a foundation, association or any other not-for-profit
        body with a political, philosophical, religious or trade union aim and on
        condition that the processing relates solely to the members or to former members
        of the body or to persons who have regular contact with it in connection with
        its purposes and that the personal data are not disclosed outside that body
        without the consent of the data subjects;
      translations:
        sv:
          description: "Behandlingen utf\xF6rs inom ramen f\xF6r ber\xE4ttigad verksamhet\
            \ med l\xE4mpliga skydds\xE5tg\xE4rder hos en stiftelse, en f\xF6rening\
            \ eller ett annat icke vinstdrivande organ, som har ett politiskt, filosofiskt,\
            \ religi\xF6st eller fackligt syfte, f\xF6rutsatt att behandlingen enbart\
            \ r\xF6r s\xE5dana organs medlemmar eller tidigare medlemmar eller personer\
            \ som p\xE5 grund av organets \xE4ndam\xE5l har regelbunden kontakt med\
            \ detta och personuppgifterna inte l\xE4mnas ut utanf\xF6r det organet\
            \ utan den registrerades samtycke."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.e
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.e
      description: processing relates to personal data which are manifestly made public
        by the data subject;
      translations:
        sv:
          description: "Behandlingen r\xF6r personuppgifter som p\xE5 ett tydligt\
            \ s\xE4tt har offentliggjorts av den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.f
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.f
      description: processing is necessary for the establishment, exercise or defence
        of legal claims or whenever courts are acting in their judicial capacity;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att fastst\xE4lla,\
            \ g\xF6ra g\xE4llande eller f\xF6rsvara r\xE4ttsliga anspr\xE5k eller\
            \ som en del av domstolarnas d\xF6mande verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.g
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.g
      description: processing is necessary for reasons of substantial public interest,
        on the basis of Union or Member State law which shall be proportionate to
        the aim pursued, respect the essence of the right to data protection and provide
        for suitable and specific measures to safeguard the fundamental rights and
        the interests of the data subject;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig av h\xE4nsyn till ett viktigt\
            \ allm\xE4nt intresse, p\xE5 grundval av unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt, vilken ska st\xE5 i proportion till det efterstr\xE4\
            vade syftet, vara f\xF6renligt med det v\xE4sentliga inneh\xE5llet i r\xE4\
            tten till dataskydd och inneh\xE5lla best\xE4mmelser om l\xE4mpliga och\
            \ s\xE4rskilda \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla den registrerades\
            \ grundl\xE4ggande r\xE4ttigheter och intressen."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.h
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.h
      description: processing is necessary for the purposes of preventive or occupational
        medicine, for the assessment of the working capacity of the employee, medical
        diagnosis, the provision of health or social care or treatment or the management
        of health or social care systems and services on the basis of Union or Member
        State law or pursuant to contract with a health professional and subject to
        the conditions and safeguards referred to in paragraph 3;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig av sk\xE4l som h\xF6r samman\
            \ med f\xF6rebyggande h\xE4lso- och sjukv\xE5rd och yrkesmedicin, bed\xF6\
            mningen av en arbetstagares arbetskapacitet, medicinska diagnoser, tillhandah\xE5\
            llande av h\xE4lso- och sjukv\xE5rd, behandling, social omsorg eller f\xF6\
            rvaltning av h\xE4lso- och sjukv\xE5rdstj\xE4nster och social omsorg och\
            \ av deras system, p\xE5 grundval av unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt eller enligt avtal med yrkesverksamma p\xE5 h\xE4\
            lsoomr\xE5det och under f\xF6ruts\xE4ttning att de villkor och skydds\xE5\
            tg\xE4rder som avses i punkt 3 \xE4r uppfyllda."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.i
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.i
      description: processing is necessary for reasons of public interest in the area
        of public health, such as protecting against serious cross-border threats
        to health or ensuring high standards of quality and safety of health care
        and of medicinal products or medical devices, on the basis of Union or Member
        State law which provides for suitable and specific measures to safeguard the
        rights and freedoms of the data subject, in particular professional secrecy;
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig av sk\xE4l av allm\xE4\
            nt intresse p\xE5 folkh\xE4lsoomr\xE5det, s\xE5som behovet av att s\xE4\
            kerst\xE4lla ett skydd mot allvarliga gr\xE4ns\xF6verskridande hot mot\
            \ h\xE4lsan eller s\xE4kerst\xE4lla h\xF6ga kvalitets- och s\xE4kerhetsnormer\
            \ f\xF6r v\xE5rd och l\xE4kemedel eller medicintekniska produkter, p\xE5\
            \ grundval av unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt, d\xE4r l\xE4mpliga och specifika \xE5tg\xE4rder f\xF6r att skydda\
            \ den registrerades r\xE4ttigheter och friheter fastst\xE4lls, s\xE4rskilt\
            \ tystnadsplikt."
    - urn: urn:intuitem:risk:req_node:gdpr:9.2.j
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:9.2
      ref_id: 9.2.j
      description: processing is necessary for archiving purposes in the public interest,
        scientific or historical research purposes or statistical purposes in accordance
        with Article 89(1) based on Union or Member State law which shall be proportionate
        to the aim pursued, respect the essence of the right to data protection and
        provide for suitable and specific measures to safeguard the fundamental rights
        and the interests of the data subject.
      translations:
        sv:
          description: "Behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r arkiv\xE4ndam\xE5\
            l av allm\xE4nt intresse, vetenskapliga eller historiska forsknings\xE4\
            ndam\xE5l eller statistiska \xE4ndam\xE5l i enlighet med artikel 89.1,\
            \ p\xE5 grundval av unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt, vilken ska st\xE5 i proportion till det efterstr\xE4vade syftet,\
            \ vara f\xF6renligt med det v\xE4sentliga inneh\xE5llet i\_r\xE4tten till\
            \ dataskydd och inneh\xE5lla best\xE4mmelser om l\xE4mpliga och s\xE4\
            rskilda \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla den registrerades\
            \ grundl\xE4ggande r\xE4ttigheter och intressen."
    - urn: urn:intuitem:risk:req_node:gdpr:9.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-9
      ref_id: '9.3'
      description: Personal data referred to in paragraph 1 may be processed for the
        purposes referred to in point (h) of paragraph 2 when those data are processed
        by or under the responsibility of a professional subject to the obligation
        of professional secrecy under Union or Member State law or rules established
        by national competent bodies or by another person also subject to an obligation
        of secrecy under Union or Member State law or rules established by national
        competent bodies.
      translations:
        sv:
          description: "Personuppgifter som avses i punkt 1 f\xE5r behandlas f\xF6\
            r de \xE4ndam\xE5l som avses i punkt 2 h, n\xE4r uppgifterna behandlas\
            \ av eller under ansvar av en yrkesut\xF6vare som omfattas av tystnadsplikt\
            \ enligt unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt eller\
            \ best\xE4mmelser som fastst\xE4lls av nationella beh\xF6riga organ eller\
            \ av en annan person som ocks\xE5 omfattas av tystnadsplikt enligt unionsr\xE4\
            tten eller medlemsstaternas nationella r\xE4tt eller best\xE4mmelser som\
            \ fastst\xE4lls av nationella beh\xF6riga organ."
    - urn: urn:intuitem:risk:req_node:gdpr:9.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-9
      ref_id: '9.4'
      description: Member States may maintain or introduce further conditions, including
        limitations, with regard to the processing of genetic data, biometric data
        or data concerning health.
      annotation: to comply with additional legal obligations
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r beh\xE5lla eller inf\xF6ra ytterligare\
            \ villkor, \xE4ven begr\xE4nsningar, f\xF6r behandlingen av genetiska\
            \ eller biometriska uppgifter eller uppgifter om h\xE4lsa."
          annotation: to comply with additional legal obligations
    - urn: urn:intuitem:risk:req_node:gdpr:article-10
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 10
      description: Processing of personal data relating to criminal convictions and
        offences
      translations:
        sv:
          name: Artikel 10
          description: "Behandling av personuppgifter som r\xF6r f\xE4llande domar\
            \ i brottm\xE5l samt \xF6vertr\xE4delser"
    - urn: urn:intuitem:risk:req_node:gdpr:node292
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-10
      description: Processing of personal data relating to criminal convictions and
        offences or related security measures based on Article 6(1) shall be carried
        out only under the control of official authority or when the processing is
        authorised by Union or Member State law providing for appropriate safeguards
        for the rights and freedoms of data subjects. Any comprehensive register of
        criminal convictions shall be kept only under the control of official authority.
      translations:
        sv:
          description: "Behandling av personuppgifter som r\xF6r f\xE4llande domar\
            \ i brottm\xE5l och \xF6vertr\xE4delser eller d\xE4rmed sammanh\xE4ngande\
            \ s\xE4kerhets\xE5tg\xE4rder enligt artikel 6.1 f\xE5r endast utf\xF6\
            ras under kontroll av myndighet eller d\xE5 behandling \xE4r till\xE5\
            ten enligt unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt,\
            \ d\xE4r l\xE4mpliga skydds\xE5tg\xE4rder f\xF6r de registrerades r\xE4\
            ttigheter och friheter fastst\xE4lls. Ett fullst\xE4ndigt register \xF6\
            ver f\xE4llande domar i brottm\xE5l f\xE5r endast f\xF6ras under kontroll\
            \ av en myndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-11
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ii
      ref_id: Article 11
      description: Processing which does not require identification
      translations:
        sv:
          name: Artikel 11
          description: "Behandling som inte kr\xE4ver identifiering"
    - urn: urn:intuitem:risk:req_node:gdpr:11.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-11
      ref_id: '11.1'
      description: If the purposes for which a controller processes personal data
        do not or do no longer require the identification of a data subject by the
        controller, the controller shall not be obliged to maintain, acquire or process
        additional information in order to identify the data subject for the sole
        purpose of complying with this Regulation.
      translations:
        sv:
          description: "Om de \xE4ndam\xE5l f\xF6r vilka den personuppgiftsansvarige\
            \ behandlar personuppgifter inte kr\xE4ver eller inte l\xE4ngre kr\xE4\
            ver att den registrerade identifieras av den personuppgiftsansvarige,\
            \ ska den personuppgiftsansvarige inte vara tvungen att bevara, f\xF6\
            rv\xE4rva eller behandla ytterligare information f\xF6r att identifiera\
            \ den registrerade endast i\_syfte att f\xF6lja denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:11.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-11
      ref_id: '11.2'
      description: Where, in cases referred to in paragraph 1 of this Article, the
        controller is able to demonstrate that it is not in a position to identify
        the data subject, the controller shall inform the data subject accordingly,
        if possible. In such cases, Articles 15 to 20 shall not apply except where
        the data subject, for the purpose of exercising his or her rights under those
        articles, provides additional information enabling his or her identification.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige, i de fall som avses i punkt\
            \ 1 i denna artikel, kan visa att denne inte \xE4r i st\xE5nd att identifiera\
            \ den registrerade, ska den personuppgiftsansvarige om m\xF6jligt informera\
            \ den registrerade om detta. I s\xE5dana fall ska artiklarna 15\u2013\
            20 inte g\xE4lla, f\xF6rutom n\xE4r den registrerade f\xF6r ut\xF6vande\
            \ av sina r\xE4ttigheter i enlighet med dessa artiklar tillhandah\xE5\
            ller ytterligare information som g\xF6r identifieringen m\xF6jlig."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      assessable: false
      depth: 1
      ref_id: CHAPTER III
      description: Rights of the data subject
      translations:
        sv:
          name: KAPITEL III
          description: "Den registrerades r\xE4ttigheter"
    - urn: urn:intuitem:risk:req_node:gdpr:node297
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      name: Section 1
      description: Transparency and modalities
      translations:
        sv:
          name: Avsnitt 1
          description: Insyn och villkor
    - urn: urn:intuitem:risk:req_node:gdpr:article-12
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node297
      ref_id: Article 12
      description: Transparent information, communication and modalities for the exercise
        of the rights of the data subject
      translations:
        sv:
          name: Artikel 12
          description: "Klar och tydlig information och kommunikation samt klara och\
            \ tydliga villkor f\xF6r ut\xF6vandet av den registrerades r\xE4ttigheter"
    - urn: urn:intuitem:risk:req_node:gdpr:12.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.1'
      description: The controller shall take appropriate measures to provide any information
        referred to in Articles 13 and 14 and any communication under Articles 15
        to 22 and 34 relating to processing to the data subject in a concise, transparent,
        intelligible and easily accessible form, using clear and plain language, in
        particular for any information addressed specifically to a child. The information
        shall be provided in writing, or by other means, including, where appropriate,
        by electronic means. When requested by the data subject, the information may
        be provided orally, provided that the identity of the data subject is proven
        by other means.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska vidta l\xE4mpliga \xE5tg\xE4\
            rder f\xF6r att till den registrerade tillhandah\xE5lla all information\
            \ som avses i artiklarna 13 och 14 och all kommunikation enligt artiklarna\
            \ 15\u201322 och 34 vilken avser behandling i en koncis, klar och tydlig,\
            \ begriplig och l\xE4tt tillg\xE4nglig form, med anv\xE4ndning av klart\
            \ och tydligt spr\xE5k, i synnerhet f\xF6r information som \xE4r s\xE4\
            rskilt riktad till barn. Informationen ska tillhandah\xE5llas skriftligt,\
            \ eller i n\xE5gon annan form, inbegripet, n\xE4r s\xE5 \xE4r l\xE4mpligt,\
            \ i elektronisk form. Om den registrerade beg\xE4r det f\xE5r informationen\
            \ tillhandah\xE5llas muntligt, f\xF6rutsatt att den registrerades identitet\
            \ bevisats p\xE5 andra s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:12.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.2'
      description: The controller shall facilitate the exercise of data subject rights
        under Articles 15 to 22. In the cases referred to in Article 11(2), the controller
        shall not refuse to act on the request of the data subject for exercising
        his or her rights under Articles 15 to 22, unless the controller demonstrates
        that it is not in a position to identify the data subject.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska underl\xE4tta ut\xF6vandet\
            \ av den registrerades r\xE4ttigheter i\_enlighet med artiklarna\_15\u2013\
            22. I de fall som avses i artikel 11.2 f\xE5r den personuppgiftsansvarige\
            \ inte v\xE4gra att tillm\xF6tesg\xE5 den registrerades beg\xE4ran om\
            \ att ut\xF6va sina r\xE4ttigheter enligt artiklarna 15\u201322, om inte\
            \ den personuppgiftsansvarige visar att han eller hon inte \xE4r i st\xE5\
            nd att identifiera den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:12.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.3'
      description: The controller shall provide information on action taken on a request
        under Articles 15 to 22 to the data subject without undue delay and in any
        event within one month of receipt of the request. That period may be extended
        by two further months where necessary, taking into account the complexity
        and number of the requests. The controller shall inform the data subject of
        any such extension within one month of receipt of the request, together with
        the reasons for the delay. Where the data subject makes the request by electronic
        form means, the information shall be provided by electronic means where possible,
        unless otherwise requested by the data subject.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska p\xE5 beg\xE4ran utan on\xF6\
            digt dr\xF6jsm\xE5l och under alla omst\xE4ndigheter senast en m\xE5nad\
            \ efter att ha mottagit beg\xE4ran tillhandah\xE5lla den registrerade\
            \ information om de \xE5tg\xE4rder som vidtagits enligt artiklarna 15\u2013\
            22. Denna period f\xE5r vid behov f\xF6rl\xE4ngas med ytterligare tv\xE5\
            \ m\xE5nader, med beaktande av hur komplicerad beg\xE4ran \xE4r och antalet\
            \ inkomna beg\xE4randen. Den personuppgiftsansvarige ska underr\xE4tta\
            \ den registrerade om en s\xE5dan f\xF6rl\xE4ngning inom en m\xE5nad fr\xE5\
            n det att beg\xE4ran mottagits samt ange orsakerna till f\xF6rseningen.\
            \ Om den registrerade l\xE4mnar beg\xE4ran i\_elektronisk form, ska informationen\
            \ om m\xF6jligt tillhandah\xE5llas i elektronisk form, om den registrerade\
            \ inte beg\xE4r n\xE5got annat."
    - urn: urn:intuitem:risk:req_node:gdpr:12.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.4'
      description: If the controller does not take action on the request of the data
        subject, the controller shall inform the data subject without delay and at
        the latest within one month of receipt of the request of the reasons for not
        taking action and on the possibility of lodging a complaint with a supervisory
        authority and seeking a judicial remedy.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige inte vidtar \xE5tg\xE4rder\
            \ p\xE5 den registrerades beg\xE4ran, ska den personuppgiftsansvarige\
            \ utan dr\xF6jsm\xE5l och senast en m\xE5nad efter att ha mottagit beg\xE4\
            ran informera den registrerade om orsaken till att \xE5tg\xE4rder inte\
            \ vidtagits och om m\xF6jligheten att l\xE4mna in ett klagom\xE5l till\
            \ en tillsynsmyndighet och beg\xE4ra r\xE4ttslig pr\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:12.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.5'
      description: 'Information provided under Articles 13 and 14 and any communication
        and any actions taken under Articles 15 to 22 and 34 shall be provided free
        of charge. Where requests from a data subject are manifestly unfounded or
        excessive, in particular because of their repetitive character, the controller
        may either:'
      translations:
        sv:
          description: "Information som tillhandah\xE5llits enligt artiklarna 13 och\
            \ 14, all kommunikation och samtliga \xE5tg\xE4rder som vidtas enligt\
            \ artiklarna 15\u201322 och 34 ska tillhandah\xE5llas kostnadsfritt. Om\
            \ beg\xE4randen fr\xE5n en registrerad \xE4r uppenbart ogrundade eller\
            \ orimliga, s\xE4rskilt p\xE5 grund av deras repetitiva art, f\xE5r den\
            \ personuppgiftsansvarige antingen"
    - urn: urn:intuitem:risk:req_node:gdpr:12.5.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:12.5
      ref_id: 12.5.a
      description: charge a reasonable fee taking into account the administrative
        costs of providing the information or communication or taking the action requested;
        or
      translations:
        sv:
          description: "ta ut en rimlig avgift som t\xE4cker de administrativa kostnaderna\
            \ f\xF6r att tillhandah\xE5lla den information eller vidta den \xE5tg\xE4\
            rd som beg\xE4rts, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:12.5.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:12.5
      ref_id: 12.5.b
      description: refuse to act on the request.
      translations:
        sv:
          description: "v\xE4gra att tillm\xF6tesg\xE5 beg\xE4ran."
    - urn: urn:intuitem:risk:req_node:gdpr:node306
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      description: The controller shall bear the burden of demonstrating the manifestly
        unfounded or excessive character of the request.
      translations:
        sv:
          description: "Det \xE5ligger den personuppgiftsansvarige att visa att beg\xE4\
            ran \xE4r uppenbart ogrundad eller orimlig."
    - urn: urn:intuitem:risk:req_node:gdpr:12.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.6'
      description: Without prejudice to Article 11, where the controller has reasonable
        doubts concerning the identity of the natural person making the request referred
        to in Articles 15 to 21, the controller may request the provision of additional
        information necessary to confirm the identity of the data subject.
      translations:
        sv:
          description: "Utan att det p\xE5verkar till\xE4mpningen av artikel 11 f\xE5\
            r den personuppgiftsansvarige, om denne har rimliga sk\xE4l att betvivla\
            \ identiteten hos den fysiska person som l\xE4mnar in en beg\xE4ran enligt\
            \ artiklarna 15\u201321, beg\xE4ra att ytterligare information som \xE4\
            r n\xF6dv\xE4ndig f\xF6r att bekr\xE4fta den registrerades identitet tillhandah\xE5\
            lls."
    - urn: urn:intuitem:risk:req_node:gdpr:12.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.7'
      description: The information to be provided to data subjects pursuant to Articles
        13 and 14 may be provided in combination with standardised icons in order
        to give in an easily visible, intelligible and clearly legible manner a meaningful
        overview of the intended processing. Where the icons are presented electronically
        they shall be machine-readable.
      translations:
        sv:
          description: "Den information som ska tillhandah\xE5llas de registrerade\
            \ i enlighet med artiklarna 13 och\_14 f\xE5r tillhandah\xE5llas kombinerad\
            \ med standardiserade symboler f\xF6r att ge en \xF6versk\xE5dlig, begriplig,\
            \ l\xE4ttl\xE4st och meningsfull \xF6verblick \xF6ver den planerade behandlingen.\
            \ Om s\xE5dana symboler visas elektroniskt ska de vara maskinl\xE4sbara."
    - urn: urn:intuitem:risk:req_node:gdpr:12.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-12
      ref_id: '12.8'
      description: The Commission shall be empowered to adopt delegated acts in accordance
        with Article 92 for the purpose of determining the information to be presented
        by the icons and the procedures for providing standardised icons.
      translations:
        sv:
          description: "Kommissionen ska ges befogenhet att anta delegerade akter\
            \ i enlighet med artikel 92 f\xF6r att fastst\xE4lla vilken information\
            \ som ska visas med hj\xE4lp av symboler och f\xF6rfaranden f\xF6r att\
            \ tillhandah\xE5lla s\xE5dana symboler."
    - urn: urn:intuitem:risk:req_node:gdpr:node310
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      name: Section 2
      description: Information and access to personal data
      translations:
        sv:
          name: Avsnitt 2
          description: "Information och tillg\xE5ng till personuppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:article-13
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node310
      ref_id: Article 13
      description: Information to be provided where personal data are collected from
        the data subject
      translations:
        sv:
          name: Artikel 13
          description: "Information som ska tillhandah\xE5llas om personuppgifterna\
            \ samlas in fr\xE5n den registrerade"
    - urn: urn:intuitem:risk:req_node:gdpr:13.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-13
      ref_id: '13.1'
      description: 'Where personal data relating to a data subject are collected from
        the data subject, the controller shall, at the time when personal data are
        obtained, provide the data subject with all of the following information:'
      translations:
        sv:
          description: "Om personuppgifter som r\xF6r en registrerad person samlas\
            \ in fr\xE5n den registrerade, ska den personuppgiftsansvarige, n\xE4\
            r personuppgifterna erh\xE5lls, till den registrerade l\xE4mna information\
            \ om f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.a
      description: the identity and the contact details of the controller and, where
        applicable, of the controller's representative;
      translations:
        sv:
          description: "Identitet och kontaktuppgifter f\xF6r den personuppgiftsansvarige\
            \ och i till\xE4mpliga fall f\xF6r dennes f\xF6retr\xE4dare."
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.b
      description: the contact details of the data protection officer, where applicable;
      translations:
        sv:
          description: "Kontaktuppgifter f\xF6r dataskyddsombudet, i till\xE4mpliga\
            \ fall."
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.c
      description: the purposes of the processing for which the personal data are
        intended as well as the legal basis for the processing;
      translations:
        sv:
          description: "\xC4ndam\xE5len med den behandling f\xF6r vilken personuppgifterna\
            \ \xE4r avsedda samt den r\xE4ttsliga grunden f\xF6r behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.d
      description: where the processing is based on point (f) of Article 6(1), the
        legitimate interests pursued by the controller or by a third party;
      translations:
        sv:
          description: "Om behandlingen \xE4r baserad p\xE5 artikel 6.1 f, den personuppgiftsansvariges\
            \ eller en tredje parts ber\xE4ttigade intressen."
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.e
      description: the recipients or categories of recipients of the personal data,
        if any;
      translations:
        sv:
          description: "Mottagarna eller de kategorier av mottagare som ska ta del\
            \ av personuppgifterna, i\_f\xF6rekommande fall."
    - urn: urn:intuitem:risk:req_node:gdpr:13.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.1
      ref_id: 13.1.f
      description: where applicable, the fact that the controller intends to transfer
        personal data to a third country or international organisation and the existence
        or absence of an adequacy decision by the Commission, or in the case of transfers
        referred to in Article 46 or 47, or the second subparagraph of Article 49(1),
        reference to the appropriate or suitable safeguards and the means by which
        to obtain a copy of them or where they have been made available.
      translations:
        sv:
          description: "I till\xE4mpliga fall att den personuppgiftsansvarige avser\
            \ att \xF6verf\xF6ra personuppgifter till ett tredjeland eller en internationell\
            \ organisation och huruvida ett beslut av kommissionen om adekvat skyddsniv\xE5\
            \ f\xF6religger eller saknas eller, n\xE4r det g\xE4ller de \xF6verf\xF6\
            ringar som avses i artikel 46, 47 eller artikel 49.1 andra stycket, h\xE4\
            nvisning till l\xE4mpliga eller passande skydds\xE5tg\xE4rder och hur\
            \ en kopia av dem kan erh\xE5llas eller var dessa har gjorts tillg\xE4\
            ngliga."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-13
      ref_id: '13.2'
      description: 'In addition to the information referred to in paragraph 1, the
        controller shall, at the time when personal data are obtained, provide the
        data subject with the following further information necessary to ensure fair
        and transparent processing:'
      translations:
        sv:
          description: "Ut\xF6ver den information som avses i punkt 1 ska den personuppgiftsansvarige\
            \ vid insamlingen av personuppgifterna l\xE4mna den registrerade f\xF6\
            ljande ytterligare information, vilken kr\xE4vs f\xF6r att s\xE4kerst\xE4\
            lla r\xE4ttvis och transparent behandling:"
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.a
      description: the period for which the personal data will be stored, or if that
        is not possible, the criteria used to determine that period;
      translations:
        sv:
          description: "Den period under vilken personuppgifterna kommer att lagras\
            \ eller, om detta inte \xE4r m\xF6jligt, de kriterier som anv\xE4nds f\xF6\
            r att fastst\xE4lla denna period."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.b
      description: the existence of the right to request from the controller access
        to and rectification or erasure of personal data or restriction of processing
        concerning the data subject or to object to processing as well as the right
        to data portability;
      translations:
        sv:
          description: "Att det f\xF6religger en r\xE4tt att av den personuppgiftsansvarige\
            \ beg\xE4ra tillg\xE5ng till och r\xE4ttelse eller radering av personuppgifter\
            \ eller begr\xE4nsning av behandling som r\xF6r den registrerade eller\
            \ att inv\xE4nda mot behandling samt r\xE4tten till dataportabilitet."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.c
      description: where the processing is based on point (a) of Article 6(1) or point
        (a) of Article 9(2), the existence of the right to withdraw consent at any
        time, without affecting the lawfulness of processing based on consent before
        its withdrawal;
      translations:
        sv:
          description: "Om behandlingen grundar sig p\xE5 artikel 6.1 a eller artikel\
            \ 9.2 a, att det f\xF6religger en r\xE4tt att n\xE4r som helst \xE5terkalla\
            \ sitt samtycke, utan att detta p\xE5verkar lagligheten av behandlingen\
            \ p\xE5 grundval av samtycket, innan detta \xE5terkallades."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.d
      description: the right to lodge a complaint with a supervisory authority;
      translations:
        sv:
          description: "R\xE4tten att inge klagom\xE5l till en tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.e
      description: whether the provision of personal data is a statutory or contractual
        requirement, or a requirement necessary to enter into a contract, as well
        as whether the data subject is obliged to provide the personal data and of
        the possible consequences of failure to provide such data;
      translations:
        sv:
          description: "Huruvida tillhandah\xE5llandet av personuppgifter \xE4r ett\
            \ lagstadgat eller avtalsenligt krav eller ett krav som \xE4r n\xF6dv\xE4\
            ndigt f\xF6r att ing\xE5 ett avtal samt huruvida den registrerade \xE4\
            r skyldig att tillhandah\xE5lla personuppgifterna och de m\xF6jliga f\xF6\
            ljderna av att s\xE5dana uppgifter inte l\xE4mnas."
    - urn: urn:intuitem:risk:req_node:gdpr:13.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:13.2
      ref_id: 13.2.f
      description: the existence of automated decision-making, including profiling,
        referred to in Article 22(1) and (4) and, at least in those cases, meaningful
        information about the logic involved, as well as the significance and the
        envisaged consequences of such processing for the data subject.
      translations:
        sv:
          description: "F\xF6rekomsten av automatiserat beslutsfattande, inbegripet\
            \ profilering enligt artikel\_22.1 och 22.4, varvid det \xE5tminstone\
            \ i dessa fall ska l\xE4mnas meningsfull information om logiken bakom\
            \ samt betydelsen och de f\xF6rutsedda f\xF6ljderna av s\xE5dan behandling\
            \ f\xF6r den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:13.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-13
      ref_id: '13.3'
      description: Where the controller intends to further process the personal data
        for a purpose other than that for which the personal data were collected,
        the controller shall provide the data subject prior to that further processing
        with information on that other purpose and with any relevant further information
        as referred to in paragraph 2.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige avser att ytterligare behandla\
            \ personuppgifterna f\xF6r ett annat syfte \xE4n det f\xF6r vilket de\
            \ insamlades, ska den personuppgiftsansvarige f\xF6re denna ytterligare\
            \ behandling ge den registrerade information om detta andra syfte samt\
            \ ytterligare relevant information enligt punkt 2."
    - urn: urn:intuitem:risk:req_node:gdpr:13.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-13
      ref_id: '13.4'
      description: Paragraphs 1, 2 and 3 shall not apply where and insofar as the
        data subject already has the information.
      translations:
        sv:
          description: "Punkterna 1, 2 och 3 ska inte till\xE4mpas om och i den m\xE5\
            n den registrerade redan f\xF6rfogar \xF6ver informationen."
    - urn: urn:intuitem:risk:req_node:gdpr:article-14
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node310
      ref_id: Article 14
      description: Information to be provided where personal data have not been obtained
        from the data subject
      translations:
        sv:
          name: Artikel 14
          description: "Information som ska tillhandah\xE5llas om personuppgifterna\
            \ inte har erh\xE5llits fr\xE5n den registrerade"
    - urn: urn:intuitem:risk:req_node:gdpr:14.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-14
      ref_id: '14.1'
      description: 'Where personal data have not been obtained from the data subject,
        the controller shall provide the data subject with the following information:'
      translations:
        sv:
          description: "Om personuppgifterna inte har erh\xE5llits fr\xE5n den registrerade,\
            \ ska den personuppgiftsansvarige f\xF6rse den registrerade med f\xF6\
            ljande information:"
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.a
      description: the identity and the contact details of the controller and, where
        applicable, of the controller's representative;
      translations:
        sv:
          description: "Identitet och kontaktuppgifter f\xF6r den personuppgiftsansvarige\
            \ och i till\xE4mpliga fall f\xF6r dennes f\xF6retr\xE4dare."
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.b
      description: the contact details of the data protection officer, where applicable;
      translations:
        sv:
          description: "Kontaktuppgifter f\xF6r dataskyddsombudet, i till\xE4mpliga\
            \ fall."
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.c
      description: the purposes of the processing for which the personal data are
        intended as well as the legal basis for the processing;
      translations:
        sv:
          description: "\xC4ndam\xE5len med den behandling f\xF6r vilken personuppgifterna\
            \ \xE4r avsedda samt den r\xE4ttsliga grunden f\xF6r behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.d
      description: the categories of personal data concerned;
      translations:
        sv:
          description: "De kategorier av personuppgifter som behandlingen g\xE4ller."
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.e
      description: the recipients or categories of recipients of the personal data,
        if any;
      translations:
        sv:
          description: "Mottagarna eller de kategorier av mottagare som ska ta del\
            \ av personuppgifterna, i\_f\xF6rekommande fall."
    - urn: urn:intuitem:risk:req_node:gdpr:14.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.1
      ref_id: 14.1.f
      description: where applicable, that the controller intends to transfer personal
        data to a recipient in a third country or international organisation and the
        existence or absence of an adequacy decision by the Commission, or in the
        case of transfers referred to in Article 46 or 47, or the second subparagraph
        of Article 49(1), reference to the appropriate or suitable safeguards and
        the means to obtain a copy of them or where they have been made available.
      translations:
        sv:
          description: "I till\xE4mpliga fall att den personuppgiftsansvarige avser\
            \ att \xF6verf\xF6ra personuppgifter till en mottagare i ett tredjeland\
            \ eller en internationell organisation och huruvida ett beslut av kommissionen\
            \ om adekvat skyddsniv\xE5 f\xF6religger eller saknas eller, n\xE4r det\
            \ g\xE4ller de \xF6verf\xF6ringar som avses i artiklarna 46, 47 eller\
            \ artikel 49.1 andra stycket, h\xE4nvisning till l\xE4mpliga eller passande\
            \ skydds\xE5tg\xE4rder och hur en kopia av dem kan erh\xE5llas eller var\
            \ dessa har gjorts tillg\xE4ngliga."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-14
      ref_id: '14.2'
      description: 'In addition to the information referred to in paragraph 1, the
        controller shall provide the data subject with the following information necessary
        to ensure fair and transparent processing in respect of the data subject:'
      translations:
        sv:
          description: "Ut\xF6ver den information som avses i punkt 1 ska den personuppgiftsansvarige\
            \ l\xE4mna den registrerade f\xF6ljande information, vilken kr\xE4vs f\xF6\
            r att s\xE4kerst\xE4lla r\xE4ttvis och transparent behandling n\xE4r det\
            \ g\xE4ller den registrerade:"
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.a
      description: the period for which the personal data will be stored, or if that
        is not possible, the criteria used to determine that period;
      translations:
        sv:
          description: "Den period under vilken personuppgifterna kommer att lagras\
            \ eller, om detta inte \xE4r m\xF6jligt, de kriterier som anv\xE4nds f\xF6\
            r att fastst\xE4lla denna period."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.b
      description: where the processing is based on point (f) of Article 6(1), the
        legitimate interests pursued by the controller or by a third party;
      translations:
        sv:
          description: "Om behandlingen grundar sig p\xE5 artikel 6.1 f, den personuppgiftsansvariges\
            \ eller en tredje parts ber\xE4ttigade intressen."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.c
      description: the existence of the right to request from the controller access
        to and rectification or erasure of personal data or restriction of processing
        concerning the data subject and to object to processing as well as the right
        to data portability;
      translations:
        sv:
          description: "F\xF6rekomsten av r\xE4tten att av den personuppgiftsansvarige\
            \ beg\xE4ra tillg\xE5ng till och r\xE4ttelse eller radering av personuppgifter\
            \ eller begr\xE4nsning av behandling som r\xF6r den registrerade och att\
            \ inv\xE4nda mot behandling samt r\xE4tten till dataportabilitet."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.d
      description: where processing is based on point (a) of Article 6(1) or point
        (a) of Article 9(2), the existence of the right to withdraw consent at any
        time, without affecting the lawfulness of processing based on consent before
        its withdrawal;
      translations:
        sv:
          description: "Om behandlingen grundar sig p\xE5 artikel 6.1 a eller artikel\
            \ 9.2 a, r\xE4tten att n\xE4r som helst \xE5terkalla sitt samtycke, utan\
            \ att detta p\xE5verkar lagligheten av behandlingen p\xE5 grundval av\
            \ samtycket, innan detta \xE5terkallades."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.e
      description: the right to lodge a complaint with a supervisory authority;
      translations:
        sv:
          description: "R\xE4tten att inge klagom\xE5l till en tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.f
      description: from which source the personal data originate, and if applicable,
        whether it came from publicly accessible sources;
      translations:
        sv:
          description: "Varifr\xE5n personuppgifterna kommer och i f\xF6rekommande\
            \ fall huruvida de har sitt ursprung i allm\xE4nt tillg\xE4ngliga k\xE4\
            llor."
    - urn: urn:intuitem:risk:req_node:gdpr:14.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.2
      ref_id: 14.2.g
      description: the existence of automated decision-making, including profiling,
        referred to in Article 22(1) and (4) and, at least in those cases, meaningful
        information about the logic involved, as well as the significance and the
        envisaged consequences of such processing for the data subject.
      translations:
        sv:
          description: "F\xF6rekomsten av automatiserat beslutsfattande, inbegripet\
            \ profilering enligt artikel\_22.1 och 22.4, varvid det \xE5tminstone\
            \ i dessa fall ska l\xE4mnas meningsfull information om logiken bakom\
            \ samt betydelsen och de f\xF6rutsedda f\xF6ljderna av s\xE5dan behandling\
            \ f\xF6r den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:14.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-14
      ref_id: '14.3'
      description: 'The controller shall provide the information referred to in paragraphs
        1 and 2:'
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska l\xE4mna den information som\
            \ anges i punkterna 1 och 2"
    - urn: urn:intuitem:risk:req_node:gdpr:14.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.3
      ref_id: 14.3.a
      description: within a reasonable period after obtaining the personal data, but
        at the latest within one month, having regard to the specific circumstances
        in which the personal data are processed;
      translations:
        sv:
          description: "inom en rimlig period efter det att personuppgifterna har\
            \ erh\xE5llits, dock senast inom en m\xE5nad, med beaktande av de s\xE4\
            rskilda omst\xE4ndigheter under vilka personuppgifterna behandlas,"
    - urn: urn:intuitem:risk:req_node:gdpr:14.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.3
      ref_id: 14.3.b
      description: if the personal data are to be used for communication with the
        data subject, at the latest at the time of the first communication to that
        data subject; or
      translations:
        sv:
          description: "om personuppgifterna ska anv\xE4ndas f\xF6r kommunikation\
            \ med den registrerade, senast vid tidpunkten f\xF6r den f\xF6rsta kommunikationen\
            \ med den registrerade, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:14.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.3
      ref_id: 14.3.c
      description: if a disclosure to another recipient is envisaged, at the latest
        when the personal data are first disclosed.
      translations:
        sv:
          description: "om ett utl\xE4mnande till en annan mottagare f\xF6rutses,\
            \ senast n\xE4r personuppgifterna l\xE4mnas ut f\xF6r f\xF6rsta g\xE5\
            ngen."
    - urn: urn:intuitem:risk:req_node:gdpr:14.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-14
      ref_id: '14.4'
      description: Where the controller intends to further process the personal data
        for a purpose other than that for which the personal data were obtained, the
        controller shall provide the data subject prior to that further processing
        with information on that other purpose and with any relevant further information
        as referred to in paragraph 2.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige avser att ytterligare behandla\
            \ personuppgifterna f\xF6r ett annat syfte \xE4n det f\xF6r vilket de\
            \ insamlades, ska den personuppgiftsansvarige f\xF6re denna ytterligare\
            \ behandling ge den registrerade information om detta andra syfte samt\
            \ ytterligare relevant information enligt punkt 2."
    - urn: urn:intuitem:risk:req_node:gdpr:14.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-14
      ref_id: '14.5'
      description: 'Paragraphs 1 to 4 shall not apply where and insofar as:'
      translations:
        sv:
          description: "Punkterna\_1\u20134 ska inte till\xE4mpas i f\xF6ljande fall\
            \ och i den m\xE5n"
    - urn: urn:intuitem:risk:req_node:gdpr:14.5.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.5
      ref_id: 14.5.a
      description: the data subject already has the information;
      translations:
        sv:
          description: "den registrerade redan f\xF6rfogar \xF6ver informationen,"
    - urn: urn:intuitem:risk:req_node:gdpr:14.5.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.5
      ref_id: 14.5.b
      description: the provision of such information proves impossible or would involve
        a disproportionate effort, in particular for processing for archiving purposes
        in the public interest, scientific or historical research purposes or statistical
        purposes, subject to the conditions and safeguards referred to in Article
        89(1) or in so far as the obligation referred to in paragraph 1 of this Article
        is likely to render impossible or seriously impair the achievement of the
        objectives of that processing. In such cases the controller shall take appropriate
        measures to protect the data subject's rights and freedoms and legitimate
        interests, including making the information publicly available;
      translations:
        sv:
          description: "tillhandah\xE5llandet av s\xE5dan information visar sig vara\
            \ om\xF6jligt eller skulle medf\xF6ra en oproportionell anstr\xE4ngning,\
            \ s\xE4rskilt f\xF6r behandling f\xF6r arkiv\xE4ndam\xE5l av allm\xE4\
            nt intresse, vetenskapliga eller historiska forsknings\xE4ndam\xE5l eller\
            \ statistiska \xE4ndam\xE5l i\_enlighet med artikel 89.1, eller i den\
            \ m\xE5n den skyldighet som avses i punkt 1 i den h\xE4r artikeln sannolikt\
            \ kommer att g\xF6ra det om\xF6jligt eller avsev\xE4rt f\xF6rsv\xE5rar\
            \ uppfyllandet av m\xE5len med den behandlingen; i s\xE5dana fall ska\
            \ den personuppgiftsansvarige vidta l\xE4mpliga \xE5tg\xE4rder f\xF6r\
            \ att skydda den registrerades r\xE4ttigheter och friheter och ber\xE4\
            ttigade intressen, inbegripet g\xF6ra uppgifterna tillg\xE4ngliga f\xF6\
            r allm\xE4nheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:14.5.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.5
      ref_id: 14.5.c
      description: obtaining or disclosure is expressly laid down by Union or Member
        State law to which the controller is subject and which provides appropriate
        measures to protect the data subject's legitimate interests; or
      translations:
        sv:
          description: "erh\xE5llande eller utl\xE4mnande av uppgifter uttryckligen\
            \ f\xF6reskrivs genom unionsr\xE4tten eller genom en medlemsstats nationella\
            \ r\xE4tt som den registrerade omfattas av och som fastst\xE4ller l\xE4\
            mpliga \xE5tg\xE4rder f\xF6r att skydda den registrerades ber\xE4ttigade\
            \ intressen, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:14.5.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:14.5
      ref_id: 14.5.d
      description: where the personal data must remain confidential subject to an
        obligation of professional secrecy regulated by Union or Member State law,
        including a statutory obligation of secrecy.
      translations:
        sv:
          description: "personuppgifterna m\xE5ste f\xF6rbli konfidentiella till f\xF6\
            ljd av tystnadsplikt enligt unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt, inbegripet andra lagstadgade sekretessf\xF6rpliktelser."
    - urn: urn:intuitem:risk:req_node:gdpr:article-15
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node310
      ref_id: Article 15
      description: Right of access by the data subject
      translations:
        sv:
          name: Artikel 15
          description: "Den registrerades r\xE4tt till tillg\xE5ng"
    - urn: urn:intuitem:risk:req_node:gdpr:15.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-15
      ref_id: '15.1'
      description: 'The data subject shall have the right to obtain from the controller
        confirmation as to whether or not personal data concerning him or her are
        being processed, and, where that is the case, access to the personal data
        and the following information:'
      annotation: The data controller must confirm if personal data concerning the
        data subject are being processed and, if so, provide access to the data and
        the following information.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att av den personuppgiftsansvarige\
            \ f\xE5 bekr\xE4ftelse p\xE5 huruvida personuppgifter som r\xF6r honom\
            \ eller henne h\xE5ller p\xE5 att behandlas och i s\xE5 fall f\xE5 tillg\xE5\
            ng till personuppgifterna och f\xF6ljande information:"
          annotation: The data controller must confirm if personal data concerning
            the data subject are being processed and, if so, provide access to the
            data and the following information.
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.a
      description: the purposes of the processing;
      translations:
        sv:
          description: "\xC4ndam\xE5len med behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.b
      description: the categories of personal data concerned;
      translations:
        sv:
          description: "De kategorier av personuppgifter som behandlingen g\xE4ller."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.c
      description: the recipients or categories of recipient to whom the personal
        data have been or will be disclosed, in particular recipients in third countries
        or international organisations;
      translations:
        sv:
          description: "De mottagare eller kategorier av mottagare till vilka personuppgifterna\
            \ har l\xE4mnats eller ska l\xE4mnas ut, s\xE4rskilt mottagare i tredjel\xE4\
            nder eller internationella organisationer."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.d
      description: where possible, the envisaged period for which the personal data
        will be stored, or, if not possible, the criteria used to determine that period;
      translations:
        sv:
          description: "Om m\xF6jligt, den f\xF6rutsedda period under vilken personuppgifterna\
            \ kommer att lagras eller, om detta inte \xE4r m\xF6jligt, de kriterier\
            \ som anv\xE4nds f\xF6r att fastst\xE4lla denna period."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.e
      description: the existence of the right to request from the controller rectification
        or erasure of personal data or restriction of processing of personal data
        concerning the data subject or to object to such processing;
      translations:
        sv:
          description: "F\xF6rekomsten av r\xE4tten att av den personuppgiftsansvarige\
            \ beg\xE4ra r\xE4ttelse eller radering av personuppgifterna eller begr\xE4\
            nsningar av behandling av personuppgifter som r\xF6r den registrerade\
            \ eller att inv\xE4nda mot s\xE5dan behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.f
      description: the right to lodge a complaint with a supervisory authority;
      translations:
        sv:
          description: "R\xE4tten att inge klagom\xE5l till en tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.g
      description: where the personal data are not collected from the data subject,
        any available information as to their source;
      translations:
        sv:
          description: "Om personuppgifterna inte samlas in fr\xE5n den registrerade,\
            \ all tillg\xE4nglig information om varifr\xE5n dessa uppgifter kommer."
    - urn: urn:intuitem:risk:req_node:gdpr:15.1.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:15.1
      ref_id: 15.1.h
      description: the existence of automated decision-making, including profiling,
        referred to in Article 22(1) and (4) and, at least in those cases, meaningful
        information about the logic involved, as well as the significance and the
        envisaged consequences of such processing for the data subject.
      translations:
        sv:
          description: "F\xF6rekomsten av automatiserat beslutsfattande, inbegripet\
            \ profilering enligt artikel\_22.1 och 22.4, varvid det \xE5tminstone\
            \ i dessa fall ska l\xE4mnas meningsfull information om logiken bakom\
            \ samt betydelsen och de f\xF6rutsedda f\xF6ljderna av s\xE5dan behandling\
            \ f\xF6r den registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:15.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-15
      ref_id: '15.2'
      description: Where personal data are transferred to a third country or to an
        international organisation, the data subject shall have the right to be informed
        of the appropriate safeguards pursuant to Article 46 relating to the transfer.
      translations:
        sv:
          description: "Om personuppgifterna \xF6verf\xF6rs till ett tredjeland eller\
            \ till en internationell organisation, ska den registrerade ha r\xE4tt\
            \ till information om de l\xE4mpliga skydds\xE5tg\xE4rder som i enlighet\
            \ med artikel 46 har vidtagits vid \xF6verf\xF6ringen."
    - urn: urn:intuitem:risk:req_node:gdpr:15.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-15
      ref_id: '15.3'
      description: The controller shall provide a copy of the personal data undergoing
        processing. For any further copies requested by the data subject, the controller
        may charge a reasonable fee based on administrative costs. Where the data
        subject makes the request by electronic means, and unless otherwise requested
        by the data subject, the information shall be provided in a commonly used
        electronic form.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska f\xF6rse den registrerade\
            \ med en kopia av de personuppgifter som \xE4r under behandling. F\xF6\
            r eventuella ytterligare kopior som den registrerade beg\xE4r f\xE5r den\
            \ personuppgiftsansvarige ta ut en rimlig avgift p\xE5 grundval av de\
            \ administrativa kostnaderna. Om den registrerade g\xF6r beg\xE4ran i\
            \ elektronisk form ska informationen tillhandah\xE5llas i ett elektroniskt\
            \ format som \xE4r allm\xE4nt anv\xE4nt, om den registrerade inte beg\xE4\
            r n\xE5got annat."
    - urn: urn:intuitem:risk:req_node:gdpr:15.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-15
      ref_id: '15.4'
      description: The right to obtain a copy referred to in paragraph 3 shall not
        adversely affect the rights and freedoms of others.
      translations:
        sv:
          description: "Den r\xE4tt till en kopia som avses i punkt 3 ska inte inverka\
            \ menligt p\xE5 andras r\xE4ttigheter och friheter."
    - urn: urn:intuitem:risk:req_node:gdpr:node367
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      name: Section 3
      description: Rectification and erasure
      translations:
        sv:
          name: Avsnitt 3
          description: "R\xE4ttelse och radering"
    - urn: urn:intuitem:risk:req_node:gdpr:article-16
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node367
      ref_id: Article 16
      description: Right to rectification
      translations:
        sv:
          name: Artikel 16
          description: "R\xE4tt till r\xE4ttelse"
    - urn: urn:intuitem:risk:req_node:gdpr:node369
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-16
      description: The data subject shall have the right to obtain from the controller
        without undue delay the rectification of inaccurate personal data concerning
        him or her. Taking into account the purposes of the processing, the data subject
        shall have the right to have incomplete personal data completed, including
        by means of providing a supplementary statement.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att av den personuppgiftsansvarige\
            \ utan on\xF6digt dr\xF6jsm\xE5l f\xE5 felaktiga personuppgifter som r\xF6\
            r honom eller henne r\xE4ttade. Med beaktande av \xE4ndam\xE5let med behandlingen,\
            \ ska den registrerade ha r\xE4tt att komplettera ofullst\xE4ndiga personuppgifter,\
            \ bland annat genom att tillhandah\xE5lla ett kompletterande utl\xE5tande."
    - urn: urn:intuitem:risk:req_node:gdpr:article-17
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node367
      ref_id: Article 17
      description: "Right to erasure (\u2018right to be forgotten\u2019)"
      translations:
        sv:
          name: Artikel 17
          description: "R\xE4tt till radering (\u201Dr\xE4tten att bli bortgl\xF6\
            md\u201D)"
    - urn: urn:intuitem:risk:req_node:gdpr:17.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-17
      ref_id: '17.1'
      description: 'The data subject shall have the right to obtain from the controller
        the erasure of personal data concerning him or her without undue delay and
        the controller shall have the obligation to erase personal data without undue
        delay where one of the following grounds applies:'
      annotation: Set up a follow-up procedure to inform other controllers processing
        the data subject to the erasure request, as it is the duty of the data controller.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att av den personuppgiftsansvarige\
            \ utan on\xF6digt dr\xF6jsm\xE5l f\xE5 sina personuppgifter raderade och\
            \ den personuppgiftsansvarige ska vara skyldig att utan on\xF6digt dr\xF6\
            jsm\xE5l radera personuppgifter om n\xE5got av f\xF6ljande g\xE4ller:"
          annotation: Set up a follow-up procedure to inform other controllers processing
            the data subject to the erasure request, as it is the duty of the data
            controller.
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.a
      description: the personal data are no longer necessary in relation to the purposes
        for which they were collected or otherwise processed;
      annotation: Set up a follow-up procedure to inform other controllers processing
        the data subject to the erasure request, as it is the duty of the data controller.
      translations:
        sv:
          description: "Personuppgifterna \xE4r inte l\xE4ngre n\xF6dv\xE4ndiga f\xF6\
            r de \xE4ndam\xE5l f\xF6r vilka de samlats in eller p\xE5 annat s\xE4\
            tt behandlats."
          annotation: Set up a follow-up procedure to inform other controllers processing
            the data subject to the erasure request, as it is the duty of the data
            controller.
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.b
      description: the data subject withdraws consent on which the processing is based
        according to point (a) of Article 6(1), or point (a) of Article 9(2), and
        where there is no other legal ground for the processing;
      annotation: Set up a follow-up procedure to inform other controllers processing
        the data subject to the erasure request, as it is the duty of the data controller.
      translations:
        sv:
          description: "Den registrerade \xE5terkallar det samtycke p\xE5 vilket behandlingen\
            \ grundar sig enligt artikel 6.1 a eller artikel 9.2 a och det finns inte\
            \ n\xE5gon annan r\xE4ttslig grund f\xF6r behandlingen."
          annotation: Set up a follow-up procedure to inform other controllers processing
            the data subject to the erasure request, as it is the duty of the data
            controller.
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.c
      description: the data subject objects to the processing pursuant to Article
        21(1) and there are no overriding legitimate grounds for the processing, or
        the data subject objects to the processing pursuant to Article 21(2);
      translations:
        sv:
          description: "Den registrerade inv\xE4nder mot behandlingen i enlighet med\
            \ artikel\_21.1 och det saknas ber\xE4ttigade sk\xE4l f\xF6r behandlingen\
            \ som v\xE4ger tyngre, eller den registrerade inv\xE4nder mot behandlingen\
            \ i enlighet med artikel 21.2."
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.d
      description: the personal data have been unlawfully processed;
      translations:
        sv:
          description: "Personuppgifterna har behandlats p\xE5 olagligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.e
      description: the personal data have to be erased for compliance with a legal
        obligation in Union or Member State law to which the controller is subject;
      translations:
        sv:
          description: "Personuppgifterna m\xE5ste raderas f\xF6r att uppfylla en\
            \ r\xE4ttslig f\xF6rpliktelse i unionsr\xE4tten eller i medlemsstaternas\
            \ nationella r\xE4tt som den personuppgiftsansvarige omfattas av."
    - urn: urn:intuitem:risk:req_node:gdpr:17.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.1
      ref_id: 17.1.f
      description: the personal data have been collected in relation to the offer
        of information society services referred to in Article 8(1).
      translations:
        sv:
          description: "Personuppgifterna har samlats in i samband med erbjudande\
            \ av informationssamh\xE4llets tj\xE4nster, i de fall som avses i artikel\
            \ 8.1."
    - urn: urn:intuitem:risk:req_node:gdpr:17.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-17
      ref_id: '17.2'
      description: Where the controller has made the personal data public and is obliged
        pursuant to paragraph 1 to erase the personal data, the controller, taking
        account of available technology and the cost of implementation, shall take
        reasonable steps, including technical measures, to inform controllers which
        are processing the personal data that the data subject has requested the erasure
        by such controllers of any links to, or copy or replication of, those personal
        data.
      annotation: 'To implement measures to ensure that these links are not accessible
        from within the EU, if necessary.


        In the judgment of the Court of Justice of the European Union (CJEU) in the
        case of Google v. CNIL (2019) C-507/17, it is stated that the judge or the
        data protection authority may order the search engine operator to delist the
        result on the national extensions of the search engine but also, if necessary,
        on all the extensions of the digital territories of all EU member states.'
      translations:
        sv:
          description: "Om den personuppgiftsansvarige har offentliggjort personuppgifterna\
            \ och enligt punkt 1 \xE4r skyldig att radera personuppgifterna, ska den\
            \ personuppgiftsansvarige med beaktande av tillg\xE4nglig teknik och kostnaden\
            \ f\xF6r genomf\xF6randet vidta rimliga \xE5tg\xE4rder, inbegripet tekniska\
            \ \xE5tg\xE4rder, f\xF6r att underr\xE4tta personuppgiftsansvariga som\
            \ behandlar personuppgifterna om att den registrerade har beg\xE4rt att\
            \ de ska radera eventuella l\xE4nkar till, eller kopior eller reproduktioner\
            \ av dessa personuppgifter."
          annotation: 'To implement measures to ensure that these links are not accessible
            from within the EU, if necessary.


            In the judgment of the Court of Justice of the European Union (CJEU) in
            the case of Google v. CNIL (2019) C-507/17, it is stated that the judge
            or the data protection authority may order the search engine operator
            to delist the result on the national extensions of the search engine but
            also, if necessary, on all the extensions of the digital territories of
            all EU member states.'
    - urn: urn:intuitem:risk:req_node:gdpr:17.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-17
      ref_id: '17.3'
      description: 'Paragraphs 1 and 2 shall not apply to the extent that processing
        is necessary:'
      translations:
        sv:
          description: "Punkterna 1 och 2 ska inte g\xE4lla i den utstr\xE4ckning\
            \ som behandlingen \xE4r n\xF6dv\xE4ndig av f\xF6ljande sk\xE4l:"
    - urn: urn:intuitem:risk:req_node:gdpr:17.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.3
      ref_id: 17.3.a
      description: for exercising the right of freedom of expression and information;
      translations:
        sv:
          description: "F\xF6r att ut\xF6va r\xE4tten till yttrande- och informationsfrihet."
    - urn: urn:intuitem:risk:req_node:gdpr:17.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.3
      ref_id: 17.3.b
      description: for compliance with a legal obligation which requires processing
        by Union or Member State law to which the controller is subject or for the
        performance of a task carried out in the public interest or in the exercise
        of official authority vested in the controller;
      translations:
        sv:
          description: "F\xF6r att uppfylla en r\xE4ttslig f\xF6rpliktelse som kr\xE4\
            ver behandling enligt unionsr\xE4tten eller enligt en medlemsstats nationella\
            \ r\xE4tt som den personuppgiftsansvarige omfattas av eller f\xF6r att\
            \ utf\xF6ra en uppgift av allm\xE4nt intresse eller som \xE4r ett led\
            \ i\_myndighetsut\xF6vning som utf\xF6rs av den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:17.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.3
      ref_id: 17.3.c
      description: for reasons of public interest in the area of public health in
        accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
      translations:
        sv:
          description: "F\xF6r sk\xE4l som r\xF6r ett viktigt allm\xE4nt intresse\
            \ p\xE5 folkh\xE4lsoomr\xE5det enligt artikel\_9.2\_h\_och\_i samt artikel\
            \ 9.3."
    - urn: urn:intuitem:risk:req_node:gdpr:17.3.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.3
      ref_id: 17.3.d
      description: for archiving purposes in the public interest, scientific or historical
        research purposes or statistical purposes in accordance with Article 89(1)
        in so far as the right referred to in paragraph 1 is likely to render impossible
        or seriously impair the achievement of the objectives of that processing;
        or
      translations:
        sv:
          description: "F\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga\
            \ eller historiska forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5\
            l enligt artikel 89.1, i den utstr\xE4ckning som den r\xE4tt som avses\
            \ i punkt 1 sannolikt om\xF6jligg\xF6r eller avsev\xE4rt f\xF6rsv\xE5\
            rar uppn\xE5endet av syftet med den behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:17.3.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:17.3
      ref_id: 17.3.e
      description: for the establishment, exercise or defence of legal claims.
      translations:
        sv:
          description: "F\xF6r att kunna fastst\xE4lla, g\xF6ra g\xE4llande eller\
            \ f\xF6rsvara r\xE4ttsliga anspr\xE5k."
    - urn: urn:intuitem:risk:req_node:gdpr:article-18
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node367
      ref_id: Article 18
      description: Right to restriction of processing
      translations:
        sv:
          name: Artikel 18
          description: "R\xE4tt till begr\xE4nsning av behandling"
    - urn: urn:intuitem:risk:req_node:gdpr:18.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-18
      ref_id: '18.1'
      description: 'The data subject shall have the right to obtain from the controller
        restriction of processing where one of the following applies:'
      annotation: The controller must comply with the data restriction request.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att av den personuppgiftsansvarige\
            \ kr\xE4va att behandlingen begr\xE4nsas om n\xE5got av f\xF6ljande alternativ\
            \ \xE4r till\xE4mpligt:"
          annotation: The controller must comply with the data restriction request.
    - urn: urn:intuitem:risk:req_node:gdpr:18.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:18.1
      ref_id: 18.1.a
      description: the accuracy of the personal data is contested by the data subject,
        for a period enabling the controller to verify the accuracy of the personal
        data;
      translations:
        sv:
          description: "Den registrerade bestrider personuppgifternas korrekthet,\
            \ under en tid som ger den personuppgiftsansvarige m\xF6jlighet att kontrollera\
            \ om personuppgifterna \xE4r korrekta."
    - urn: urn:intuitem:risk:req_node:gdpr:18.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:18.1
      ref_id: 18.1.b
      description: the processing is unlawful and the data subject opposes the erasure
        of the personal data and requests the restriction of their use instead;
      translations:
        sv:
          description: "Behandlingen \xE4r olaglig och den registrerade mots\xE4tter\
            \ sig att personuppgifterna raderas och i st\xE4llet beg\xE4r en begr\xE4\
            nsning av deras anv\xE4ndning."
    - urn: urn:intuitem:risk:req_node:gdpr:18.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:18.1
      ref_id: 18.1.c
      description: the controller no longer needs the personal data for the purposes
        of the processing, but they are required by the data subject for the establishment,
        exercise or defence of legal claims;
      translations:
        sv:
          description: "Den personuppgiftsansvarige beh\xF6ver inte l\xE4ngre personuppgifterna\
            \ f\xF6r \xE4ndam\xE5len med behandlingen men den registrerade beh\xF6\
            ver dem f\xF6r att kunna fastst\xE4lla, g\xF6ra g\xE4llande eller f\xF6\
            rsvara r\xE4ttsliga anspr\xE5k."
    - urn: urn:intuitem:risk:req_node:gdpr:18.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:18.1
      ref_id: 18.1.d
      description: the data subject has objected to processing pursuant to Article
        21(1) pending the verification whether the legitimate grounds of the controller
        override those of the data subject.
      translations:
        sv:
          description: "Den registrerade har inv\xE4nt mot behandling i enlighet med\
            \ artikel\_21.1 i\_v\xE4ntan p\xE5 kontroll av huruvida den personuppgiftsansvariges\
            \ ber\xE4ttigade sk\xE4l v\xE4ger tyngre \xE4n den registrerades ber\xE4\
            ttigade sk\xE4l."
    - urn: urn:intuitem:risk:req_node:gdpr:18.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-18
      ref_id: '18.2'
      description: Where processing has been restricted under paragraph 1, such personal
        data shall, with the exception of storage, only be processed with the data
        subject's consent or for the establishment, exercise or defence of legal claims
        or for the protection of the rights of another natural or legal person or
        for reasons of important public interest of the Union or of a Member State.
      translations:
        sv:
          description: "Om behandlingen har begr\xE4nsats i enlighet med punkt 1 f\xE5\
            r s\xE5dana personuppgifter, med undantag f\xF6r lagring, endast behandlas\
            \ med den registrerades samtycke eller f\xF6r att fastst\xE4lla, g\xF6\
            ra g\xE4llande eller f\xF6rsvara r\xE4ttsliga anspr\xE5k eller f\xF6r\
            \ att skydda n\xE5gon annan fysisk eller juridisk persons r\xE4ttigheter\
            \ eller f\xF6r sk\xE4l som r\xF6r ett viktigt allm\xE4nintresse f\xF6\
            r unionen eller f\xF6r en medlemsstat."
    - urn: urn:intuitem:risk:req_node:gdpr:18.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-18
      ref_id: '18.3'
      description: A data subject who has obtained restriction of processing pursuant
        to paragraph 1 shall be informed by the controller before the restriction
        of processing is lifted.
      translations:
        sv:
          description: "En registrerad som har f\xE5tt behandling begr\xE4nsad i enlighet\
            \ med punkt 1 ska underr\xE4ttas av den personuppgiftsansvarige innan\
            \ begr\xE4nsningen av behandlingen upph\xF6r."
    - urn: urn:intuitem:risk:req_node:gdpr:article-19
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node367
      ref_id: Article 19
      description: Notification obligation regarding rectification or erasure of personal
        data or restriction of processing
      translations:
        sv:
          name: Artikel 19
          description: "Anm\xE4lningsskyldighet avseende r\xE4ttelse eller radering\
            \ av personuppgifter och begr\xE4nsning av behandling"
    - urn: urn:intuitem:risk:req_node:gdpr:node394
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-19
      description: The controller shall communicate any rectification or erasure of
        personal data or restriction of processing carried out in accordance with
        Article 16, Article 17(1) and Article 18 to each recipient to whom the personal
        data have been disclosed, unless this proves impossible or involves disproportionate
        effort. The controller shall inform the data subject about those recipients
        if the data subject requests it.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska underr\xE4tta varje mottagare\
            \ till vilken personuppgifterna har l\xE4mnats ut om eventuella r\xE4\
            ttelser eller radering av personuppgifter eller begr\xE4nsningar av behandling\
            \ som skett i enlighet med artiklarna 16, 17.1 och 18, om inte detta visar\
            \ sig vara om\xF6jligt eller medf\xF6ra en oproportionell anstr\xE4ngning.\
            \ Den personuppgiftsansvarige ska informera den registrerade om dessa\
            \ mottagare p\xE5 den registrerades beg\xE4ran."
    - urn: urn:intuitem:risk:req_node:gdpr:article-20
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node367
      ref_id: Article 20
      description: Right to data portability
      translations:
        sv:
          name: Artikel 20
          description: "R\xE4tt till dataportabilitet"
    - urn: urn:intuitem:risk:req_node:gdpr:20.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-20
      ref_id: '20.1'
      description: 'The data subject shall have the right to receive the personal
        data concerning him or her, which he or she has provided to a controller,
        in a structured, commonly used and machine-readable format and have the right
        to transmit those data to another controller without hindrance from the controller
        to which the personal data have been provided, where:'
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att f\xE5 ut de personuppgifter\
            \ som r\xF6r honom eller henne och som han eller hon har tillhandah\xE5\
            llit den personuppgiftsansvarige i ett strukturerat, allm\xE4nt anv\xE4\
            nt och maskinl\xE4sbart format och ha r\xE4tt att \xF6verf\xF6ra dessa\
            \ uppgifter till en annan personuppgiftsansvarig utan att den personuppgiftsansvarige\
            \ som tillhandah\xE5llits personuppgifterna hindrar detta, om"
    - urn: urn:intuitem:risk:req_node:gdpr:20.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:20.1
      ref_id: 20.1.a
      description: the processing is based on consent pursuant to point (a) of Article
        6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of
        Article 6(1); and
      translations:
        sv:
          description: "behandlingen grundar sig p\xE5 samtycke enligt artikel 6.1\
            \ a eller artikel 9.2 a eller p\xE5 ett avtal enligt artikel 6.1 b, och"
    - urn: urn:intuitem:risk:req_node:gdpr:20.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:20.1
      ref_id: 20.1.b
      description: the processing is carried out by automated means.
      translations:
        sv:
          description: behandlingen sker automatiserat.
    - urn: urn:intuitem:risk:req_node:gdpr:20.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-20
      ref_id: '20.2'
      description: In exercising his or her right to data portability pursuant to
        paragraph 1, the data subject shall have the right to have the personal data
        transmitted directly from one controller to another, where technically feasible.
      translations:
        sv:
          description: "Vid ut\xF6vandet av sin r\xE4tt till dataportabilitet i enlighet\
            \ med punkt 1 ska den registrerade ha r\xE4tt till \xF6verf\xF6ring av\
            \ personuppgifterna direkt fr\xE5n en personuppgiftsansvarig till en annan,\
            \ n\xE4r detta \xE4r tekniskt m\xF6jligt."
    - urn: urn:intuitem:risk:req_node:gdpr:20.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-20
      ref_id: '20.3'
      description: The exercise of the right referred to in paragraph 1 of this Article
        shall be without prejudice to Article 17. That right shall not apply to processing
        necessary for the performance of a task carried out in the public interest
        or in the exercise of official authority vested in the controller.
      translations:
        sv:
          description: "Ut\xF6vandet av den r\xE4tt som avses i punkt 1 i den h\xE4\
            r artikeln ska inte p\xE5verka till\xE4mpningen av artikel 17. Den r\xE4\
            tten ska inte g\xE4lla i fr\xE5ga om en behandling som \xE4r n\xF6dv\xE4\
            ndig f\xF6r att utf\xF6ra en uppgift av allm\xE4nt intresse eller som\
            \ \xE4r ett led i myndighetsut\xF6vning som utf\xF6rs av den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:20.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-20
      ref_id: '20.4'
      description: The right referred to in paragraph 1 shall not adversely affect
        the rights and freedoms of others.
      translations:
        sv:
          description: "Den r\xE4tt som avses i punkt 1 f\xE5r inte p\xE5verka andras\
            \ r\xE4ttigheter och friheter p\xE5 ett ogynnsamt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:node402
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      name: Section 4
      description: Right to object and automated individual decision-making
      translations:
        sv:
          name: Avsnitt 4
          description: "R\xE4tt att g\xF6ra inv\xE4ndningar och automatiserat individuellt\
            \ beslutsfattande"
    - urn: urn:intuitem:risk:req_node:gdpr:article-21
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node402
      ref_id: Article 21
      description: Right to object
      translations:
        sv:
          name: Artikel 21
          description: "R\xE4tt att g\xF6ra inv\xE4ndningar"
    - urn: urn:intuitem:risk:req_node:gdpr:21.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.1'
      description: The data subject shall have the right to object, on grounds relating
        to his or her particular situation, at any time to processing of personal
        data concerning him or her which is based on point (e) or (f) of Article 6(1),
        including profiling based on those provisions. The controller shall no longer
        process the personal data unless the controller demonstrates compelling legitimate
        grounds for the processing which override the interests, rights and freedoms
        of the data subject or for the establishment, exercise or defence of legal
        claims.
      translations:
        sv:
          description: "Den registrerade ska, av sk\xE4l som h\xE4nf\xF6r sig till\
            \ hans eller hennes specifika situation, ha r\xE4tt att n\xE4r som helst\
            \ g\xF6ra inv\xE4ndningar mot behandling av personuppgifter avseende honom\
            \ eller henne som grundar sig p\xE5 artikel 6.1 e eller f, inbegripet\
            \ profilering som grundar sig p\xE5 dessa best\xE4mmelser. Den personuppgiftsansvarige\
            \ f\xE5r inte l\xE4ngre behandla personuppgifterna s\xE5vida denne inte\
            \ kan p\xE5visa tvingande ber\xE4ttigade sk\xE4l f\xF6r behandlingen som\
            \ v\xE4ger tyngre \xE4n den registrerades intressen, r\xE4ttigheter och\
            \ friheter eller om det sker f\xF6r fastst\xE4llande, ut\xF6vande eller\
            \ f\xF6rsvar av r\xE4ttsliga anspr\xE5k."
    - urn: urn:intuitem:risk:req_node:gdpr:21.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.2'
      description: Where personal data are processed for direct marketing purposes,
        the data subject shall have the right to object at any time to processing
        of personal data concerning him or her for such marketing, which includes
        profiling to the extent that it is related to such direct marketing.
      translations:
        sv:
          description: "Om personuppgifterna behandlas f\xF6r direkt marknadsf\xF6\
            ring ska den registrerade ha r\xE4tt att n\xE4r som helst inv\xE4nda mot\
            \ behandling av personuppgifter som avser honom eller henne f\xF6r s\xE5\
            dan marknadsf\xF6ring, vilket inkluderar profilering i den utstr\xE4ckning\
            \ som denna har ett samband med s\xE5dan direkt marknadsf\xF6ring."
    - urn: urn:intuitem:risk:req_node:gdpr:21.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.3'
      description: Where the data subject objects to processing for direct marketing
        purposes, the personal data shall no longer be processed for such purposes.
      translations:
        sv:
          description: "Om den registrerade inv\xE4nder mot behandling f\xF6r direkt\
            \ marknadsf\xF6ring ska personuppgifterna inte l\xE4ngre behandlas f\xF6\
            r s\xE5dana \xE4ndam\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:21.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.4'
      description: At the latest at the time of the first communication with the data
        subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought
        to the attention of the data subject and shall be presented clearly and separately
        from any other information.
      translations:
        sv:
          description: "Senast vid den f\xF6rsta kommunikationen med den registrerade\
            \ ska den r\xE4tt som avses i\_punkterna 1 och 2 uttryckligen meddelas\
            \ den registrerade och redovisas tydligt, klart och \xE5tskilt fr\xE5\
            n eventuell annan information."
    - urn: urn:intuitem:risk:req_node:gdpr:21.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.5'
      description: In the context of the use of information society services, and
        notwithstanding Directive 2002/58/EC, the data subject may exercise his or
        her right to object by automated means using technical specifications.
      translations:
        sv:
          description: "N\xE4r det g\xE4ller anv\xE4ndningen av informationssamh\xE4\
            llets tj\xE4nster, och trots vad som s\xE4gs i direktiv 2002/58/EG, f\xE5\
            r den registrerade ut\xF6va sin r\xE4tt att g\xF6ra inv\xE4ndningar p\xE5\
            \ automatiserat s\xE4tt med anv\xE4ndning av tekniska specifikationer."
    - urn: urn:intuitem:risk:req_node:gdpr:21.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-21
      ref_id: '21.6'
      description: Where personal data are processed for scientific or historical
        research purposes or statistical purposes pursuant to Article 89(1), the data
        subject, on grounds relating to his or her particular situation, shall have
        the right to object to processing of personal data concerning him or her,
        unless the processing is necessary for the performance of a task carried out
        for reasons of public interest.
      translations:
        sv:
          description: "Om personuppgifter behandlas f\xF6r vetenskapliga eller historiska\
            \ forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5l i enlighet med\
            \ artikel 89.1 ska den registrerade, av sk\xE4l som h\xE4nf\xF6r sig till\
            \ hans eller hennes specifika situation, ha r\xE4tt att g\xF6ra inv\xE4\
            ndningar mot behandling av personuppgifter avseende honom eller henne\
            \ om inte behandlingen \xE4r n\xF6dv\xE4ndig f\xF6r att utf\xF6ra en uppgift\
            \ av allm\xE4nt intresse."
    - urn: urn:intuitem:risk:req_node:gdpr:article-22
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node402
      ref_id: Article 22
      description: Automated individual decision-making, including profiling
      translations:
        sv:
          name: Artikel 22
          description: Automatiserat individuellt beslutsfattande, inbegripet profilering
    - urn: urn:intuitem:risk:req_node:gdpr:22.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-22
      ref_id: '22.1'
      description: The data subject shall have the right not to be subject to a decision
        based solely on automated processing, including profiling, which produces
        legal effects concerning him or her or similarly significantly affects him
        or her.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att inte bli f\xF6rem\xE5\
            l f\xF6r ett beslut som enbart grundas p\xE5 automatiserad behandling,\
            \ inbegripet profilering, vilket har r\xE4ttsliga f\xF6ljder f\xF6r honom\
            \ eller henne eller p\xE5 liknande s\xE4tt i betydande grad p\xE5verkar\
            \ honom eller henne."
    - urn: urn:intuitem:risk:req_node:gdpr:22.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-22
      ref_id: '22.2'
      description: 'Paragraph 1 shall not apply if the decision:'
      translations:
        sv:
          description: "Punkt 1 ska inte till\xE4mpas om beslutet"
    - urn: urn:intuitem:risk:req_node:gdpr:22.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:22.2
      ref_id: 22.2.a
      description: is necessary for entering into, or performance of, a contract between
        the data subject and a data controller;
      translations:
        sv:
          description: "\xE4r n\xF6dv\xE4ndigt f\xF6r ing\xE5ende eller fullg\xF6\
            rande av ett avtal mellan den registrerade och den personuppgiftsansvarige,"
    - urn: urn:intuitem:risk:req_node:gdpr:22.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:22.2
      ref_id: 22.2.b
      description: is authorised by Union or Member State law to which the controller
        is subject and which also lays down suitable measures to safeguard the data
        subject's rights and freedoms and legitimate interests; or
      translations:
        sv:
          description: "till\xE5ts enligt unionsr\xE4tten eller en medlemsstats nationella\
            \ r\xE4tt som den personuppgiftsansvarige omfattas av och som fastst\xE4\
            ller l\xE4mpliga \xE5tg\xE4rder till skydd f\xF6r den registrerades r\xE4\
            ttigheter, friheter och ber\xE4ttigade intressen, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:22.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:22.2
      ref_id: 22.2.c
      description: is based on the data subject's explicit consent.
      translations:
        sv:
          description: "grundar sig p\xE5 den registrerades uttryckliga samtycke."
    - urn: urn:intuitem:risk:req_node:gdpr:22.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-22
      ref_id: '22.3'
      description: In the cases referred to in points (a) and (c) of paragraph 2,
        the data controller shall implement suitable measures to safeguard the data
        subject's rights and freedoms and legitimate interests, at least the right
        to obtain human intervention on the part of the controller, to express his
        or her point of view and to contest the decision.
      annotation: To implement systems and technical processes that allow individuals
        to exercise their right to object in an automated manner.
      translations:
        sv:
          description: "I fall som avses i punkt 2\_a och c ska den personuppgiftsansvarige\
            \ genomf\xF6ra l\xE4mpliga \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla\
            \ den registrerades r\xE4ttigheter, friheter och r\xE4ttsliga intressen,\
            \ \xE5tminstone r\xE4tten till personlig kontakt med den personuppgiftsansvarige\
            \ f\xF6r att kunna utrycka sin \xE5sikt och bestrida beslutet."
          annotation: To implement systems and technical processes that allow individuals
            to exercise their right to object in an automated manner.
    - urn: urn:intuitem:risk:req_node:gdpr:22.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-22
      ref_id: '22.4'
      description: Decisions referred to in paragraph 2 shall not be based on special
        categories of personal data referred to in Article 9(1), unless point (a)
        or (g) of Article 9(2) applies and suitable measures to safeguard the data
        subject's rights and freedoms and legitimate interests are in place.
      translations:
        sv:
          description: "Beslut enligt punkt 2 f\xE5r inte grunda sig p\xE5 de s\xE4\
            rskilda kategorier av personuppgifter som avses i artikel 9.1, s\xE5vida\
            \ inte artikel 9.2\_a eller g g\xE4ller och l\xE4mpliga \xE5tg\xE4rder\
            \ som ska skydda den registrerades ber\xE4ttigade intressen har vidtagits."
    - urn: urn:intuitem:risk:req_node:gdpr:node418
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iii
      name: Section 5
      description: Restrictions
      translations:
        sv:
          name: Avsnitt 5
          description: "Begr\xE4nsningar"
    - urn: urn:intuitem:risk:req_node:gdpr:article-23
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node418
      ref_id: Article 23
      description: Restrictions
      translations:
        sv:
          name: Artikel 23
          description: "Begr\xE4nsningar"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-23
      ref_id: '23.1'
      description: 'Union or Member State law to which the data controller or processor
        is subject may restrict by way of a legislative measure the scope of the obligations
        and rights provided for in Articles 12 to 22 and Article 34, as well as Article
        5 in so far as its provisions correspond to the rights and obligations provided
        for in Articles 12 to 22, when such a restriction respects the essence of
        the fundamental rights and freedoms and is a necessary and proportionate measure
        in a democratic society to safeguard:'
      translations:
        sv:
          description: "Det ska vara m\xF6jligt att i unionsr\xE4tten eller i en medlemsstats\
            \ nationella r\xE4tt som den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det omfattas av inf\xF6ra en lagstiftnings\xE5tg\xE4rd som begr\xE4nsar\
            \ till\xE4mpningsomr\xE5det f\xF6r de skyldigheter och r\xE4ttigheter\
            \ som f\xF6reskrivs i\_artiklarna\_12\u201322 och 34, samt artikel 5 i\
            \ den m\xE5n dess best\xE4mmelser motsvarar de r\xE4ttigheter och skyldigheter\
            \ som fastst\xE4lls i artiklarna 12\u201322, om en s\xE5dan begr\xE4nsning\
            \ sker med respekt f\xF6r andemeningen i de grundl\xE4ggande r\xE4ttigheterna\
            \ och friheterna och utg\xF6r en n\xF6dv\xE4ndig och proportionell \xE5\
            tg\xE4rd i ett demokratiskt samh\xE4lle i syfte att s\xE4kerst\xE4lla"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.a
      description: national security;
      translations:
        sv:
          description: "den nationella s\xE4kerheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.b
      description: defence;
      translations:
        sv:
          description: "f\xF6rsvaret,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.c
      description: public security;
      translations:
        sv:
          description: "den allm\xE4nna s\xE4kerheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.d
      description: the prevention, investigation, detection or prosecution of criminal
        offences or the execution of criminal penalties, including the safeguarding
        against and the prevention of threats to public security;
      translations:
        sv:
          description: "f\xF6rebyggande, f\xF6rhindrande, utredning, avsl\xF6jande\
            \ eller lagf\xF6ring av brott eller verkst\xE4llande av straffr\xE4ttsliga\
            \ sanktioner, inbegripet skydd mot samt f\xF6rebyggande och f\xF6rhindrande\
            \ av hot mot den allm\xE4nna s\xE4kerheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.e
      description: other important objectives of general public interest of the Union
        or of a Member State, in particular an important economic or financial interest
        of the Union or of a Member State, including monetary, budgetary and taxation
        a matters, public health and social security;
      translations:
        sv:
          description: "andra av unionens eller en medlemsstats viktiga m\xE5l av\
            \ generellt allm\xE4nt intresse, s\xE4rskilt ett av unionens eller en\
            \ medlemsstats viktiga ekonomiska eller finansiella intressen, d\xE4ribland\
            \ penning-, budget- eller skattefr\xE5gor, folkh\xE4lsa och social trygghet,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.f
      description: the protection of judicial independence and judicial proceedings;
      translations:
        sv:
          description: "skydd av r\xE4ttsv\xE4sendets oberoende och r\xE4ttsliga \xE5\
            tg\xE4rder,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.g
      description: the prevention, investigation, detection and prosecution of breaches
        of ethics for regulated professions;
      translations:
        sv:
          description: "f\xF6rebyggande, f\xF6rhindrande, utredning, avsl\xF6jande\
            \ och lagf\xF6ring av \xF6vertr\xE4delser av etiska regler som g\xE4ller\
            \ f\xF6r lagreglerade yrken,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.h
      description: a monitoring, inspection or regulatory function connected, even
        occasionally, to the exercise of official authority in the cases referred
        to in points (a) to (e) and (g);
      translations:
        sv:
          description: "en tillsyns-, inspektions- eller regleringsfunktion som, \xE4\
            ven i enstaka fall, har samband med myndighetsut\xF6vning i fall som n\xE4\
            mns i a\u2013e och g,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.i
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.i
      description: the protection of the data subject or the rights and freedoms of
        others;
      translations:
        sv:
          description: "skydd av den registrerade eller andras r\xE4ttigheter och\
            \ friheter,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.1.j
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.1
      ref_id: 23.1.j
      description: the enforcement of civil law claims.
      translations:
        sv:
          description: "verkst\xE4llighet av civilr\xE4ttsliga krav."
    - urn: urn:intuitem:risk:req_node:gdpr:23.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-23
      ref_id: '23.2'
      description: 'In particular, any legislative measure referred to in paragraph
        1 shall contain specific provisions at least, where relevant, as to:'
      translations:
        sv:
          description: "Framf\xF6r allt ska alla lagstiftnings\xE5tg\xE4rder som avses\
            \ i punkt 1 inneh\xE5lla specifika best\xE4mmelser \xE5tminstone, n\xE4\
            r s\xE5 \xE4r relevant, avseende"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.a
      description: the purposes of the processing or categories of processing;
      translations:
        sv:
          description: "\xE4ndam\xE5len med behandlingen eller kategorierna av behandling,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.b
      description: the categories of personal data;
      translations:
        sv:
          description: kategorierna av personuppgifter,
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.c
      description: the scope of the restrictions introduced;
      translations:
        sv:
          description: "omfattningen av de inf\xF6rda begr\xE4nsningarna,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.d
      description: the safeguards to prevent abuse or unlawful access or transfer;
      translations:
        sv:
          description: "skydds\xE5tg\xE4rder f\xF6r att f\xF6rhindra missbruk eller\
            \ olaglig tillg\xE5ng eller \xF6verf\xF6ring,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.e
      description: the specification of the controller or categories of controllers;
      translations:
        sv:
          description: specificeringen av den personuppgiftsansvarige eller kategorierna
            av personuppgiftsansvariga,
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.f
      description: the storage periods and the applicable safeguards taking into account
        the nature, scope and purposes of the processing or categories of processing;
      translations:
        sv:
          description: "lagringstiden samt till\xE4mpliga skydds\xE5tg\xE4rder med\
            \ beaktande av behandlingens art, omfattning och \xE4ndam\xE5l eller kategorierna\
            \ av behandling,"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.g
      description: the risks to the rights and freedoms of data subjects; and
      translations:
        sv:
          description: "riskerna f\xF6r de registrerades r\xE4ttigheter och friheter,\
            \ och"
    - urn: urn:intuitem:risk:req_node:gdpr:23.2.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:23.2
      ref_id: 23.2.h
      description: the right of data subjects to be informed about the restriction,
        unless that may be prejudicial to the purpose of the restriction.
      translations:
        sv:
          description: "de registrerades r\xE4tt att bli informerade om begr\xE4nsningen,\
            \ s\xE5vida detta inte kan inverka menligt p\xE5 begr\xE4nsningen."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      assessable: false
      depth: 1
      ref_id: CHAPTER IV
      description: Controller and processor
      translations:
        sv:
          name: KAPITEL IV
          description: "Personuppgiftsansvarig och personuppgiftsbitr\xE4de"
    - urn: urn:intuitem:risk:req_node:gdpr:node441
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      name: Section 1
      description: General obligations
      translations:
        sv:
          name: Avsnitt 1
          description: "Allm\xE4nna skyldigheter"
    - urn: urn:intuitem:risk:req_node:gdpr:article-24
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 24
      description: Responsibility of the controller
      translations:
        sv:
          name: Artikel 24
          description: Den personuppgiftsansvariges ansvar
    - urn: urn:intuitem:risk:req_node:gdpr:24.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-24
      ref_id: '24.1'
      description: Taking into account the nature, scope, context and purposes of
        processing as well as the risks of varying likelihood and severity for the
        rights and freedoms of natural persons, the controller shall implement appropriate
        technical and organisational measures to ensure and to be able to demonstrate
        that processing is performed in accordance with this Regulation. Those measures
        shall be reviewed and updated where necessary.
      annotation: 'Here is the link for the Guidelines 07/2020 on the concepts of
        controller and processor in the GDPR.

        Adopted on 07 July 2021 (Version 2.1)

        https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf'
      translations:
        sv:
          description: "Med beaktande av behandlingens art, omfattning, sammanhang\
            \ och \xE4ndam\xE5l samt riskerna, av varierande sannolikhetsgrad och\
            \ allvar, f\xF6r fysiska personers r\xE4ttigheter och friheter ska den\
            \ personuppgiftsansvarige genomf\xF6ra l\xE4mpliga tekniska och organisatoriska\
            \ \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla och kunna visa att behandlingen\
            \ utf\xF6rs i enlighet med denna f\xF6rordning. Dessa \xE5tg\xE4rder ska\
            \ ses \xF6ver och uppdateras vid behov."
          annotation: 'Here is the link for the Guidelines 07/2020 on the concepts
            of controller and processor in the GDPR.

            Adopted on 07 July 2021 (Version 2.1)

            https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf'
    - urn: urn:intuitem:risk:req_node:gdpr:24.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-24
      ref_id: '24.2'
      description: Where proportionate in relation to processing activities, the measures
        referred to in paragraph 1 shall include the implementation of appropriate
        data protection policies by the controller.
      translations:
        sv:
          description: "Om det st\xE5r i proportion till behandlingen, ska de \xE5\
            tg\xE4rder som avses i punkt 1 omfatta den personuppgiftsansvariges genomf\xF6\
            rande av l\xE4mpliga strategier f\xF6r dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:24.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-24
      ref_id: '24.3'
      description: Adherence to approved codes of conduct as referred to in Article
        40 or approved certification mechanisms as referred to in Article 42 may be
        used as an element by which to demonstrate compliance with the obligations
        of the controller.
      translations:
        sv:
          description: "Till\xE4mpningen av godk\xE4nda uppf\xF6randekoder som avses\
            \ i artikel 40 eller godk\xE4nda certifieringsmekanismer som avses i artikel\
            \ 42 f\xE5r anv\xE4ndas f\xF6r att visa att den personuppgiftsansvarige\
            \ fullg\xF6r sina skyldigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:article-25
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 25
      description: Data protection by design and by default
      translations:
        sv:
          name: Artikel 25
          description: Inbyggt dataskydd och dataskydd som standard
    - urn: urn:intuitem:risk:req_node:gdpr:25.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-25
      ref_id: '25.1'
      description: Taking into account the state of the art, the cost of implementation
        and the nature, scope, context and purposes of processing as well as the risks
        of varying likelihood and severity for rights and freedoms of natural persons
        posed by the processing, the controller shall, both at the time of the determination
        of the means for processing and at the time of the processing itself, implement
        appropriate technical and organisational measures, such as pseudonymisation,
        which are designed to implement data-protection principles, such as data minimisation,
        in an effective manner and to integrate the necessary safeguards into the
        processing in order to meet the requirements of this Regulation and protect
        the rights of data subjects.
      translations:
        sv:
          description: "Med beaktande av den senaste utvecklingen, genomf\xF6randekostnader\
            \ och behandlingens art, omfattning, sammanhang och \xE4ndam\xE5l samt\
            \ riskerna, av varierande sannolikhetsgrad och allvar, f\xF6r fysiska\
            \ personers r\xE4ttigheter och friheter ska den personuppgiftsansvarige,\
            \ b\xE5de vid fastst\xE4llandet av vilka medel behandlingen utf\xF6rs\
            \ med och vid sj\xE4lva behandlingen, genomf\xF6ra l\xE4mpliga tekniska\
            \ och organisatoriska \xE5tg\xE4rder \u2013 s\xE5som pseudonymisering\
            \ \u2013 vilka \xE4r utformade f\xF6r ett effektivt genomf\xF6rande av\
            \ dataskyddsprinciper \u2013 s\xE5som uppgiftsminimering \u2013 och f\xF6\
            r integrering av de n\xF6dv\xE4ndiga skydds\xE5tg\xE4rderna i behandlingen,\
            \ s\xE5 att kraven i denna f\xF6rordning uppfylls och den registrerades\
            \ r\xE4ttigheter skyddas."
    - urn: urn:intuitem:risk:req_node:gdpr:25.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-25
      ref_id: '25.2'
      description: The controller shall implement appropriate technical and organisational
        measures for ensuring that, by default, only personal data which are necessary
        for each specific purpose of the processing are processed. That obligation
        applies to the amount of personal data collected, the extent of their processing,
        the period of their storage and their accessibility. In particular, such measures
        shall ensure that by default personal data are not made accessible without
        the individual's intervention to an indefinite number of natural persons.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska genomf\xF6ra l\xE4mpliga tekniska\
            \ och organisatoriska \xE5tg\xE4rder f\xF6r att, i standardfallet, s\xE4\
            kerst\xE4lla att endast personuppgifter som \xE4r n\xF6dv\xE4ndiga f\xF6\
            r varje specifikt \xE4ndam\xE5l med behandlingen behandlas. Den skyldigheten\
            \ g\xE4ller m\xE4ngden insamlade personuppgifter, behandlingens omfattning,\
            \ tiden f\xF6r deras lagring och deras tillg\xE4nglighet. Framf\xF6r allt\
            \ ska dessa \xE5tg\xE4rder s\xE4kerst\xE4lla att personuppgifter i\_standardfallet\
            \ inte utan den enskildes medverkan g\xF6rs tillg\xE4ngliga f\xF6r ett\
            \ obegr\xE4nsat antal fysiska personer."
    - urn: urn:intuitem:risk:req_node:gdpr:25.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-25
      ref_id: '25.3'
      description: An approved certification mechanism pursuant to Article 42 may
        be used as an element to demonstrate compliance with the requirements set
        out in paragraphs 1 and 2 of this Article.
      translations:
        sv:
          description: "En godk\xE4nd certifieringsmekanism i enlighet med artikel\
            \ 42 f\xE5r anv\xE4ndas f\xF6r att visa att kraven i punkterna 1 och\_\
            2 i den h\xE4r artikeln f\xF6ljs."
    - urn: urn:intuitem:risk:req_node:gdpr:article-26
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 26
      description: Joint controllers
      translations:
        sv:
          name: Artikel 26
          description: Gemensamt personuppgiftsansvariga
    - urn: urn:intuitem:risk:req_node:gdpr:26.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-26
      ref_id: '26.1'
      description: Where two or more controllers jointly determine the purposes and
        means of processing, they shall be joint controllers. They shall in a transparent
        manner determine their respective responsibilities for compliance with the
        obligations under this Regulation, in particular as regards the exercising
        of the rights of the data subject and their respective duties to provide the
        information referred to in Articles 13 and 14, by means of an arrangement
        between them unless, and in so far as, the respective responsibilities of
        the controllers are determined by Union or Member State law to which the controllers
        are subject. The arrangement may designate a contact point for data subjects.
      annotation: The Controller is required to ensure that users are fully informed
        and that the processing of personal data, especially when integrating social
        media buttons such as Facebook's 'Like' button, strictly adheres to GDPR requirements.
        ( CJEU Fashion ID case C-40/17)
      translations:
        sv:
          description: "Om tv\xE5 eller fler personuppgiftsansvariga gemensamt fastst\xE4\
            ller \xE4ndam\xE5len med och medlen f\xF6r behandlingen ska de vara gemensamt\
            \ personuppgiftsansvariga. Gemensamt personuppgiftsansvariga ska under\
            \ \xF6ppna former fastst\xE4lla sitt respektive ansvar f\xF6r att fullg\xF6\
            ra skyldigheterna enligt denna f\xF6rordning, s\xE4rskilt vad g\xE4ller\
            \ ut\xF6vandet av den registrerades r\xE4ttigheter och sina respektive\
            \ skyldigheter att tillhandah\xE5lla den information som avses i\_artiklarna\
            \ 13 och\_14, genom ett inb\xF6rdes arrangemang, s\xE5vida inte de personuppgiftsansvarigas\
            \ respektive skyldigheter fastst\xE4lls genom unionsr\xE4tten eller en\
            \ medlemsstats nationella r\xE4tt som de personuppgiftsansvariga omfattas\
            \ av. Inom ramen f\xF6r arrangemanget f\xE5r en gemensam kontaktpunkt\
            \ f\xF6r de personuppgiftsansvariga utses."
          annotation: The Controller is required to ensure that users are fully informed
            and that the processing of personal data, especially when integrating
            social media buttons such as Facebook's 'Like' button, strictly adheres
            to GDPR requirements. ( CJEU Fashion ID case C-40/17)
    - urn: urn:intuitem:risk:req_node:gdpr:26.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-26
      ref_id: '26.2'
      description: "The arrangement referred to in paragraph 1 shall duly reflect\
        \ the respective roles and relationships of the joint controllers vis-\xE0\
        -vis the data subjects. The essence of the arrangement shall be made available\
        \ to the data subject."
      annotation: The Controller is required to ensure that users are fully informed
        and that the processing of personal data, especially when integrating social
        media buttons such as Facebook's 'Like' button, strictly adheres to GDPR requirements.
        ( CJEU Fashion ID case C-40/17)
      translations:
        sv:
          description: "Det arrangemang som avses i punkt 1 ska p\xE5 l\xE4mpligt\
            \ s\xE4tt \xE5terspegla de gemensamt personuppgiftsansvarigas respektive\
            \ roller och f\xF6rh\xE5llanden gentemot registrerade. Det v\xE4sentliga\
            \ inneh\xE5llet i arrangemanget ska g\xF6ras tillg\xE4ngligt f\xF6r den\
            \ registrerade."
          annotation: The Controller is required to ensure that users are fully informed
            and that the processing of personal data, especially when integrating
            social media buttons such as Facebook's 'Like' button, strictly adheres
            to GDPR requirements. ( CJEU Fashion ID case C-40/17)
    - urn: urn:intuitem:risk:req_node:gdpr:26.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-26
      ref_id: '26.3'
      description: Irrespective of the terms of the arrangement referred to in paragraph
        1, the data subject may exercise his or her rights under this Regulation in
        respect of and against each of the controllers.
      translations:
        sv:
          description: "Oavsett formerna f\xF6r det arrangemang som avses i punkt\
            \ 1 f\xE5r den registrerade ut\xF6va sina r\xE4ttigheter enligt denna\
            \ f\xF6rordning med avseende p\xE5 och emot var och en av de personuppgiftsansvariga."
    - urn: urn:intuitem:risk:req_node:gdpr:article-27
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 27
      description: Representatives of controllers or processors not established in
        the Union
      translations:
        sv:
          name: Artikel 27
          description: "F\xF6retr\xE4dare f\xF6r personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            den som inte \xE4r etablerade i unionen"
    - urn: urn:intuitem:risk:req_node:gdpr:27.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-27
      ref_id: '27.1'
      description: Where Article 3(2) applies, the controller or the processor shall
        designate in writing a representative in the Union.
      translations:
        sv:
          description: "Om artikel 3.2 till\xE4mpas ska den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det skriftligen utse en f\xF6retr\xE4dare\
            \ i unionen."
    - urn: urn:intuitem:risk:req_node:gdpr:27.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-27
      ref_id: '27.2'
      description: 'The obligation laid down in paragraph 1 of this Article shall
        not apply to:'
      translations:
        sv:
          description: "Skyldigheten enligt punkt 1 i denna artikel ska inte g\xE4\
            lla"
    - urn: urn:intuitem:risk:req_node:gdpr:27.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:27.2
      ref_id: 27.2.a
      description: processing which is occasional, does not include, on a large scale,
        processing of special categories of data as referred to in Article 9(1) or
        processing of personal data relating to criminal convictions and offences
        referred to in Article 10, and is unlikely to result in a risk to the rights
        and freedoms of natural persons, taking into account the nature, context,
        scope and purposes of the processing; or
      translations:
        sv:
          description: "tillf\xE4llig behandling som inte omfattar behandling i stor\
            \ omfattning av s\xE4rskilda kategorier av uppgifter, som avses i artikel\
            \ 9.1, eller behandling av personuppgifter avseende f\xE4llande domar\
            \ i brottm\xE5l samt \xF6vertr\xE4delser, som avses i artikel 10, och\
            \ som sannolikt inte kommer att medf\xF6ra en risk f\xF6r fysiska personers\
            \ r\xE4ttigheter och friheter, med h\xE4nsyn till behandlingens art, sammanhang,\
            \ omfattning och \xE4ndam\xE5l, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:27.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:27.2
      ref_id: 27.2.b
      description: a public authority or body.
      translations:
        sv:
          description: en offentlig myndighet eller ett offentligt organ.
    - urn: urn:intuitem:risk:req_node:gdpr:27.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-27
      ref_id: '27.3'
      description: The representative shall be established in one of the Member States
        where the data subjects, whose personal data are processed in relation to
        the offering of goods or services to them, or whose behaviour is monitored,
        are.
      translations:
        sv:
          description: "F\xF6retr\xE4daren ska vara etablerad i en av de medlemsstater\
            \ d\xE4r de registrerade, vars personuppgifter behandlas i samband med\
            \ att de erbjuds varor eller tj\xE4nster, eller vars beteende \xF6vervakas,\
            \ befinner sig."
    - urn: urn:intuitem:risk:req_node:gdpr:27.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-27
      ref_id: '27.4'
      description: The representative shall be mandated by the controller or processor
        to be addressed in addition to or instead of the controller or the processor
        by, in particular, supervisory authorities and data subjects, on all issues
        related to processing, for the purposes of ensuring compliance with this Regulation.
      translations:
        sv:
          description: "F\xF6retr\xE4daren ska p\xE5 den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets uppdrag, ut\xF6ver eller i\_st\xE4\
            llet f\xF6r den personuppgiftsansvarige eller personuppgiftsbitr\xE4det,\
            \ fungera som kontaktperson f\xF6r i\_synnerhet tillsynsmyndigheter och\
            \ registrerade, i alla fr\xE5gor som har anknytning till behandlingen,\
            \ i syfte att s\xE4kerst\xE4lla efterlevnad av denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:27.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-27
      ref_id: '27.5'
      description: The designation of a representative by the controller or processor
        shall be without prejudice to legal actions which could be initiated against
        the controller or the processor themselves.
      translations:
        sv:
          description: "Att den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det utser en f\xF6retr\xE4dare ska inte p\xE5verka de r\xE4ttsliga \xE5\
            tg\xE4rder som skulle kunna inledas mot den personuppgiftsansvarige eller\
            \ personuppgiftsbitr\xE4det."
    - urn: urn:intuitem:risk:req_node:gdpr:article-28
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 28
      description: Processor
      translations:
        sv:
          name: Artikel 28
          description: "Personuppgiftsbitr\xE4den"
    - urn: urn:intuitem:risk:req_node:gdpr:28.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.1'
      description: Where processing is to be carried out on behalf of a controller,
        the controller shall use only processors providing sufficient guarantees to
        implement appropriate technical and organisational measures in such a manner
        that processing will meet the requirements of this Regulation and ensure the
        protection of the rights of the data subject.
      translations:
        sv:
          description: "Om en behandling ska genomf\xF6ras p\xE5 en personuppgiftsansvarigs\
            \ v\xE4gnar ska den personuppgiftsansvarige endast anlita personuppgiftsbitr\xE4\
            den som ger tillr\xE4ckliga garantier om att genomf\xF6ra l\xE4mpliga\
            \ tekniska och organisatoriska \xE5tg\xE4rder p\xE5 ett s\xE5dant s\xE4\
            tt att behandlingen uppfyller kraven i\_denna f\xF6rordning och s\xE4\
            kerst\xE4ller att den registrerades r\xE4ttigheter skyddas."
    - urn: urn:intuitem:risk:req_node:gdpr:28.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.2'
      description: The processor shall not engage another processor without prior
        specific or general written authorisation of the controller. In the case of
        general written authorisation, the processor shall inform the controller of
        any intended changes concerning the addition or replacement of other processors,
        thereby giving the controller the opportunity to object to such changes.
      translations:
        sv:
          description: "Personuppgiftsbitr\xE4det f\xE5r inte anlita ett annat personuppgiftsbitr\xE4\
            de utan att ett s\xE4rskilt eller allm\xE4nt skriftligt f\xF6rhandstillst\xE5\
            nd har erh\xE5llits av den personuppgiftsansvarige. Om ett allm\xE4nt\
            \ skriftligt tillst\xE5nd har erh\xE5llits, ska personuppgiftsbitr\xE4\
            det informera den personuppgiftsansvarige om eventuella planer p\xE5 att\
            \ anlita nya personuppgiftsbitr\xE4den eller ers\xE4tta personuppgiftsbitr\xE4\
            den, s\xE5 att den personuppgiftsansvarige har m\xF6jlighet att g\xF6\
            ra inv\xE4ndningar mot s\xE5dana f\xF6r\xE4ndringar."
    - urn: urn:intuitem:risk:req_node:gdpr:28.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.3'
      description: 'Processing by a processor shall be governed by a contract or other
        legal act under Union or Member State law, that is binding on the processor
        with regard to the controller and that sets out the subject-matter and duration
        of the processing, the nature and purpose of the processing, the type of personal
        data and categories of data subjects and the obligations and rights of the
        controller. That contract or other legal act shall stipulate, in particular,
        that the processor:'
      translations:
        sv:
          description: "N\xE4r uppgifter behandlas av ett personuppgiftsbitr\xE4de\
            \ ska hanteringen regleras genom ett avtal eller en annan r\xE4ttsakt\
            \ enligt unionsr\xE4tten eller enligt medlemsstaternas nationella r\xE4\
            tt som \xE4r bindande f\xF6r personuppgiftsbitr\xE4det med avseende p\xE5\
            \ den personuppgiftsansvarige och i vilken f\xF6rem\xE5let f\xF6r behandlingen,\
            \ behandlingens varaktighet, art och \xE4ndam\xE5l, typen av personuppgifter\
            \ och kategorier av registrerade, samt den personuppgiftsansvariges skyldigheter\
            \ och r\xE4ttigheter anges. I det avtalet eller den r\xE4ttsakten ska\
            \ det s\xE4rskilt f\xF6reskrivas att personuppgiftsbitr\xE4det"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.a
      description: processes the personal data only on documented instructions from
        the controller, including with regard to transfers of personal data to a third
        country or an international organisation, unless required to do so by Union
        or Member State law to which the processor is subject; in such a case, the
        processor shall inform the controller of that legal requirement before processing,
        unless that law prohibits such information on important grounds of public
        interest;
      translations:
        sv:
          description: "endast f\xE5r behandla personuppgifter p\xE5 dokumenterade\
            \ instruktioner fr\xE5n den personuppgiftsansvarige, inbegripet n\xE4\
            r det g\xE4ller \xF6verf\xF6ringar av personuppgifter till ett tredjeland\
            \ eller en internationell organisation, s\xE5vida inte denna behandling\
            \ kr\xE4vs enligt unionsr\xE4tten eller enligt en medlemsstats nationella\
            \ r\xE4tt som personuppgiftsbitr\xE4det omfattas av, och i s\xE5 fall\
            \ ska personuppgiftsbitr\xE4det informera den personuppgiftsansvarige\
            \ om det r\xE4ttsliga kravet innan uppgifterna behandlas, s\xE5vida s\xE5\
            dan information inte \xE4r f\xF6rbjuden med h\xE4nvisning till ett viktigt\
            \ allm\xE4nintresse enligt denna r\xE4tt,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.b
      description: ensures that persons authorised to process the personal data have
        committed themselves to confidentiality or are under an appropriate statutory
        obligation of confidentiality;
      translations:
        sv:
          description: "s\xE4kerst\xE4ller att personer med beh\xF6righet att behandla\
            \ personuppgifterna har \xE5tagit sig att iaktta konfidentialitet eller\
            \ omfattas av en l\xE4mplig lagstadgad tystnadsplikt,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.c
      description: takes all measures required pursuant to Article 32;
      translations:
        sv:
          description: "ska vidta alla \xE5tg\xE4rder som kr\xE4vs enligt artikel\
            \ 32,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.d
      description: respects the conditions referred to in paragraphs 2 and 4 for engaging
        another processor;
      translations:
        sv:
          description: "ska respektera de villkor som avses i punkterna 2 och 4 f\xF6\
            r anlitandet av ett annat personuppgiftsbitr\xE4de,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.e
      description: taking into account the nature of the processing, assists the controller
        by appropriate technical and organisational measures, insofar as this is possible,
        for the fulfilment of the controller's obligation to respond to requests for
        exercising the data subject's rights laid down in Chapter III;
      translations:
        sv:
          description: "med tanke p\xE5 behandlingens art, ska hj\xE4lpa den personuppgiftsansvarige\
            \ genom l\xE4mpliga tekniska och organisatoriska \xE5tg\xE4rder, i den\
            \ m\xE5n detta \xE4r m\xF6jligt, s\xE5 att den personuppgiftsansvarige\
            \ kan fullg\xF6ra sin skyldighet att svara p\xE5 beg\xE4ran om ut\xF6\
            vande av den registrerades r\xE4ttigheter i enlighet med kapitel III,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.f
      description: assists the controller in ensuring compliance with the obligations
        pursuant to Articles 32 to 36 taking into account the nature of processing
        and the information available to the processor;
      translations:
        sv:
          description: "ska bist\xE5 den personuppgiftsansvarige med att se till att\
            \ skyldigheterna enligt artiklarna\_32\u201336 fullg\xF6rs, med beaktande\
            \ av typen av behandling och den information som personuppgiftsbitr\xE4\
            det har att tillg\xE5,"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.g
      description: at the choice of the controller, deletes or returns all the personal
        data to the controller after the end of the provision of services relating
        to processing, and deletes existing copies unless Union or Member State law
        requires storage of the personal data;
      translations:
        sv:
          description: "beroende p\xE5 vad den personuppgiftsansvarige v\xE4ljer,\
            \ ska radera eller \xE5terl\xE4mna alla personuppgifter till den personuppgiftsansvarige\
            \ efter det att tillhandah\xE5llandet av behandlingstj\xE4nster har avslutats,\
            \ och radera befintliga kopior s\xE5vida inte lagring av personuppgifterna\
            \ kr\xE4vs enligt unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt, och"
    - urn: urn:intuitem:risk:req_node:gdpr:28.3.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:28.3
      ref_id: 28.3.h
      description: makes available to the controller all information necessary to
        demonstrate compliance with the obligations laid down in this Article and
        allow for and contribute to audits, including inspections, conducted by the
        controller or another auditor mandated by the controller.
      translations:
        sv:
          description: "ska ge den personuppgiftsansvarige tillg\xE5ng till all information\
            \ som kr\xE4vs f\xF6r att visa att de skyldigheter som fastst\xE4lls i\
            \ denna artikel har fullgjorts samt m\xF6jligg\xF6ra och bidra till granskningar,\
            \ inbegripet inspektioner, som genomf\xF6rs av den personuppgiftsansvarige\
            \ eller av en annan revisor som bemyndigats av den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:node474
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      description: With regard to point (h) of the first subparagraph, the processor
        shall immediately inform the controller if, in its opinion, an instruction
        infringes this Regulation or other Union or Member State data protection provisions.
      translations:
        sv:
          description: "Med avseende p\xE5 led h i f\xF6rsta stycket ska personuppgiftsbitr\xE4\
            det omedelbart informera den personuppgiftsansvarige om han anser att\
            \ en instruktion strider mot denna f\xF6rordning eller mot andra av unionens\
            \ eller medlemsstaternas dataskyddsbest\xE4mmelser."
    - urn: urn:intuitem:risk:req_node:gdpr:28.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.4'
      description: Where a processor engages another processor for carrying out specific
        processing activities on behalf of the controller, the same data protection
        obligations as set out in the contract or other legal act between the controller
        and the processor as referred to in paragraph 3 shall be imposed on that other
        processor by way of a contract or other legal act under Union or Member State
        law, in particular providing sufficient guarantees to implement appropriate
        technical and organisational measures in such a manner that the processing
        will meet the requirements of this Regulation. Where that other processor
        fails to fulfil its data protection obligations, the initial processor shall
        remain fully liable to the controller for the performance of that other processor's
        obligations.
      translations:
        sv:
          description: "I de fall d\xE4r ett personuppgiftsbitr\xE4de anlitar ett\
            \ annat personuppgiftsbitr\xE4de f\xF6r utf\xF6rande av specifik behandling\
            \ p\xE5 den personuppgiftsansvariges v\xE4gnar ska det andra personuppgiftsbitr\xE4\
            det, genom ett avtal eller en annan r\xE4ttsakt enligt unionsr\xE4tten\
            \ eller enligt medlemsstaternas nationella r\xE4tt, \xE5l\xE4ggas samma\
            \ skyldigheter i fr\xE5ga om dataskydd som de som fastst\xE4lls i avtalet\
            \ eller den andra r\xE4ttsakten mellan den personuppgiftsansvarige och\
            \ personuppgiftsbitr\xE4det enligt punkt 3, och framf\xF6r allt att ge\
            \ tillr\xE4ckliga garantier om att genomf\xF6ra l\xE4mpliga tekniska och\
            \ organisatoriska \xE5tg\xE4rder p\xE5 ett s\xE5dant s\xE4tt att behandlingen\
            \ uppfyller kraven i denna f\xF6rordning. Om det andra personuppgiftsbitr\xE4\
            det inte fullg\xF6r sina skyldigheter i fr\xE5ga om dataskydd ska det\
            \ ursprungliga personuppgiftsbitr\xE4det vara fullt ansvarig gentemot\
            \ den personuppgiftsansvarige f\xF6r utf\xF6randet av det andra personuppgiftsbitr\xE4\
            dets skyldigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:28.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.5'
      description: Adherence of a processor to an approved code of conduct as referred
        to in Article 40 or an approved certification mechanism as referred to in
        Article 42 may be used as an element by which to demonstrate sufficient guarantees
        as referred to in paragraphs 1 and 4 of this Article.
      translations:
        sv:
          description: "Ett personuppgiftsbitr\xE4des anslutning till en godk\xE4\
            nd uppf\xF6randekod som avses i artikel 40 eller en godk\xE4nd certifieringsmekanism\
            \ som avses i artikel 42 f\xE5r anv\xE4ndas f\xF6r att visa att tillr\xE4\
            ckliga garantier tillhandah\xE5lls, s\xE5 som avses punkterna 1 och 4\
            \ i den h\xE4r artikeln."
    - urn: urn:intuitem:risk:req_node:gdpr:28.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.6'
      description: Without prejudice to an individual contract between the controller
        and the processor, the contract or the other legal act referred to in paragraphs
        3 and 4 of this Article may be based, in whole or in part, on standard contractual
        clauses referred to in paragraphs 7 and 8 of this Article, including when
        they are part of a certification granted to the controller or processor pursuant
        to Articles 42 and 43.
      translations:
        sv:
          description: "Det avtal eller den andra r\xE4ttsakt som avses i punkterna\
            \ 3 och 4 i den h\xE4r artikeln f\xE5r, utan att det p\xE5verkar till\xE4\
            mpningen av ett enskilt avtal mellan den personuppgiftsansvarige och personuppgiftsbitr\xE4\
            det, helt eller delvis baseras p\xE5 s\xE5dana standardavtalsklausuler\
            \ som avses i punkterna 7 och 8 i den h\xE4r artikeln, inbegripet n\xE4\
            r de ing\xE5r i en certifiering som i enlighet med artiklarna 42 och 43\
            \ beviljats den personuppgiftsansvarige eller personuppgiftsbitr\xE4det."
    - urn: urn:intuitem:risk:req_node:gdpr:28.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.7'
      description: The Commission may lay down standard contractual clauses for the
        matters referred to in paragraph 3 and 4 of this Article and in accordance
        with the examination procedure referred to in Article 93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r fastst\xE4lla standardavtalsklausuler\
            \ f\xF6r de fr\xE5gor som avses i punkterna 3 och 4 i den h\xE4r artikeln,\
            \ i enlighet med det granskningsf\xF6rfarande som avses i artikel 93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:28.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.8'
      description: A supervisory authority may adopt standard contractual clauses
        for the matters referred to in paragraph 3 and 4 of this Article and in accordance
        with the consistency mechanism referred to in Article 63.
      translations:
        sv:
          description: "En tillsynsmyndighet f\xE5r fastst\xE4lla standardavtalsklausuler\
            \ f\xF6r de fr\xE5gor som avses i\_punkterna 3 och 4 i den h\xE4r artikeln,\
            \ i enlighet med den mekanism f\xF6r enhetlighet som avses i artikel 63."
    - urn: urn:intuitem:risk:req_node:gdpr:28.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.9'
      description: The contract or the other legal act referred to in paragraphs 3
        and 4 shall be in writing, including in electronic form.
      translations:
        sv:
          description: "Det avtal eller den andra r\xE4ttsakt som avses i punkterna\
            \ 3 och 4 ska uppr\xE4ttas skriftligen, inbegripet i ett elektroniskt\
            \ format."
    - urn: urn:intuitem:risk:req_node:gdpr:28.10
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-28
      ref_id: '28.10'
      description: Without prejudice to Articles 82, 83 and 84, if a processor infringes
        this Regulation by determining the purposes and means of processing, the processor
        shall be considered to be a controller in respect of that processing.
      translations:
        sv:
          description: "Om ett personuppgiftsbitr\xE4de \xF6vertr\xE4der denna f\xF6\
            rordning genom att fastst\xE4lla \xE4ndam\xE5len med och medlen f\xF6\
            r behandlingen, ska personuppgiftsbitr\xE4det anses vara personuppgiftsansvarig\
            \ med avseende p\xE5 den behandlingen, utan att det p\xE5verkar till\xE4\
            mpningen av artiklarna 82, 83 och 84."
    - urn: urn:intuitem:risk:req_node:gdpr:article-29
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 29
      description: Processing under the authority of the controller or processor
      translations:
        sv:
          name: Artikel 29
          description: "Behandling under den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets \xF6verinseende"
    - urn: urn:intuitem:risk:req_node:gdpr:node483
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-29
      description: The processor and any person acting under the authority of the
        controller or of the processor, who has access to personal data, shall not
        process those data except on instructions from the controller, unless required
        to do so by Union or Member State law.
      translations:
        sv:
          description: "Personuppgiftsbitr\xE4det och personer som utf\xF6r arbete\
            \ under den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets\
            \ \xF6verinseende, och som f\xE5r tillg\xE5ng till personuppgifter, f\xE5\
            r endast behandla dessa p\xE5 instruktion fr\xE5n den personuppgiftsansvarige,\
            \ s\xE5vida han eller hon inte \xE4r skyldig att g\xF6ra det enligt unionsr\xE4\
            tten eller medlemsstaternas nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:article-30
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 30
      description: Records of processing activities
      translations:
        sv:
          name: Artikel 30
          description: "Register \xF6ver behandling"
    - urn: urn:intuitem:risk:req_node:gdpr:30.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-30
      ref_id: '30.1'
      description: 'Each controller and, where applicable, the controller''s representative,
        shall maintain a record of processing activities under its responsibility.
        That record shall contain all of the following information:'
      translations:
        sv:
          description: "Varje personuppgiftsansvarig och, i till\xE4mpliga fall, dennes\
            \ f\xF6retr\xE4dare ska f\xF6ra ett register \xF6ver behandling som utf\xF6\
            rts under dess ansvar. Detta register ska inneh\xE5lla samtliga f\xF6\
            ljande uppgifter:"
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.a
      description: the name and contact details of the controller and, where applicable,
        the joint controller, the controller's representative and the data protection
        officer;
      translations:
        sv:
          description: "Namn och kontaktuppgifter f\xF6r den personuppgiftsansvarige,\
            \ samt i till\xE4mpliga fall gemensamt personuppgiftsansvariga, den personuppgiftsansvariges\
            \ f\xF6retr\xE4dare samt dataskyddsombudet."
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.b
      description: the purposes of the processing;
      translations:
        sv:
          description: "\xC4ndam\xE5len med behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.c
      description: a description of the categories of data subjects and of the categories
        of personal data;
      translations:
        sv:
          description: En beskrivning av kategorierna av registrerade och av kategorierna
            av personuppgifter.
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.d
      description: the categories of recipients to whom the personal data have been
        or will be disclosed including recipients in third countries or international
        organisations;
      translations:
        sv:
          description: "De kategorier av mottagare till vilka personuppgifterna har\
            \ l\xE4mnats eller ska l\xE4mnas ut, inbegripet mottagare i tredjel\xE4\
            nder eller i internationella organisationer."
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.e
      description: where applicable, transfers of personal data to a third country
        or an international organisation, including the identification of that third
        country or international organisation and, in the case of transfers referred
        to in the second subparagraph of Article 49(1), the documentation of suitable
        safeguards;
      translations:
        sv:
          description: "I till\xE4mpliga fall, \xF6verf\xF6ringar av personuppgifter\
            \ till ett tredjeland eller en internationell organisation, inbegripet\
            \ identifiering av tredjelandet eller den internationella organisationen\
            \ och, vid s\xE5dana \xF6verf\xF6ringar som avses i artikel\_49.1 andra\
            \ stycket, dokumentationen av l\xE4mpliga skydds\xE5tg\xE4rder."
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.f
      description: where possible, the envisaged time limits for erasure of the different
        categories of data;
      translations:
        sv:
          description: "Om m\xF6jligt, de f\xF6rutsedda tidsfristerna f\xF6r radering\
            \ av de olika kategorierna av uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:30.1.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.1
      ref_id: 30.1.g
      description: where possible, a general description of the technical and organisational
        security measures referred to in Article 32(1).
      translations:
        sv:
          description: "Om m\xF6jligt, en allm\xE4n beskrivning av de tekniska och\
            \ organisatoriska s\xE4kerhets\xE5tg\xE4rder som avses i artikel 32.1."
    - urn: urn:intuitem:risk:req_node:gdpr:30.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-30
      ref_id: '30.2'
      description: 'Each processor and, where applicable, the processor''s representative
        shall maintain a record of all categories of processing activities carried
        out on behalf of a controller, containing:'
      translations:
        sv:
          description: "Varje personuppgiftsbitr\xE4de och, i till\xE4mpliga fall,\
            \ dennes f\xF6retr\xE4dare ska f\xF6ra ett register \xF6ver alla kategorier\
            \ av behandling som utf\xF6rts f\xF6r den personuppgiftsansvariges r\xE4\
            kning, som omfattar f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:30.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.2
      ref_id: 30.2.a
      description: the name and contact details of the processor or processors and
        of each controller on behalf of which the processor is acting, and, where
        applicable, of the controller's or the processor's representative, and the
        data protection officer;
      translations:
        sv:
          description: "Namn och kontaktuppgifter f\xF6r personuppgiftsbitr\xE4det\
            \ eller personuppgiftsbitr\xE4dena och f\xF6r varje personuppgiftsansvarig\
            \ f\xF6r vars r\xE4kning personuppgiftsbitr\xE4det agerar, och, i\_till\xE4\
            mpliga fall, f\xF6r den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets f\xF6retr\xE4dare samt dataskyddsombudet."
    - urn: urn:intuitem:risk:req_node:gdpr:30.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.2
      ref_id: 30.2.b
      description: the categories of processing carried out on behalf of each controller;
      translations:
        sv:
          description: "De kategorier av behandling som har utf\xF6rts f\xF6r varje\
            \ personuppgiftsansvariges r\xE4kning."
    - urn: urn:intuitem:risk:req_node:gdpr:30.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.2
      ref_id: 30.2.c
      description: where applicable, transfers of personal data to a third country
        or an international organisation, including the identification of that third
        country or international organisation and, in the case of transfers referred
        to in the second subparagraph of Article 49(1), the documentation of suitable
        safeguards;
      translations:
        sv:
          description: "I till\xE4mpliga fall, \xF6verf\xF6ringar av personuppgifter\
            \ till ett tredjeland eller en internationell organisation, inbegripet\
            \ identifiering av tredjelandet eller den internationella organisationen\
            \ och, vid s\xE5dana \xF6verf\xF6ringar som avses i artikel\_49.1 andra\
            \ stycket, dokumentationen av l\xE4mpliga skydds\xE5tg\xE4rder."
    - urn: urn:intuitem:risk:req_node:gdpr:30.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:30.2
      ref_id: 30.2.d
      description: where possible, a general description of the technical and organisational
        security measures referred to in Article 32(1).
      translations:
        sv:
          description: "Om m\xF6jligt, en allm\xE4n beskrivning av de tekniska och\
            \ organisatoriska s\xE4kerhets\xE5tg\xE4rder som avses i artikel 32.1."
    - urn: urn:intuitem:risk:req_node:gdpr:30.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-30
      ref_id: '30.3'
      description: The records referred to in paragraphs 1 and 2 shall be in writing,
        including in electronic form.
      translations:
        sv:
          description: "De register som avses i punkterna 1 och 2 ska uppr\xE4ttas\
            \ skriftligen, inbegripet i elektronisk form."
    - urn: urn:intuitem:risk:req_node:gdpr:30.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-30
      ref_id: '30.4'
      description: The controller or the processor and, where applicable, the controller's
        or the processor's representative, shall make the record available to the
        supervisory authority on request.
      translations:
        sv:
          description: "P\xE5 beg\xE4ran ska den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det samt, i till\xE4mpliga fall, den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets f\xF6retr\xE4dare g\xF6ra registret tillg\xE4ngligt f\xF6r tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:30.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-30
      ref_id: '30.5'
      description: The obligations referred to in paragraphs 1 and 2 shall not apply
        to an enterprise or an organisation employing fewer than 250 persons unless
        the processing it carries out is likely to result in a risk to the rights
        and freedoms of data subjects, the processing is not occasional, or the processing
        includes special categories of data as referred to in Article 9(1) or personal
        data relating to criminal convictions and offences referred to in Article
        10.
      translations:
        sv:
          description: "De skyldigheter som anges i punkterna 1 och 2 ska inte g\xE4\
            lla f\xF6r ett f\xF6retag eller en organisation som syssels\xE4tter f\xE4\
            rre \xE4n 250 personer s\xE5vida inte den behandling som utf\xF6rs sannolikt\
            \ kommer att medf\xF6ra en risk f\xF6r registrerades r\xE4ttigheter och\
            \ friheter, behandlingen inte \xE4r tillf\xE4llig eller behandlingen omfattar\
            \ s\xE4rskilda kategorier av uppgifter som avses i\_artikel 9.1 eller\
            \ personuppgifter om f\xE4llande domar i brottm\xE5l samt \xF6vertr\xE4\
            delser som avses i artikel 10."
    - urn: urn:intuitem:risk:req_node:gdpr:article-31
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node441
      ref_id: Article 31
      description: Cooperation with the supervisory authority
      translations:
        sv:
          name: Artikel 31
          description: Samarbete med tillsynsmyndigheten
    - urn: urn:intuitem:risk:req_node:gdpr:node502
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-31
      description: The controller and the processor and, where applicable, their representatives,
        shall cooperate, on request, with the supervisory authority in the performance
        of its tasks.
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ samt, i till\xE4mpliga fall, deras f\xF6retr\xE4dare ska p\xE5 beg\xE4\
            ran samarbeta med tillsynsmyndigheten vid utf\xF6randet av dennes uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:node503
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      name: Section 2
      description: Security of personal data
      translations:
        sv:
          name: Avsnitt 2
          description: "S\xE4kerhet f\xF6r personuppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:article-32
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node503
      ref_id: Article 32
      description: Security of processing
      translations:
        sv:
          name: Artikel 32
          description: "S\xE4kerhet i samband med behandlingen"
    - urn: urn:intuitem:risk:req_node:gdpr:32.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-32
      ref_id: '32.1'
      description: 'Taking into account the state of the art, the costs of implementation
        and the nature, scope, context and purposes of processing as well as the risk
        of varying likelihood and severity for the rights and freedoms of natural
        persons, the controller and the processor shall implement appropriate technical
        and organisational measures to ensure a level of security appropriate to the
        risk, including inter alia as appropriate:'
      translations:
        sv:
          description: "Med beaktande av den senaste utvecklingen, genomf\xF6randekostnaderna\
            \ och behandlingens art, omfattning, sammanhang och \xE4ndam\xE5l samt\
            \ riskerna, av varierande sannolikhetsgrad och allvar, f\xF6r fysiska\
            \ personers r\xE4ttigheter och friheter ska den personuppgiftsansvarige\
            \ och personuppgiftsbitr\xE4det vidta l\xE4mpliga tekniska och organisatoriska\
            \ \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla en s\xE4kerhetsniv\xE5 som\
            \ \xE4r l\xE4mplig i f\xF6rh\xE5llande till risken, inbegripet, n\xE4\
            r det \xE4r l\xE4mpligt"
    - urn: urn:intuitem:risk:req_node:gdpr:32.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:32.1
      ref_id: 32.1.a
      description: the pseudonymisation and encryption of personal data;
      translations:
        sv:
          description: pseudonymisering och kryptering av personuppgifter,
    - urn: urn:intuitem:risk:req_node:gdpr:32.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:32.1
      ref_id: 32.1.b
      description: the ability to ensure the ongoing confidentiality, integrity, availability
        and resilience of processing systems and services;
      translations:
        sv:
          description: "f\xF6rm\xE5gan att fortl\xF6pande s\xE4kerst\xE4lla konfidentialitet,\
            \ integritet, tillg\xE4nglighet och motst\xE5ndskraft hos behandlingssystemen\
            \ och -tj\xE4nsterna,"
    - urn: urn:intuitem:risk:req_node:gdpr:32.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:32.1
      ref_id: 32.1.c
      description: the ability to restore the availability and access to personal
        data in a timely manner in the event of a physical or technical incident;
      translations:
        sv:
          description: "f\xF6rm\xE5gan att \xE5terst\xE4lla tillg\xE4ngligheten och\
            \ tillg\xE5ngen till personuppgifter i rimlig tid vid en fysisk eller\
            \ teknisk incident,"
    - urn: urn:intuitem:risk:req_node:gdpr:32.1.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:32.1
      ref_id: 32.1.d
      description: a process for regularly testing, assessing and evaluating the effectiveness
        of technical and organisational measures for ensuring the security of the
        processing.
      translations:
        sv:
          description: "ett f\xF6rfarande f\xF6r att regelbundet testa, unders\xF6\
            ka och utv\xE4rdera effektiviteten hos de tekniska och organisatoriska\
            \ \xE5tg\xE4rder som ska s\xE4kerst\xE4lla behandlingens s\xE4kerhet."
    - urn: urn:intuitem:risk:req_node:gdpr:32.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-32
      ref_id: '32.2'
      description: In assessing the appropriate level of security account shall be
        taken in particular of the risks that are presented by processing, in particular
        from accidental or unlawful destruction, loss, alteration, unauthorised disclosure
        of, or access to personal data transmitted, stored or otherwise processed.
      translations:
        sv:
          description: "Vid bed\xF6mningen av l\xE4mplig s\xE4kerhetsniv\xE5 ska s\xE4\
            rskild h\xE4nsyn tas till de risker som behandling medf\xF6r, i synnerhet\
            \ fr\xE5n oavsiktlig eller olaglig f\xF6rst\xF6ring, f\xF6rlust eller\
            \ \xE4ndring eller till obeh\xF6rigt r\xF6jande av eller obeh\xF6rig \xE5\
            tkomst till de personuppgifter som \xF6verf\xF6rts, lagrats eller p\xE5\
            \ annat s\xE4tt behandlats."
    - urn: urn:intuitem:risk:req_node:gdpr:32.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-32
      ref_id: '32.3'
      description: Adherence to an approved code of conduct as referred to in Article
        40 or an approved certification mechanism as referred to in Article 42 may
        be used as an element by which to demonstrate compliance with the requirements
        set out in paragraph 1 of this Article.
      translations:
        sv:
          description: "Anslutning till en godk\xE4nd uppf\xF6randekod som avses i\
            \ artikel 40 eller en godk\xE4nd certifieringsmekanism som avses i artikel\
            \ 42 f\xE5r anv\xE4ndas f\xF6r att visa att kraven i punkt 1 i\_den h\xE4\
            r artikeln f\xF6ljs."
    - urn: urn:intuitem:risk:req_node:gdpr:32.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-32
      ref_id: '32.4'
      description: The controller and processor shall take steps to ensure that any
        natural person acting under the authority of the controller or the processor
        who has access to personal data does not process them except on instructions
        from the controller, unless he or she is required to do so by Union or Member
        State law.
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ ska vidta \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla att varje fysisk\
            \ person som utf\xF6r arbete under den personuppgiftsansvariges eller\
            \ personuppgiftsbitr\xE4dets \xF6verinseende, och som f\xE5r tillg\xE5\
            ng till personuppgifter, endast behandlar dessa p\xE5 instruktion fr\xE5\
            n den personuppgiftsansvarige, om inte unionsr\xE4tten eller medlemsstaternas\
            \ nationella r\xE4tt \xE5l\xE4gger honom eller henne att g\xF6ra det."
    - urn: urn:intuitem:risk:req_node:gdpr:article-33
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node503
      ref_id: Article 33
      description: Notification of a personal data breach to the supervisory authority
      translations:
        sv:
          name: Artikel 33
          description: "Anm\xE4lan av en personuppgiftsincident till tillsynsmyndigheten"
    - urn: urn:intuitem:risk:req_node:gdpr:33.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-33
      ref_id: '33.1'
      description: In the case of a personal data breach, the controller shall without
        undue delay and, where feasible, not later than 72 hours after having become
        aware of it, notify the personal data breach to the supervisory authority
        competent in accordance with Article 55, unless the personal data breach is
        unlikely to result in a risk to the rights and freedoms of natural persons.
        Where the notification to the supervisory authority is not made within 72
        hours, it shall be accompanied by reasons for the delay.
      translations:
        sv:
          description: "Vid en personuppgiftsincident ska den personuppgiftsansvarige\
            \ utan on\xF6digt dr\xF6jsm\xE5l och, om s\xE5 \xE4r m\xF6jligt, inte\
            \ senare \xE4n 72 timmar efter att ha f\xE5tt vetskap om den, anm\xE4\
            la personuppgiftsincidenten till den tillsynsmyndighet som \xE4r beh\xF6\
            rig i enlighet med artikel\_55, s\xE5vida det inte \xE4r osannolikt att\
            \ personuppgiftsincidenten medf\xF6r en risk f\xF6r fysiska personers\
            \ r\xE4ttigheter och friheter. Om anm\xE4lan till tillsynsmyndigheten\
            \ inte g\xF6rs inom 72 timmar ska den \xE5tf\xF6ljas av en motivering\
            \ till f\xF6rseningen."
    - urn: urn:intuitem:risk:req_node:gdpr:33.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-33
      ref_id: '33.2'
      description: The processor shall notify the controller without undue delay after
        becoming aware of a personal data breach.
      translations:
        sv:
          description: "Personuppgiftsbitr\xE4det ska underr\xE4tta den personuppgiftsansvarige\
            \ utan on\xF6digt dr\xF6jsm\xE5l efter att ha f\xE5tt vetskap om en personuppgiftsincident."
    - urn: urn:intuitem:risk:req_node:gdpr:33.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-33
      ref_id: '33.3'
      description: 'The notification referred to in paragraph 1 shall at least:'
      translations:
        sv:
          description: "Den anm\xE4lan som avses i punkt 1 ska \xE5tminstone"
    - urn: urn:intuitem:risk:req_node:gdpr:33.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:33.3
      ref_id: 33.3.a
      description: describe the nature of the personal data breach including where
        possible, the categories and approximate number of data subjects concerned
        and the categories and approximate number of personal data records concerned;
      translations:
        sv:
          description: "beskriva personuppgiftsincidentens art, inbegripet, om s\xE5\
            \ \xE4r m\xF6jligt, de kategorier av och det ungef\xE4rliga antalet registrerade\
            \ som ber\xF6rs samt de kategorier av och det ungef\xE4rliga antalet personuppgiftsposter\
            \ som ber\xF6rs,"
    - urn: urn:intuitem:risk:req_node:gdpr:33.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:33.3
      ref_id: 33.3.b
      description: communicate the name and contact details of the data protection
        officer or other contact point where more information can be obtained;
      translations:
        sv:
          description: "f\xF6rmedla namnet p\xE5 och kontaktuppgifterna f\xF6r dataskyddsombudet\
            \ eller andra kontaktpunkter d\xE4r mer information kan erh\xE5llas,"
    - urn: urn:intuitem:risk:req_node:gdpr:33.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:33.3
      ref_id: 33.3.c
      description: describe the likely consequences of the personal data breach;
      translations:
        sv:
          description: beskriva de sannolika konsekvenserna av personuppgiftsincidenten,
            och
    - urn: urn:intuitem:risk:req_node:gdpr:33.3.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:33.3
      ref_id: 33.3.d
      description: describe the measures taken or proposed to be taken by the controller
        to address the personal data breach, including, where appropriate, measures
        to mitigate its possible adverse effects.
      translations:
        sv:
          description: "beskriva de \xE5tg\xE4rder som den personuppgiftsansvarige\
            \ har vidtagit eller f\xF6reslagit f\xF6r att \xE5tg\xE4rda personuppgiftsincidenten,\
            \ inbegripet, n\xE4r s\xE5 \xE4r l\xE4mpligt, \xE5tg\xE4rder f\xF6r att\
            \ mildra dess potentiella negativa effekter."
    - urn: urn:intuitem:risk:req_node:gdpr:33.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-33
      ref_id: '33.4'
      description: Where, and in so far as, it is not possible to provide the information
        at the same time, the information may be provided in phases without undue
        further delay.
      translations:
        sv:
          description: "Om och i den utstr\xE4ckning det inte \xE4r m\xF6jligt att\
            \ tillhandah\xE5lla informationen samtidigt, f\xE5r informationen tillhandah\xE5\
            llas i omg\xE5ngar utan on\xF6digt ytterligare dr\xF6jsm\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:33.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-33
      ref_id: '33.5'
      description: The controller shall document any personal data breaches, comprising
        the facts relating to the personal data breach, its effects and the remedial
        action taken. That documentation shall enable the supervisory authority to
        verify compliance with this Article.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska dokumentera alla personuppgiftsincidenter,\
            \ inbegripet omst\xE4ndigheterna kring personuppgiftsincidenten, dess\
            \ effekter och de korrigerande \xE5tg\xE4rder som vidtagits. Dokumentationen\
            \ ska g\xF6ra det m\xF6jligt f\xF6r tillsynsmyndigheten att kontrollera\
            \ efterlevnaden av denna artikel."
    - urn: urn:intuitem:risk:req_node:gdpr:article-34
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node503
      ref_id: Article 34
      description: Communication of a personal data breach to the data subject
      translations:
        sv:
          name: Artikel 34
          description: Information till den registrerade om en personuppgiftsincident
    - urn: urn:intuitem:risk:req_node:gdpr:34.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-34
      ref_id: '34.1'
      description: When the personal data breach is likely to result in a high risk
        to the rights and freedoms of natural persons, the controller shall communicate
        the personal data breach to the data subject without undue delay.
      translations:
        sv:
          description: "Om personuppgiftsincidenten sannolikt leder till en h\xF6\
            g risk f\xF6r fysiska personers r\xE4ttigheter och friheter ska den personuppgiftsansvarige\
            \ utan on\xF6digt dr\xF6jsm\xE5l informera den registrerade om personuppgiftsincidenten."
    - urn: urn:intuitem:risk:req_node:gdpr:34.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-34
      ref_id: '34.2'
      description: The communication to the data subject referred to in paragraph
        1 of this Article shall describe in clear and plain language the nature of
        the personal data breach and contain at least the information and measures
        referred to in points (b), (c) and (d) of Article 33(3).
      translations:
        sv:
          description: "Den information till den registrerade som avses i punkt 1\
            \ i denna artikel ska inneh\xE5lla en tydlig och klar beskrivning av personuppgiftsincidentens\
            \ art och \xE5tminstone de upplysningar och \xE5tg\xE4rder som avses i\
            \ artikel 33.3 b, c och d."
    - urn: urn:intuitem:risk:req_node:gdpr:34.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-34
      ref_id: '34.3'
      description: 'The communication to the data subject referred to in paragraph
        1 shall not be required if any of the following conditions are met:'
      translations:
        sv:
          description: "Information till den registrerade i enlighet med punkt 1 kr\xE4\
            vs inte om n\xE5got av f\xF6ljande villkor \xE4r uppfyllt:"
    - urn: urn:intuitem:risk:req_node:gdpr:34.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:34.3
      ref_id: 34.3.a
      description: the controller has implemented appropriate technical and organisational
        protection measures, and those measures were applied to the personal data
        affected by the personal data breach, in particular those that render the
        personal data unintelligible to any person who is not authorised to access
        it, such as encryption;
      translations:
        sv:
          description: "Den personuppgiftsansvarige har genomf\xF6rt l\xE4mpliga tekniska\
            \ och organisatoriska skydds\xE5tg\xE4rder och dessa \xE5tg\xE4rder till\xE4\
            mpats p\xE5 de personuppgifter som p\xE5verkades av personuppgiftsincidenten,\
            \ i synnerhet s\xE5dana som ska g\xF6ra uppgifterna ol\xE4sbara f\xF6\
            r alla personer som inte \xE4r beh\xF6riga att f\xE5 tillg\xE5ng till\
            \ personuppgifterna, s\xE5som kryptering."
    - urn: urn:intuitem:risk:req_node:gdpr:34.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:34.3
      ref_id: 34.3.b
      description: the controller has taken subsequent measures which ensure that
        the high risk to the rights and freedoms of data subjects referred to in paragraph
        1 is no longer likely to materialise;
      translations:
        sv:
          description: "Den personuppgiftsansvarige har vidtagit ytterligare \xE5\
            tg\xE4rder som s\xE4kerst\xE4ller att den h\xF6ga risk f\xF6r registrerades\
            \ r\xE4ttigheter och friheter som avses i punkt 1 sannolikt inte l\xE4\
            ngre kommer att uppst\xE5."
    - urn: urn:intuitem:risk:req_node:gdpr:34.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:34.3
      ref_id: 34.3.c
      description: it would involve disproportionate effort. In such a case, there
        shall instead be a public communication or similar measure whereby the data
        subjects are informed in an equally effective manner.
      translations:
        sv:
          description: "Det skulle inbegripa en oproportionell anstr\xE4ngning. I\
            \ s\xE5 fall ska i st\xE4llet allm\xE4nheten informeras eller en liknande\
            \ \xE5tg\xE4rd vidtas genom vilken de registrerade informeras p\xE5 ett\
            \ lika effektivt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:34.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-34
      ref_id: '34.4'
      description: If the controller has not already communicated the personal data
        breach to the data subject, the supervisory authority, having considered the
        likelihood of the personal data breach resulting in a high risk, may require
        it to do so or may decide that any of the conditions referred to in paragraph
        3 are met.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige inte redan har informerat den\
            \ registrerade om personuppgiftsincidenten f\xE5r tillsynsmyndigheten,\
            \ efter att ha bed\xF6mt sannolikheten f\xF6r att personuppgiftsincidenten\
            \ medf\xF6r en h\xF6g risk, kr\xE4va att personuppgiftsbitr\xE4det g\xF6\
            r det eller f\xE5r besluta att n\xE5got av de villkor som avses i punkt\_\
            3 uppfylls."
    - urn: urn:intuitem:risk:req_node:gdpr:node532
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      name: Section 3
      description: Data protection impact assessment and prior consultation
      translations:
        sv:
          name: Avsnitt 3
          description: "Konsekvensbed\xF6mning avseende dataskydd samt f\xF6reg\xE5\
            ende samr\xE5d"
    - urn: urn:intuitem:risk:req_node:gdpr:article-35
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node532
      ref_id: Article 35
      description: Data protection impact assessment
      translations:
        sv:
          name: Artikel 35
          description: "Konsekvensbed\xF6mning avseende dataskydd"
    - urn: urn:intuitem:risk:req_node:gdpr:35.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.1'
      description: Where a type of processing in particular using new technologies,
        and taking into account the nature, scope, context and purposes of the processing,
        is likely to result in a high risk to the rights and freedoms of natural persons,
        the controller shall, prior to the processing, carry out an assessment of
        the impact of the envisaged processing operations on the protection of personal
        data. A single assessment may address a set of similar processing operations
        that present similar high risks.
      translations:
        sv:
          description: "Om en typ av behandling, s\xE4rskilt med anv\xE4ndning av\
            \ ny teknik och med beaktande av dess art, omfattning, sammanhang och\
            \ \xE4ndam\xE5l, sannolikt leder till en h\xF6g risk f\xF6r fysiska personers\
            \ r\xE4ttigheter och friheter ska den personuppgiftsansvarige f\xF6re\
            \ behandlingen utf\xF6ra en bed\xF6mning av den planerade behandlingens\
            \ konsekvenser f\xF6r skyddet av personuppgifter. En enda bed\xF6mning\
            \ kan omfatta en serie liknande behandlingar som medf\xF6r liknande h\xF6\
            ga risker."
    - urn: urn:intuitem:risk:req_node:gdpr:35.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.2'
      description: The controller shall seek the advice of the data protection officer,
        where designated, when carrying out a data protection impact assessment.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska r\xE5dfr\xE5ga dataskyddsombudet,\
            \ om ett s\xE5dant utsetts, vid genomf\xF6rande av en konsekvensbed\xF6\
            mning avseende dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:35.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.3'
      description: 'A data protection impact assessment referred to in paragraph 1
        shall in particular be required in the case of:'
      translations:
        sv:
          description: "En konsekvensbed\xF6mning avseende dataskydd som avses i punkt\
            \ 1 ska s\xE4rskilt kr\xE4vas i\_f\xF6ljande fall:"
    - urn: urn:intuitem:risk:req_node:gdpr:35.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.3
      ref_id: 35.3.a
      description: a systematic and extensive evaluation of personal aspects relating
        to natural persons which is based on automated processing, including profiling,
        and on which decisions are based that produce legal effects concerning the
        natural person or similarly significantly affect the natural person;
      translations:
        sv:
          description: "En systematisk och omfattande bed\xF6mning av fysiska personers\
            \ personliga aspekter som grundar sig p\xE5 automatisk behandling, inbegripet\
            \ profilering, och p\xE5 vilken beslut grundar sig som har r\xE4ttsliga\
            \ f\xF6ljder f\xF6r fysiska personer eller p\xE5 liknande s\xE4tt i\_\
            betydande grad p\xE5verkar fysiska personer."
    - urn: urn:intuitem:risk:req_node:gdpr:35.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.3
      ref_id: 35.3.b
      description: processing on a large scale of special categories of data referred
        to in Article 9(1), or of personal data relating to criminal convictions and
        offences referred to in Article 10; or
      translations:
        sv:
          description: "Behandling i stor omfattning av s\xE4rskilda kategorier av\
            \ uppgifter, som avses i\_artikel\_9.1, eller av personuppgifter som r\xF6\
            r f\xE4llande domar i brottm\xE5l och \xF6vertr\xE4delser som avses i\
            \ artikel 10."
    - urn: urn:intuitem:risk:req_node:gdpr:35.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.3
      ref_id: 35.3.c
      description: a systematic monitoring of a publicly accessible area on a large
        scale.
      translations:
        sv:
          description: "Systematisk \xF6vervakning av en allm\xE4n plats i stor omfattning."
    - urn: urn:intuitem:risk:req_node:gdpr:35.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.4'
      description: The supervisory authority shall establish and make public a list
        of the kind of processing operations which are subject to the requirement
        for a data protection impact assessment pursuant to paragraph 1. The supervisory
        authority shall communicate those lists to the Board referred to in Article
        68.
      translations:
        sv:
          description: "Tillsynsmyndigheten ska uppr\xE4tta och offentligg\xF6ra en\
            \ f\xF6rteckning \xF6ver det slags behandlingsverksamheter som omfattas\
            \ av kravet p\xE5 en konsekvensbed\xF6mning avseende dataskydd i enlighet\
            \ med punkt 1. Tillsynsmyndigheten ska \xF6vers\xE4nda dessa f\xF6rteckningar\
            \ till den styrelse som avses i artikel 68."
    - urn: urn:intuitem:risk:req_node:gdpr:35.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.5'
      description: The supervisory authority may also establish and make public a
        list of the kind of processing operations for which no data protection impact
        assessment is required. The supervisory authority shall communicate those
        lists to the Board.
      translations:
        sv:
          description: "Tillsynsmyndigheten f\xE5r ocks\xE5 uppr\xE4tta och offentligg\xF6\
            ra en f\xF6rteckning \xF6ver det slags behandlingsverksamheter som inte\
            \ kr\xE4ver n\xE5gon konsekvensbed\xF6mning avseende dataskydd. Tillsynsmyndigheten\
            \ ska \xF6vers\xE4nda dessa f\xF6rteckningar till styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:35.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.6'
      description: Prior to the adoption of the lists referred to in paragraphs 4
        and 5, the competent supervisory authority shall apply the consistency mechanism
        referred to in Article 63 where such lists involve processing activities which
        are related to the offering of goods or services to data subjects or to the
        monitoring of their behaviour in several Member States, or may substantially
        affect the free movement of personal data within the Union.
      translations:
        sv:
          description: "Innan de f\xF6rteckningar som avses i punkterna 4 och 5 antas\
            \ ska den beh\xF6riga tillsynsmyndigheten till\xE4mpa den mekanism f\xF6\
            r enhetlighet som avses i artikel 63 om en s\xE5dan f\xF6rteckning inbegriper\
            \ behandling som r\xF6r erbjudandet av varor eller tj\xE4nster till registrerade,\
            \ eller \xF6vervakning av deras beteende i flera. medlemsstater, eller\
            \ som v\xE4sentligt kan p\xE5verka den fria r\xF6rligheten f\xF6r personuppgifter\
            \ i unionen"
    - urn: urn:intuitem:risk:req_node:gdpr:35.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.7'
      description: 'The assessment shall contain at least:'
      translations:
        sv:
          description: "Bed\xF6mningen ska inneh\xE5lla \xE5tminstone"
    - urn: urn:intuitem:risk:req_node:gdpr:35.7.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.7
      ref_id: 35.7.a
      description: a systematic description of the envisaged processing operations
        and the purposes of the processing, including, where applicable, the legitimate
        interest pursued by the controller;
      translations:
        sv:
          description: "en systematisk beskrivning av den planerade behandlingen och\
            \ behandlingens syften, inbegripet, n\xE4r det \xE4r l\xE4mpligt, den\
            \ personuppgiftsansvariges ber\xE4ttigade intresse,"
    - urn: urn:intuitem:risk:req_node:gdpr:35.7.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.7
      ref_id: 35.7.b
      description: an assessment of the necessity and proportionality of the processing
        operations in relation to the purposes;
      translations:
        sv:
          description: "en bed\xF6mning av behovet av och proportionaliteten hos behandlingen\
            \ i f\xF6rh\xE5llande till syftena,"
    - urn: urn:intuitem:risk:req_node:gdpr:35.7.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.7
      ref_id: 35.7.c
      description: an assessment of the risks to the rights and freedoms of data subjects
        referred to in paragraph 1; and
      translations:
        sv:
          description: "en bed\xF6mning av de risker f\xF6r de registrerades r\xE4\
            ttigheter och friheter som avses i\_punkt 1, och"
    - urn: urn:intuitem:risk:req_node:gdpr:35.7.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:35.7
      ref_id: 35.7.d
      description: the measures envisaged to address the risks, including safeguards,
        security measures and mechanisms to ensure the protection of personal data
        and to demonstrate compliance with this Regulation taking into account the
        rights and legitimate interests of data subjects and other persons concerned.
      translations:
        sv:
          description: "de \xE5tg\xE4rder som planeras f\xF6r att hantera riskerna,\
            \ inbegripet skydds\xE5tg\xE4rder, s\xE4kerhets\xE5tg\xE4rder och rutiner\
            \ f\xF6r att s\xE4kerst\xE4lla skyddet av personuppgifterna och f\xF6\
            r att visa att denna f\xF6rordning efterlevs, med h\xE4nsyn till de registrerades\
            \ och andra ber\xF6rda personers r\xE4ttigheter och ber\xE4ttigade intressen."
    - urn: urn:intuitem:risk:req_node:gdpr:35.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.8'
      description: Compliance with approved codes of conduct referred to in Article
        40 by the relevant controllers or processors shall be taken into due account
        in assessing the impact of the processing operations performed by such controllers
        or processors, in particular for the purposes of a data protection impact
        assessment.
      translations:
        sv:
          description: "De ber\xF6rda personuppgiftsansvarigas eller personuppgiftsbitr\xE4\
            denas efterlevnad av godk\xE4nda uppf\xF6randekoder enligt artikel 40\
            \ ska p\xE5 l\xE4mpligt s\xE4tt beaktas vid bed\xF6mningen av konsekvenserna\
            \ av de behandlingar som utf\xF6rs av dessa personuppgiftsansvariga eller\
            \ personuppgiftsbitr\xE4den, framf\xF6r allt n\xE4r det g\xE4ller att\
            \ ta fram en konsekvensbed\xF6mning avseende dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:35.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.9'
      description: Where appropriate, the controller shall seek the views of data
        subjects or their representatives on the intended processing, without prejudice
        to the protection of commercial or public interests or the security of processing
        operations.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska, n\xE4r det \xE4r l\xE4mpligt,\
            \ inh\xE4mta synpunkter fr\xE5n de registrerade eller deras f\xF6retr\xE4\
            dare om den avsedda behandlingen, utan att det p\xE5verkar skyddet av\
            \ kommersiella eller allm\xE4nna intressen eller behandlingens s\xE4kerhet."
    - urn: urn:intuitem:risk:req_node:gdpr:35.10
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.10'
      description: Where processing pursuant to point (c) or (e) of Article 6(1) has
        a legal basis in Union law or in the law of the Member State to which the
        controller is subject, that law regulates the specific processing operation
        or set of operations in question, and a data protection impact assessment
        has already been carried out as part of a general impact assessment in the
        context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply
        unless Member States deem it to be necessary to carry out such an assessment
        prior to processing activities.
      translations:
        sv:
          description: "Om behandling enligt artikel 6.1 c eller e har en r\xE4ttslig\
            \ grund i unionsr\xE4tten eller i en medlemsstats nationella r\xE4tt som\
            \ den personuppgiftsansvarige omfattas av, reglerar den r\xE4tten den\
            \ aktuella specifika behandlings\xE5tg\xE4rden eller serien av \xE5tg\xE4\
            rder i fr\xE5ga och en konsekvensbed\xF6mning avseende dataskydd redan\
            \ har genomf\xF6rts som en del av en allm\xE4n konsekvensbed\xF6mning\
            \ i samband med antagandet av denna r\xE4ttsliga grund, ska punkterna\_\
            1\u20137 inte g\xE4lla, om inte medlemsstaterna anser det n\xF6dv\xE4\
            ndigt att utf\xF6ra en s\xE5dan bed\xF6mning f\xF6re behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:35.11
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-35
      ref_id: '35.11'
      description: Where necessary, the controller shall carry out a review to assess
        if processing is performed in accordance with the data protection impact assessment
        at least when there is a change of the risk represented by processing operations.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska vid behov genomf\xF6ra en\
            \ \xF6versyn f\xF6r att bed\xF6ma om behandlingen genomf\xF6rs i enlighet\
            \ med konsekvensbed\xF6mningen avseende dataskydd \xE5tminstone n\xE4\
            r den risk som behandlingen medf\xF6r f\xF6r\xE4ndras."
    - urn: urn:intuitem:risk:req_node:gdpr:article-36
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node532
      ref_id: Article 36
      description: Prior consultation
      translations:
        sv:
          name: Artikel 36
          description: "F\xF6rhandssamr\xE5d"
    - urn: urn:intuitem:risk:req_node:gdpr:36.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-36
      ref_id: '36.1'
      description: The controller shall consult the supervisory authority prior to
        processing where a data protection impact assessment under Article 35 indicates
        that the processing would result in a high risk in the absence of measures
        taken by the controller to mitigate the risk.
      translations:
        sv:
          description: "Den personuppgiftsansvarige ska samr\xE5da med tillsynsmyndigheten\
            \ f\xF6re behandling om en konsekvensbed\xF6mning avseende dataskydd enligt\
            \ artikel 35 visar att behandlingen skulle leda till en h\xF6g risk om\
            \ inte den personuppgiftsansvarige vidtar \xE5tg\xE4rder f\xF6r att minska\
            \ risken."
    - urn: urn:intuitem:risk:req_node:gdpr:36.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-36
      ref_id: '36.2'
      description: Where the supervisory authority is of the opinion that the intended
        processing referred to in paragraph 1 would infringe this Regulation, in particular
        where the controller has insufficiently identified or mitigated the risk,
        the supervisory authority shall, within period of up to eight weeks of receipt
        of the request for consultation, provide written advice to the controller
        and, where applicable to the processor, and may use any of its powers referred
        to in Article 58. That period may be extended by six weeks, taking into account
        the complexity of the intended processing. The supervisory authority shall
        inform the controller and, where applicable, the processor, of any such extension
        within one month of receipt of the request for consultation together with
        the reasons for the delay. Those periods may be suspended until the supervisory
        authority has obtained information it has requested for the purposes of the
        consultation.
      translations:
        sv:
          description: "Om tillsynsmyndigheten anser att den planerade behandling\
            \ som avses i punkt\_1 skulle strida mot denna f\xF6rordning, s\xE4rskilt\
            \ om den personuppgiftsansvarige inte i tillr\xE4cklig m\xE5n har fastst\xE4\
            llt eller reducerat risken, ska tillsynsmyndigheten inom en period p\xE5\
            \ h\xF6gst\_\xE5tta\_veckor fr\xE5n det att beg\xE4ran om samr\xE5d mottagits,\
            \ ge den personuppgiftsansvarige och i\_till\xE4mpliga fall personuppgiftsbitr\xE4\
            det skriftliga r\xE5d och f\xE5r utnyttja alla de befogenheter som den\
            \ har enligt artikel 58. Denna period f\xE5r f\xF6rl\xE4ngas med sex veckor\
            \ beroende p\xE5 hur komplicerad den planerade behandlingen \xE4r. Tillsynsmyndigheten\
            \ ska informera den personuppgiftsansvarige och, i till\xE4mpliga fall,\
            \ personuppgiftsbitr\xE4det om en s\xE5dan f\xF6rl\xE4ngning inom en m\xE5\
            nad fr\xE5n det att beg\xE4ran om samr\xE5d mottagits, tillsammans med\
            \ orsakerna till f\xF6rseningen. Dessa perioder f\xE5r tillf\xE4lligt\
            \ upph\xF6ra att l\xF6pa i avvaktan p\xE5 att tillsynsmyndigheten erh\xE5\
            ller den information som den har beg\xE4rt med tanke p\xE5 samr\xE5det."
    - urn: urn:intuitem:risk:req_node:gdpr:36.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-36
      ref_id: '36.3'
      description: 'When consulting the supervisory authority pursuant to paragraph
        1, the controller shall provide the supervisory authority with:'
      translations:
        sv:
          description: "Vid samr\xE5d med tillsynsmyndigheten enligt punkt 1 ska den\
            \ personuppgiftsansvarige till tillsynsmyndigheten l\xE4mna"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.a
      description: where applicable, the respective responsibilities of the controller,
        joint controllers and processors involved in the processing, in particular
        for processing within a group of undertakings;
      translations:
        sv:
          description: "i till\xE4mpliga fall de respektive ansvarsomr\xE5dena f\xF6\
            r de personuppgiftsansvariga, gemensamt personuppgiftsansvariga och personuppgiftsbitr\xE4\
            den som medverkar vid behandlingen, framf\xF6r allt vid behandling inom\
            \ en koncern,"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.b
      description: the purposes and means of the intended processing;
      translations:
        sv:
          description: "\xE4ndam\xE5len med och medlen f\xF6r den avsedda behandlingen,"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.c
      description: the measures and safeguards provided to protect the rights and
        freedoms of data subjects pursuant to this Regulation;
      translations:
        sv:
          description: "de \xE5tg\xE4rder som vidtas och de garantier som l\xE4mnas\
            \ f\xF6r att skydda de registrerades r\xE4ttigheter och friheter enligt\
            \ denna f\xF6rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.d
      description: where applicable, the contact details of the data protection officer;
      translations:
        sv:
          description: "i till\xE4mpliga fall kontaktuppgifter till dataskyddsombudet,"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.e
      description: the data protection impact assessment provided for in Article 35;
        and
      translations:
        sv:
          description: "konsekvensbed\xF6mningen avseende dataskydd enligt artikel\
            \ 35, och"
    - urn: urn:intuitem:risk:req_node:gdpr:36.3.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:36.3
      ref_id: 36.3.f
      description: any other information requested by the supervisory authority.
      translations:
        sv:
          description: "all annan information som beg\xE4rs av tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:36.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-36
      ref_id: '36.4'
      description: Member States shall consult the supervisory authority during the
        preparation of a proposal for a legislative measure to be adopted by a national
        parliament, or of a regulatory measure based on such a legislative measure,
        which relates to processing.
      translations:
        sv:
          description: "Medlemsstaterna ska samr\xE5da med tillsynsmyndigheten vid\
            \ utarbetandet av ett f\xF6rslag till lagstiftnings\xE5tg\xE4rd som ska\
            \ antas av ett nationellt parlament eller av en reglerings\xE5tg\xE4rd\
            \ som grundar sig p\xE5 en s\xE5dan lagstiftnings\xE5tg\xE4rd som r\xF6\
            r behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:36.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-36
      ref_id: '36.5'
      description: Notwithstanding paragraph 1, Member State law may require controllers
        to consult with, and obtain prior authorisation from, the supervisory authority
        in relation to processing by a controller for the performance of a task carried
        out by the controller in the public interest, including processing in relation
        to social protection and public health.
      annotation: Comply with national law
      translations:
        sv:
          description: "Trots vad som s\xE4gs i punkt 1 f\xE5r det i medlemsstaternas\
            \ nationella r\xE4tt kr\xE4vas att personuppgiftsansvariga ska samr\xE5\
            da med, och erh\xE5lla f\xF6rhandstillst\xE5nd av, tillsynsmyndigheten\
            \ n\xE4r det g\xE4ller en personuppgiftsansvarigs behandling f\xF6r utf\xF6\
            randet av en uppgift som den personuppgiftsansvarige utf\xF6r av allm\xE4\
            nt intresse, inbegripet behandling avseende social trygghet och folkh\xE4\
            lsa."
          annotation: Comply with national law
    - urn: urn:intuitem:risk:req_node:gdpr:node564
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      name: Section 4
      description: Data protection officer
      translations:
        sv:
          name: Avsnitt 4
          description: Dataskyddsombud
    - urn: urn:intuitem:risk:req_node:gdpr:article-37
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node564
      ref_id: Article 37
      description: Designation of the data protection officer
      translations:
        sv:
          name: Artikel 37
          description: "Utn\xE4mning av dataskyddsombudet"
    - urn: urn:intuitem:risk:req_node:gdpr:37.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.1'
      description: 'The controller and the processor shall designate a data protection
        officer in any case where:'
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ ska under alla omst\xE4ndigheter utn\xE4mna ett\_dataskyddsombud om"
    - urn: urn:intuitem:risk:req_node:gdpr:37.1.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:37.1
      ref_id: 37.1.a
      description: the processing is carried out by a public authority or body, except
        for courts acting in their judicial capacity;
      translations:
        sv:
          description: "behandlingen genomf\xF6rs av en myndighet eller ett offentligt\
            \ organ, f\xF6rutom n\xE4r detta sker som en del av domstolarnas d\xF6\
            mande verksamhet,"
    - urn: urn:intuitem:risk:req_node:gdpr:37.1.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:37.1
      ref_id: 37.1.b
      description: the core activities of the controller or the processor consist
        of processing operations which, by virtue of their nature, their scope and/or
        their purposes, require regular and systematic monitoring of data subjects
        on a large scale; or
      translations:
        sv:
          description: "den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets k\xE4rnverksamhet best\xE5r av behandling som, p\xE5 grund av sin\
            \ karakt\xE4r, sin omfattning och/eller sina \xE4ndam\xE5l, kr\xE4ver\
            \ regelbunden och systematisk \xF6vervakning av de registrerade i stor\
            \ omfattning, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:37.1.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:37.1
      ref_id: 37.1.c
      description: the core activities of the controller or the processor consist
        of processing on a large scale of special categories of data pursuant to Article
        9 or personal data relating to criminal convictions and offences referred
        to in Article 10.
      translations:
        sv:
          description: "den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets k\xE4rnverksamhet best\xE5r av behandling i stor omfattning av s\xE4\
            rskilda kategorier av uppgifter i enlighet med artikel 9 och personuppgifter\
            \ som r\xF6r f\xE4llande domar i brottm\xE5l och \xF6vertr\xE4delser,\
            \ som avses i artikel 10."
    - urn: urn:intuitem:risk:req_node:gdpr:37.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.2'
      description: A group of undertakings may appoint a single data protection officer
        provided that a data protection officer is easily accessible from each establishment.
      translations:
        sv:
          description: "En koncern f\xE5r utn\xE4mna ett enda dataskyddsombud om det\
            \ p\xE5 varje etableringsort \xE4r l\xE4tt att n\xE5 ett dataskyddsombud."
    - urn: urn:intuitem:risk:req_node:gdpr:37.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.3'
      description: Where the controller or the processor is a public authority or
        body, a single data protection officer may be designated for several such
        authorities or bodies, taking account of their organisational structure and
        size.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det \xE4r en myndighet eller ett offentligt organ, f\xE5r ett enda dataskyddsombud\
            \ utn\xE4mnas f\xF6r flera s\xE5dana myndigheter eller organ, med h\xE4\
            nsyn till deras organisationsstruktur och storlek."
    - urn: urn:intuitem:risk:req_node:gdpr:37.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.4'
      description: In cases other than those referred to in paragraph 1, the controller
        or processor or associations and other bodies representing categories of controllers
        or processors may or, where required by Union or Member State law shall, designate
        a data protection officer. The data protection officer may act for such associations
        and other bodies representing controllers or processors.
      translations:
        sv:
          description: "I andra fall \xE4n de som avses i punkt 1 f\xE5r eller, om\
            \ s\xE5 kr\xE4vs enligt unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt, ska den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det eller sammanslutningar och andra organ som f\xF6retr\xE4der kategorier\
            \ av personuppgiftsansvariga eller personuppgiftsbitr\xE4den utn\xE4mna\
            \ ett dataskyddsombud. Dataskyddsombudet f\xE5r agera f\xF6r s\xE5dana\
            \ sammanslutningar och andra organ som f\xF6retr\xE4der personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den."
    - urn: urn:intuitem:risk:req_node:gdpr:37.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.5'
      description: The data protection officer shall be designated on the basis of
        professional qualities and, in particular, expert knowledge of data protection
        law and practices and the ability to fulfil the tasks referred to in Article
        39.
      translations:
        sv:
          description: "Dataskyddsombudet ska utses p\xE5 grundval av yrkesm\xE4ssiga\
            \ kvalifikationer och, i\_synnerhet, sakkunskap om lagstiftning och praxis\
            \ avseende dataskydd samt f\xF6rm\xE5gan att fullg\xF6ra de uppgifter\
            \ som avses i artikel 39."
    - urn: urn:intuitem:risk:req_node:gdpr:37.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.6'
      description: The data protection officer may be a staff member of the controller
        or processor, or fulfil the tasks on the basis of a service contract.
      translations:
        sv:
          description: "Dataskyddsombudet f\xE5r ing\xE5 i den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets personal, eller utf\xF6ra uppgifterna\
            \ p\xE5 grundval av ett tj\xE4nsteavtal."
    - urn: urn:intuitem:risk:req_node:gdpr:37.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-37
      ref_id: '37.7'
      description: The controller or the processor shall publish the contact details
        of the data protection officer and communicate them to the supervisory authority.
      translations:
        sv:
          description: "Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det\
            \ ska offentligg\xF6ra dataskyddsombudets kontaktuppgifter och meddela\
            \ dessa till tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:article-38
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node564
      ref_id: Article 38
      description: Position of the data protection officer
      translations:
        sv:
          name: Artikel 38
          description: "Dataskyddsombudets st\xE4llning"
    - urn: urn:intuitem:risk:req_node:gdpr:38.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.1'
      description: The controller and the processor shall ensure that the data protection
        officer is involved, properly and in a timely manner, in all issues which
        relate to the protection of personal data.
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ ska s\xE4kerst\xE4lla att dataskyddsombudet p\xE5 ett korrekt s\xE4\
            tt och i god tid deltar i alla fr\xE5gor som r\xF6r skyddet av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:38.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.2'
      description: The controller and processor shall support the data protection
        officer in performing the tasks referred to in Article 39 by providing resources
        necessary to carry out those tasks and access to personal data and processing
        operations, and to maintain his or her expert knowledge.
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ ska st\xF6dja dataskyddsombudet i\_utf\xF6randet av de uppgifter som\
            \ avses i artikel 39 genom att tillhandah\xE5lla de resurser som kr\xE4\
            vs f\xF6r att fullg\xF6ra dessa uppgifter samt tillg\xE5ng till personuppgifter\
            \ och behandlingsf\xF6rfaranden, samt i uppr\xE4tth\xE5llandet av dennes\
            \ sakkunskap."
    - urn: urn:intuitem:risk:req_node:gdpr:38.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.3'
      description: The controller and processor shall ensure that the data protection
        officer does not receive any instructions regarding the exercise of those
        tasks. He or she shall not be dismissed or penalised by the controller or
        the processor for performing his tasks. The data protection officer shall
        directly report to the highest management level of the controller or the processor.
      translations:
        sv:
          description: "Den personuppgiftsansvarige och personuppgiftsbitr\xE4det\
            \ ska s\xE4kerst\xE4lla att uppgiftskyddsombudet inte tar emot instruktioner\
            \ som g\xE4ller utf\xF6randet av dessa uppgifter. Han eller hon f\xE5\
            r inte avs\xE4ttas eller bli f\xF6rem\xE5l f\xF6r sanktioner av den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det f\xF6r att ha utf\xF6rt sina uppgifter.\
            \ Dataskyddsombudet ska rapportera direkt till den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets h\xF6gsta f\xF6rvaltningsniv\xE5."
    - urn: urn:intuitem:risk:req_node:gdpr:38.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.4'
      description: Data subjects may contact the data protection officer with regard
        to all issues related to processing of their personal data and to the exercise
        of their rights under this Regulation.
      translations:
        sv:
          description: "Den registrerade f\xE5r kontakta dataskyddsombudet med avseende\
            \ p\xE5 alla fr\xE5gor som r\xF6r behandlingen av dennes personuppgifter\
            \ och ut\xF6vandet av dennes r\xE4ttigheter enligt denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:38.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.5'
      description: The data protection officer shall be bound by secrecy or confidentiality
        concerning the performance of his or her tasks, in accordance with Union or
        Member State law.
      translations:
        sv:
          description: "Dataskyddsombudet ska, n\xE4r det g\xE4ller dennes genomf\xF6\
            rande av sina uppgifter, vara bundet av sekretess eller konfidentialitet\
            \ i enlighet med unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt."
    - urn: urn:intuitem:risk:req_node:gdpr:38.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-38
      ref_id: '38.6'
      description: The data protection officer may fulfil other tasks and duties.
        The controller or processor shall ensure that any such tasks and duties do
        not result in a conflict of interests.
      translations:
        sv:
          description: "Dataskyddsombudet f\xE5r fullg\xF6ra andra uppgifter och uppdrag.\
            \ Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det ska se till\
            \ att s\xE5dana uppgifter och uppdrag inte leder till en intressekonflikt."
    - urn: urn:intuitem:risk:req_node:gdpr:article-39
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      ref_id: Article 39
      description: Tasks of the data protection officer
      translations:
        sv:
          name: Artikel 39
          description: Dataskyddsombudets uppgifter
    - urn: urn:intuitem:risk:req_node:gdpr:39.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-39
      ref_id: '39.1'
      description: 'The data protection officer shall have at least the following
        tasks:'
      translations:
        sv:
          description: "Dataskyddsombudet ska ha minst f\xF6ljande uppgifter:"
    - urn: urn:intuitem:risk:req_node:gdpr:39.1.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:39.1
      ref_id: 39.1.a
      description: to inform and advise the controller or the processor and the employees
        who carry out processing of their obligations pursuant to this Regulation
        and to other Union or Member State data protection provisions;
      translations:
        sv:
          description: "Att informera och ge r\xE5d till den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det och de anst\xE4llda som behandlar om\
            \ deras skyldigheter enligt denna f\xF6rordning och andra av unionens\
            \ eller medlemsstaternas dataskyddsbest\xE4mmelser."
    - urn: urn:intuitem:risk:req_node:gdpr:39.1.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:39.1
      ref_id: 39.1.b
      description: to monitor compliance with this Regulation, with other Union or
        Member State data protection provisions and with the policies of the controller
        or processor in relation to the protection of personal data, including the
        assignment of responsibilities, awareness-raising and training of staff involved
        in processing operations, and the related audits;
      translations:
        sv:
          description: "Att \xF6vervaka efterlevnaden av denna f\xF6rordning, av andra\
            \ av unionens eller medlemsstaternas dataskyddsbest\xE4mmelser och av\
            \ den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets strategi\
            \ f\xF6r skydd av personuppgifter, inbegripet ansvarstilldelning, information\
            \ till och utbildning av personal som deltar i behandling och tillh\xF6\
            rande granskning."
    - urn: urn:intuitem:risk:req_node:gdpr:39.1.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:39.1
      ref_id: 39.1.c
      description: to provide advice where requested as regards the data protection
        impact assessment and monitor its performance pursuant to Article 35;
      translations:
        sv:
          description: "Att p\xE5 beg\xE4ran ge r\xE5d vad g\xE4ller konsekvensbed\xF6\
            mningen avseende dataskydd och \xF6vervaka genomf\xF6randet av den enligt\
            \ artikel 35."
    - urn: urn:intuitem:risk:req_node:gdpr:39.1.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:39.1
      ref_id: 39.1.d
      description: to cooperate with the supervisory authority;
      translations:
        sv:
          description: Att samarbeta med tillsynsmyndigheten.
    - urn: urn:intuitem:risk:req_node:gdpr:39.1.e
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:39.1
      ref_id: 39.1.e
      description: to act as the contact point for the supervisory authority on issues
        relating to processing, including the prior consultation referred to in Article
        36, and to consult, where appropriate, with regard to any other matter.
      translations:
        sv:
          description: "Att fungera som kontaktpunkt f\xF6r tillsynsmyndigheten i\
            \ fr\xE5gor som r\xF6r behandling, inbegripet det f\xF6rhandssamr\xE5\
            d som avses i artikel 36, och vid behov samr\xE5da i alla andra fr\xE5\
            gor."
    - urn: urn:intuitem:risk:req_node:gdpr:39.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-39
      ref_id: '39.2'
      description: The data protection officer shall in the performance of his or
        her tasks have due regard to the risk associated with processing operations,
        taking into account the nature, scope, context and purposes of processing.
      translations:
        sv:
          description: "Dataskyddsombudet ska vid utf\xF6randet av sina uppgifter\
            \ ta vederb\xF6rlig h\xE4nsyn till de risker som \xE4r f\xF6rknippade\
            \ med behandling, med beaktande av behandlingens art, omfattning, sammanhang\
            \ och syften."
    - urn: urn:intuitem:risk:req_node:gdpr:node591
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-iv
      name: Section 5
      description: Codes of conduct and certification
      translations:
        sv:
          name: Avsnitt 5
          description: "Uppf\xF6randekod och certifiering"
    - urn: urn:intuitem:risk:req_node:gdpr:article-40
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node591
      ref_id: Article 40
      description: Codes of conduct
      translations:
        sv:
          name: Artikel 40
          description: "Uppf\xF6randekoder"
    - urn: urn:intuitem:risk:req_node:gdpr:40.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.1'
      description: The Member States, the supervisory authorities, the Board and the
        Commission shall encourage the drawing up of codes of conduct intended to
        contribute to the proper application of this Regulation, taking account of
        the specific features of the various processing sectors and the specific needs
        of micro, small and medium-sized enterprises.
      translations:
        sv:
          description: "Medlemsstaterna, tillsynsmyndigheterna, styrelsen och kommissionen\
            \ ska uppmuntra utarbetandet av uppf\xF6randekoder avsedda att bidra till\
            \ att denna f\xF6rordning genomf\xF6rs korrekt, med h\xE4nsyn till s\xE4\
            rdragen hos de olika sektorer d\xE4r behandling sker, och de s\xE4rskilda\
            \ behoven hos mikrof\xF6retag samt sm\xE5 och medelstora f\xF6retag."
    - urn: urn:intuitem:risk:req_node:gdpr:40.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.2'
      description: 'Associations and other bodies representing categories of controllers
        or processors may prepare codes of conduct, or amend or extend such codes,
        for the purpose of specifying the application of this Regulation, such as
        with regard to:'
      translations:
        sv:
          description: "Sammanslutningar och andra organ som f\xF6retr\xE4der kategorier\
            \ av personuppgiftsansvariga eller personuppgiftsbitr\xE4den f\xE5r utarbeta\
            \ uppf\xF6randekoder, eller \xE4ndra eller ut\xF6ka s\xE5dana koder, i\
            \ syfte att specificera till\xE4mpningen av denna f\xF6rordning, till\
            \ exempel n\xE4r det g\xE4ller"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.a
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.a
      description: fair and transparent processing;
      translations:
        sv:
          description: "r\xE4ttvis och \xF6ppen behandling,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.b
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.b
      description: the legitimate interests pursued by controllers in specific contexts;
      translations:
        sv:
          description: "personuppgiftsansvarigas ber\xE4ttigade intressen i s\xE4\
            rskilda sammanhang,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.c
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.c
      description: the collection of personal data;
      translations:
        sv:
          description: insamling av personuppgifter,
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.d
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.d
      description: the pseudonymisation of personal data;
      translations:
        sv:
          description: pseudonymisering av personuppgifter,
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.e
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.e
      description: the information provided to the public and to data subjects;
      translations:
        sv:
          description: "information till allm\xE4nheten och de registrerade,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.f
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.f
      description: the exercise of the rights of data subjects;
      translations:
        sv:
          description: "ut\xF6vande av registrerades r\xE4ttigheter,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.g
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.g
      description: the information provided to, and the protection of, children, and
        the manner in which the consent of the holders of parental responsibility
        over children is to be obtained;
      translations:
        sv:
          description: "information till och skydd av barn samt metoderna f\xF6r att\
            \ erh\xE5lla samtycke fr\xE5n de personer som har f\xF6r\xE4ldraansvar\
            \ f\xF6r barn,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.h
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.h
      description: the measures and procedures referred to in Articles 24 and 25 and
        the measures to ensure security of processing referred to in Article 32;
      translations:
        sv:
          description: "\xE5tg\xE4rder och f\xF6rfaranden som avses i artiklarna 24\
            \ och 25 samt \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla s\xE4kerhet\
            \ vid behandling i enlighet med artikel 32,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.i
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.i
      description: the notification of personal data breaches to supervisory authorities
        and the communication of such personal data breaches to data subjects;
      translations:
        sv:
          description: "anm\xE4lan av personuppgiftsincidenter till tillsynsmyndigheter\
            \ och meddelande av s\xE5dana personuppgiftsincidenter till registrerade,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.j
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.j
      description: the transfer of personal data to third countries or international
        organisations; or
      translations:
        sv:
          description: "\xF6verf\xF6ring av personuppgifter till tredjel\xE4nder eller\
            \ internationella organisationer,"
    - urn: urn:intuitem:risk:req_node:gdpr:40.2.k
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:40.2
      ref_id: 40.2.k
      description: out-of-court proceedings and other dispute resolution procedures
        for resolving disputes between controllers and data subjects with regard to
        processing, without prejudice to the rights of data subjects pursuant to Articles
        77 and 79.
      translations:
        sv:
          description: "utomr\xE4ttsliga f\xF6rfaranden och andra tvistl\xF6sningsf\xF6\
            rfaranden f\xF6r l\xF6sande av tvister mellan personuppgiftsansvariga\
            \ och registrerade n\xE4r det g\xE4ller behandling, utan att detta p\xE5\
            verkar registrerades r\xE4ttigheter enligt artiklarna 77 och\_79."
    - urn: urn:intuitem:risk:req_node:gdpr:40.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.3'
      description: In addition to adherence by controllers or processors subject to
        this Regulation, codes of conduct approved pursuant to paragraph 5 of this
        Article and having general validity pursuant to paragraph 9 of this Article
        may also be adhered to by controllers or processors that are not subject to
        this Regulation pursuant to Article 3 in order to provide appropriate safeguards
        within the framework of personal data transfers to third countries or international
        organisations under the terms referred to in point (e) of Article 46(2). Such
        controllers or processors shall make binding and enforceable commitments,
        via contractual or other legally binding instruments, to apply those appropriate
        safeguards including with regard to the rights of data subjects.
      translations:
        sv:
          description: "Uppf\xF6randekoder som \xE4r godk\xE4nda i enlighet med punkt\
            \ 5 i denna artikel och som har allm\xE4n giltighet enligt punkt 9 i denna\
            \ artikel f\xE5r, f\xF6rutom att de iakttas av personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den som omfattas av denna f\xF6rordning,\
            \ \xE4ven iakttas av personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            den som inte omfattas av denna f\xF6rordning enligt artikel 3, f\xF6r\
            \ att tillhandah\xE5lla l\xE4mpliga garantier inom ramen f\xF6r \xF6verf\xF6\
            ringar av personuppgifter till tredjel\xE4nder eller internationella organisationer\
            \ enligt villkoren i artikel 46.2 e. S\xE5dana personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den ska g\xF6ra bindande och verkst\xE4\
            llbara \xE5taganden, genom avtal eller andra r\xE4ttsligt bindande instrument,\
            \ att till\xE4mpa dessa l\xE4mpliga garantier inbegripet n\xE4r det g\xE4\
            ller registrerades r\xE4ttigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:40.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.4'
      description: A code of conduct referred to in paragraph 2 of this Article shall
        contain mechanisms which enable the body referred to in Article 41(1) to carry
        out the mandatory monitoring of compliance with its provisions by the controllers
        or processors which undertake to apply it, without prejudice to the tasks
        and powers of supervisory authorities competent pursuant to Article 55 or
        56.
      translations:
        sv:
          description: "Den uppf\xF6randekod som avses i punkt 2 i den h\xE4r artikeln\
            \ ska inneh\xE5lla mekanismer som g\xF6r det m\xF6jligt f\xF6r det organ\
            \ som avses i artikel 41.1 att utf\xF6ra den obligatoriska \xF6vervakningen\
            \ av att dess best\xE4mmelser efterlevs av personuppgiftsansvariga och\
            \ personuppgiftsbitr\xE4den som till\xE4mpar den, utan att det p\xE5verkar\
            \ uppgifter eller befogenheter f\xF6r de tillsynsmyndigheter som \xE4\
            r beh\xF6riga enligt artikel 55 eller 56."
    - urn: urn:intuitem:risk:req_node:gdpr:40.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.5'
      description: Associations and other bodies referred to in paragraph 2 of this
        Article which intend to prepare a code of conduct or to amend or extend an
        existing code shall submit the draft code, amendment or extension to the supervisory
        authority which is competent pursuant to Article 55. The supervisory authority
        shall provide an opinion on whether the draft code, amendment or extension
        complies with this Regulation and shall approve that draft code, amendment
        or extension if it finds that it provides sufficient appropriate safeguards.
      translations:
        sv:
          description: "Sammanslutningar och andra organ som avses i punkt 2 i den\
            \ h\xE4r artikeln som avser att utarbeta en uppf\xF6randekod eller \xE4\
            ndra eller ut\xF6ka befintliga uppf\xF6randekoder ska inge utkastet till\
            \ uppf\xF6randekod, \xE4ndringen eller ut\xF6kningen till den tillsynsmyndighet\
            \ som \xE4r beh\xF6rig enligt artikel 55. Tillsynsmyndigheten ska yttra\
            \ sig om huruvida utkastet till uppf\xF6randekod, \xE4ndring eller ut\xF6\
            kning \xF6verensst\xE4mmer med denna f\xF6rordning och ska godk\xE4nna\
            \ ett det utkastet till kod, \xE4ndring eller ut\xF6kning om den finner\
            \ att tillr\xE4ckliga garantier tillhandah\xE5lls."
    - urn: urn:intuitem:risk:req_node:gdpr:40.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.6'
      description: Where the draft code, or amendment or extension is approved in
        accordance with paragraph 5, and where the code of conduct concerned does
        not relate to processing activities in several Member States, the supervisory
        authority shall register and publish the code.
      translations:
        sv:
          description: "Om utkastet till kod, eller en \xE4ndring eller ut\xF6kning,\
            \ godk\xE4nns i enlighet med punkt 5, och om den ber\xF6rda uppf\xF6randekoden\
            \ inte avser behandling i flera medlemsstater, ska tillsynsmyndigheten\
            \ registrera och offentligg\xF6ra uppf\xF6randekoden."
    - urn: urn:intuitem:risk:req_node:gdpr:40.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.7'
      description: Where a draft code of conduct relates to processing activities
        in several Member States, the supervisory authority which is competent pursuant
        to Article 55 shall, before approving the draft code, amendment or extension,
        submit it in the procedure referred to in Article 63 to the Board which shall
        provide an opinion on whether the draft code, amendment or extension complies
        with this Regulation or, in the situation referred to in paragraph 3 of this
        Article, provides appropriate safeguards.
      translations:
        sv:
          description: "Om ett utkast till uppf\xF6randekod avser behandling i flera\
            \ medlemsstater ska den tillsynsmyndighet som \xE4r beh\xF6rig enligt\
            \ artikel 55 innan den godk\xE4nner utkastet till kod, \xE4ndring eller\
            \ ut\xF6kning, inom ramen f\xF6r det f\xF6rfarande som avses i artikel\
            \ 63 \xF6verl\xE4mna det till styrelsen som ska avge ett yttrande om huruvida\
            \ utkastet till kod, \xE4ndring eller ut\xF6kning \xE4r f\xF6renlig med\
            \ denna f\xF6rordning eller, i de fall som avses i\_punkt\_3 i den h\xE4\
            r artikeln, tillhandah\xE5ller l\xE4mpliga garantier."
    - urn: urn:intuitem:risk:req_node:gdpr:40.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.8'
      description: Where the opinion referred to in paragraph 7 confirms that the
        draft code, amendment or extension complies with this Regulation, or, in the
        situation referred to in paragraph 3, provides appropriate safeguards, the
        Board shall submit its opinion to the Commission.
      translations:
        sv:
          description: "Om det i det yttrande som avses i punkt 7 bekr\xE4ftas att\
            \ utkastet till kod, \xE4ndring eller ut\xF6kning \xE4r f\xF6renligt med\
            \ denna f\xF6rordning, eller, i\_de fall som avses i punkt 3, tillhandah\xE5\
            ller l\xE4mpliga garantier, ska styrelsen inl\xE4mna sitt yttrande till\
            \ kommissionen."
    - urn: urn:intuitem:risk:req_node:gdpr:40.9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.9'
      description: The Commission may, by way of implementing acts, decide that the
        approved code of conduct, amendment or extension submitted to it pursuant
        to paragraph 8 of this Article have general validity within the Union. Those
        implementing acts shall be adopted in accordance with the examination procedure
        set out in Article 93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r, genom genomf\xF6randeakter, besluta att\
            \ den godk\xE4nda koden, \xE4ndringen eller ut\xF6kningen som getts in\
            \ till den enligt punkt\_8 i den h\xE4r artikeln har allm\xE4n giltighet\
            \ inom unionen. Dessa genomf\xF6randeakter ska antas i enlighet med det\
            \ granskningsf\xF6rfarande som avses i\_artikel\_93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:40.10
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.10'
      description: The Commission shall ensure appropriate publicity for the approved
        codes which have been decided as having general validity in accordance with
        paragraph 9.
      translations:
        sv:
          description: "Kommissionen ska se till att de godk\xE4nda koder om vilka\
            \ det har beslutats att de har allm\xE4n giltighet enligt punkt\_9 offentligg\xF6\
            rs p\xE5 l\xE4mpligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:40.11
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-40
      ref_id: '40.11'
      description: The Board shall collate all approved codes of conduct, amendments
        and extensions in a register and shall make them publicly available by way
        of appropriate means.
      translations:
        sv:
          description: "Styrelsen ska samla alla godk\xE4nda uppf\xF6randekoder, \xE4\
            ndringar och ut\xF6kningar i ett register och offentligg\xF6ra dem p\xE5\
            \ l\xE4mpligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:article-41
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node591
      ref_id: Article 41
      description: Monitoring of approved codes of conduct
      translations:
        sv:
          name: Artikel 41
          description: "\xD6vervakning av godk\xE4nda uppf\xF6randekoder"
    - urn: urn:intuitem:risk:req_node:gdpr:41.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.1'
      description: Without prejudice to the tasks and powers of the competent supervisory
        authority under Articles 57 and 58, the monitoring of compliance with a code
        of conduct pursuant to Article 40 may be carried out by a body which has an
        appropriate level of expertise in relation to the subject-matter of the code
        and is accredited for that purpose by the competent supervisory authority.
      translations:
        sv:
          description: "Utan att det p\xE5verkar den ber\xF6rda tillsynsmyndighetens\
            \ uppgifter och befogenheter enligt artiklarna 57 och 58 f\xE5r \xF6vervakningen\
            \ av efterlevnaden av en uppf\xF6randekod i\_enlighet med artikel 40 utf\xF6\
            ras av ett organ som har en l\xE4mplig expertniv\xE5 i f\xF6rh\xE5llande\
            \ till kodens syfte och som ackrediteras f\xF6r detta \xE4ndam\xE5l av\
            \ den beh\xF6riga tillsynsmyndigheten."
    - urn: urn:intuitem:risk:req_node:gdpr:41.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.2'
      description: 'A body as referred to in paragraph 1 may be accredited to monitor
        compliance with a code of conduct where that body has:'
      translations:
        sv:
          description: "Ett organ som avses i punkt 1 f\xE5r ackrediteras f\xF6r att\
            \ \xF6vervaka efterlevnaden av en uppf\xF6randekod om detta organ har"
    - urn: urn:intuitem:risk:req_node:gdpr:41.2.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:41.2
      ref_id: 41.2.a
      description: demonstrated its independence and expertise in relation to the
        subject-matter of the code to the satisfaction of the competent supervisory
        authority;
      translations:
        sv:
          description: "visat sitt oberoende och sin expertis i f\xF6rh\xE5llande\
            \ till uppf\xF6randekodens syfte p\xE5 ett s\xE4tt som den beh\xF6riga\
            \ tillsynsmyndigheten finner tillfredsst\xE4llande,"
    - urn: urn:intuitem:risk:req_node:gdpr:41.2.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:41.2
      ref_id: 41.2.b
      description: established procedures which allow it to assess the eligibility
        of controllers and processors concerned to apply the code, to monitor their
        compliance with its provisions and to periodically review its operation;
      translations:
        sv:
          description: "uppr\xE4ttat f\xF6rfaranden varigenom det kan bed\xF6ma de\
            \ ber\xF6rda personuppgiftsansvarigas och personuppgiftsbitr\xE4denas\
            \ l\xE4mplighet f\xF6r att till\xE4mpa uppf\xF6randekoden, \xF6vervaka\
            \ att de efterlever dess best\xE4mmelser och regelbundet se \xF6ver hur\
            \ den fungerar,"
    - urn: urn:intuitem:risk:req_node:gdpr:41.2.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:41.2
      ref_id: 41.2.c
      description: established procedures and structures to handle complaints about
        infringements of the code or the manner in which the code has been, or is
        being, implemented by a controller or processor, and to make those procedures
        and structures transparent to data subjects and the public; and
      translations:
        sv:
          description: "uppr\xE4ttat f\xF6rfaranden och strukturer f\xF6r att hantera\
            \ klagom\xE5l om \xF6vertr\xE4delser av uppf\xF6randekoden eller det s\xE4\
            tt p\xE5 vilket uppf\xF6randekoden har till\xE4mpats, eller till\xE4mpas,\
            \ av en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de, och\
            \ f\xF6r att g\xF6ra dessa f\xF6rfaranden och strukturer synliga f\xF6\
            r registrerade och f\xF6r allm\xE4nheten, och"
    - urn: urn:intuitem:risk:req_node:gdpr:41.2.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:41.2
      ref_id: 41.2.d
      description: demonstrated to the satisfaction of the competent supervisory authority
        that its tasks and duties do not result in a conflict of interests.
      translations:
        sv:
          description: "p\xE5 ett s\xE4tt som den beh\xF6riga tillsynsmyndigheten\
            \ finner tillfredsst\xE4llande visat att dess uppgifter och uppdrag inte\
            \ leder till en intressekonflikt."
    - urn: urn:intuitem:risk:req_node:gdpr:41.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.3'
      description: The competent supervisory authority shall submit the draft requirements
        for accreditation of a body as referred to in paragraph 1 of this Article
        to the Board pursuant to the consistency mechanism referred to in Article
        63.
      translations:
        sv:
          description: "Den beh\xF6riga tillsynsmyndigheten ska inl\xE4mna utkastet\
            \ till kriterier f\xF6r ackreditering av ett organ som avses i punkt 1\
            \ i den h\xE4r artikeln till styrelsen i enlighet med den mekanism f\xF6\
            r enhetlighet som avses i artikel 63."
    - urn: urn:intuitem:risk:req_node:gdpr:41.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.4'
      description: Without prejudice to the tasks and powers of the competent supervisory
        authority and the provisions of Chapter VIII, a body as referred to in paragraph
        1 of this Article shall, subject to appropriate safeguards, take appropriate
        action in cases of infringement of the code by a controller or processor,
        including suspension or exclusion of the controller or processor concerned
        from the code. It shall inform the competent supervisory authority of such
        actions and the reasons for taking them.
      translations:
        sv:
          description: "Utan att det p\xE5verkar den beh\xF6riga tillsynsmyndighetens\
            \ uppgifter och befogenheter och till\xE4mpningen av best\xE4mmelserna\
            \ i kapitel VIII ska ett organ som avses i punkt 1 i denna artikel, med\
            \ f\xF6rbeh\xE5ll f\xF6r tillr\xE4ckliga skydds\xE5tg\xE4rder, vidta l\xE4\
            mpliga \xE5tg\xE4rder i fall av en personuppgiftsansvarigs eller ett personuppgiftsbitr\xE4\
            des \xF6vertr\xE4delse av uppf\xF6randekoden, inbegripet avst\xE4ngning\
            \ eller uteslutande av den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det fr\xE5n uppf\xF6randekoden. Det ska informera den beh\xF6riga tillsynsmyndigheten\
            \ om s\xE5dana \xE5tg\xE4rder och sk\xE4len f\xF6r att de vidtagits."
    - urn: urn:intuitem:risk:req_node:gdpr:41.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.5'
      description: The competent supervisory authority shall revoke the accreditation
        of a body as referred to in paragraph 1 if the requirements for accreditation
        are not, or are no longer, met or where actions taken by the body infringe
        this Regulation.
      translations:
        sv:
          description: "Den beh\xF6riga tillsynsmyndigheten ska \xE5terkalla ackrediteringen\
            \ av ett organ som avses i\_punkt 1 om villkoren f\xF6r ackrediteringen\
            \ inte, eller inte l\xE4ngre, uppfylls eller om \xE5tg\xE4rder som vidtagits\
            \ av organet strider mot denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:41.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-41
      ref_id: '41.6'
      description: This Article shall not apply to processing carried out by public
        authorities and bodies.
      translations:
        sv:
          description: "Denna artikel ska inte g\xE4lla behandling som utf\xF6rs av\
            \ offentliga myndigheter och organ."
    - urn: urn:intuitem:risk:req_node:gdpr:article-42
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node591
      ref_id: Article 42
      description: Certification
      translations:
        sv:
          name: Artikel 42
          description: Certifiering
    - urn: urn:intuitem:risk:req_node:gdpr:42.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.1'
      description: The Member States, the supervisory authorities, the Board and the
        Commission shall encourage, in particular at Union level, the establishment
        of data protection certification mechanisms and of data protection seals and
        marks, for the purpose of demonstrating compliance with this Regulation of
        processing operations by controllers and processors. The specific needs of
        micro, small and medium-sized enterprises shall be taken into account.
      translations:
        sv:
          description: "Medlemsstaterna, tillsynsmyndigheterna, styrelsen och kommissionen\
            \ ska uppmuntra, s\xE4rskilt p\xE5 unionsniv\xE5, inf\xF6randet av certifieringsmekanismer\
            \ f\xF6r dataskydd och sigill och m\xE4rkningar f\xF6r dataskydd som syftar\
            \ till att visa att personuppgiftsansvarigas eller personuppgiftsbitr\xE4\
            dens behandling \xE4r f\xF6renlig med denna f\xF6rordning. De s\xE4rskilda\
            \ behoven hos mikrof\xF6retag samt sm\xE5 och medelstora f\xF6retag ska\
            \ beaktas."
    - urn: urn:intuitem:risk:req_node:gdpr:42.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.2'
      description: In addition to adherence by controllers or processors subject to
        this Regulation, data protection certification mechanisms, seals or marks
        approved pursuant to paragraph 5 of this Article may be established for the
        purpose of demonstrating the existence of appropriate safeguards provided
        by controllers or processors that are not subject to this Regulation pursuant
        to Article 3 within the framework of personal data transfers to third countries
        or international organisations under the terms referred to in point (f) of
        Article 46(2). Such controllers or processors shall make binding and enforceable
        commitments, via contractual or other legally binding instruments, to apply
        those appropriate safeguards, including with regard to the rights of data
        subjects.
      translations:
        sv:
          description: "Certifieringsmekanismer f\xF6r dataskydd och sigill och m\xE4\
            rkningar f\xF6r dataskydd som \xE4r godk\xE4nda enligt punkt 5 i denna\
            \ artikel f\xE5r, f\xF6rutom att de iakttas av personuppgiftsansvariga\
            \ eller personuppgiftsbitr\xE4den som omfattas av denna f\xF6rordning,\
            \ inr\xE4ttas f\xF6r att visa att det f\xF6religger l\xE4mpliga garantier\
            \ som tillhandah\xE5lls av personuppgiftsansvariga och personuppgiftsbitr\xE4\
            den som inte omfattas av denna f\xF6rordning enligt artikel 3, inom ramen\
            \ f\xF6r \xF6verf\xF6ringar av personuppgifter till tredjel\xE4nder eller\
            \ internationella organisationer enligt villkoren i artikel 46.2 f. S\xE5\
            dana personuppgiftsansvariga eller personuppgiftsbitr\xE4den ska g\xF6\
            ra bindande och verkst\xE4llbara \xE5taganden, genom avtal eller andra\
            \ r\xE4ttsligt bindande instrument, att till\xE4mpa dessa l\xE4mpliga\
            \ garantier, inbegripet n\xE4r det g\xE4ller registrerades r\xE4ttigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:42.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.3'
      description: The certification shall be voluntary and available via a process
        that is transparent.
      translations:
        sv:
          description: "Certifieringen ska vara frivillig och tillg\xE4nglig via ett\
            \ \xF6ppet f\xF6rfarande."
    - urn: urn:intuitem:risk:req_node:gdpr:42.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.4'
      description: A certification pursuant to this Article does not reduce the responsibility
        of the controller or the processor for compliance with this Regulation and
        is without prejudice to the tasks and powers of the supervisory authorities
        which are competent pursuant to Article 55 or 56.
      translations:
        sv:
          description: "En certifiering i enlighet med denna artikel minskar inte\
            \ den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets ansvar\
            \ f\xF6r att denna f\xF6rordning efterlevs och p\xE5verkar inte uppgifter\
            \ och befogenheter f\xF6r de tillsynsmyndigheter som \xE4r beh\xF6riga\
            \ enligt artikel 55 eller 56."
    - urn: urn:intuitem:risk:req_node:gdpr:42.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.5'
      description: A certification pursuant to this Article shall be issued by the
        certification bodies referred to in Article 43 or by the competent supervisory
        authority, on the basis of criteria approved by that competent supervisory
        authority pursuant to Article 58(3) or by the Board pursuant to Article 63.
        Where the criteria are approved by the Board, this may result in a common
        certification, the European Data Protection Seal.
      translations:
        sv:
          description: "En certifiering i enlighet med denna artikel ska utf\xE4rdas\
            \ av de certifieringsorgan som avses i\_artikel 43 eller av den beh\xF6\
            riga tillsynsmyndigheten p\xE5 grundval av kriterier som godk\xE4nts av\
            \ den beh\xF6riga myndigheten enligt artikel 58.3 eller av styrelsen enligt\
            \ artikel\_63. Om kriterierna har godk\xE4nts av styrelsen f\xE5r detta\
            \ leda till en gemensam certifiering, det europeiska sigillet f\xF6r dataskydd."
    - urn: urn:intuitem:risk:req_node:gdpr:42.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.6'
      description: The controller or processor which submits its processing to the
        certification mechanism shall provide the certification body referred to in
        Article 43, or where applicable, the competent supervisory authority, with
        all information and access to its processing activities which are necessary
        to conduct the certification procedure.
      translations:
        sv:
          description: "Den personuppgiftsansvarige eller det personuppgiftsbitr\xE4\
            de som l\xE5ter sin behandling av uppgifter omfattas av certifieringsmekanismen\
            \ ska f\xF6rse det certifieringsorgan som avses i\_artikel 43 eller, i\_\
            till\xE4mpliga fall, den beh\xF6riga tillsynsmyndigheten, med all information\
            \ och tillg\xE5ng till behandlingsf\xF6rfaranden som kr\xE4vs f\xF6r att\
            \ genomf\xF6ra certifieringsf\xF6rfarandet."
    - urn: urn:intuitem:risk:req_node:gdpr:42.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.7'
      description: Certification shall be issued to a controller or processor for
        a maximum period of three years and may be renewed, under the same conditions,
        provided that the relevant criteria continue to be met. Certification shall
        be withdrawn, as applicable, by the certification bodies referred to in Article
        43 or by the competent supervisory authority where the criteria for the certification
        are not or are no longer met.
      translations:
        sv:
          description: "Certifiering ska utf\xE4rdas till en personuppgiftsansvarig\
            \ eller ett personuppgiftsbitr\xE4de f\xF6r en period p\xE5 h\xF6gst tre\
            \ \xE5r och f\xE5r f\xF6rnyas p\xE5 samma villkor under f\xF6ruts\xE4\
            ttning att kraven forts\xE4tter att vara uppfyllda. Certifiering ska,\
            \ i\_till\xE4mpliga fall, \xE5terkallas av de certifieringsorgan som avses\
            \ i artikel 43 eller av den beh\xF6riga tillsynsmyndigheten om kraven\
            \ f\xF6r certifieringen inte eller inte l\xE4ngre uppfylls."
    - urn: urn:intuitem:risk:req_node:gdpr:42.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-42
      ref_id: '42.8'
      description: The Board shall collate all certification mechanisms and data protection
        seals and marks in a register and shall make them publicly available by any
        appropriate means.
      translations:
        sv:
          description: "Styrelsen ska samla alla certifieringsmekanismer och sigill\
            \ och m\xE4rkningar f\xF6r dataskydd i\_ett register och offentligg\xF6\
            ra dem p\xE5 l\xE4mpligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:article-43
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node591
      ref_id: Article 43
      description: Certification bodies
      translations:
        sv:
          name: Artikel 43
          description: Certifieringsorgan
    - urn: urn:intuitem:risk:req_node:gdpr:43.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.1'
      description: 'Without prejudice to the tasks and powers of the competent supervisory
        authority under Articles 57 and 58, certification bodies which have an appropriate
        level of expertise in relation to data protection shall, after informing the
        supervisory authority in order to allow it to exercise its powers pursuant
        to point (h) of Article 58(2) where necessary, issue and renew certification.
        Member States shall ensure that those certification bodies are accredited
        by one or both of the following:'
      translations:
        sv:
          description: "Utan att det p\xE5verkar den beh\xF6riga tillsynsmyndighetens\
            \ uppgifter och befogenheter enligt artiklarna 57 och 58 ska certifieringsorgan\
            \ som har l\xE4mplig niv\xE5 av expertis i fr\xE5ga om dataskydd, efter\
            \ att ha informerat tillsynsmyndigheten f\xF6r att den ska kunna ut\xF6\
            va sina befogenheter enligt artikel 58.2 h n\xE4r s\xE5 \xE4r n\xF6dv\xE4\
            ndigt, utf\xE4rda och f\xF6rnya certifiering. Medlemsstat ska s\xE4kerst\xE4\
            lla att dessa certifieringsorgan \xE4r ackrediterade av en av eller b\xE5\
            da f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:43.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.1
      ref_id: 43.1.a
      description: the supervisory authority which is competent pursuant to Article
        55 or 56;
      translations:
        sv:
          description: "Den tillsynsmyndighet som \xE4r beh\xF6rig enligt artikel\
            \ 55 eller 56,"
    - urn: urn:intuitem:risk:req_node:gdpr:43.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.1
      ref_id: 43.1.b
      description: the national accreditation body named in accordance with Regulation
        (EC) No 765/2008 of the European Parliament and of the Council ( 1 ) in accordance
        with EN-ISO/IEC 17065/2012 and with the additional requirements established
        by the supervisory authority which is competent pursuant to Article 55 or
        56.
      translations:
        sv:
          description: "det nationella ackrediteringsorgan som utsetts i enlighet\
            \ med Europaparlamentets och r\xE5dets f\xF6rordning (EG) nr\_765/2008\_\
            (20)\_i enlighet med EN-ISO/IEC 17065/2012 och med de ytterligare krav\
            \ som fastst\xE4llts av den tillsynsmyndighet som \xE4r beh\xF6rig enligt\
            \ artikel 55 eller 56."
    - urn: urn:intuitem:risk:req_node:gdpr:43.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.2'
      description: 'Certification bodies referred to in paragraph 1 shall be accredited
        in accordance with that paragraph only where they have:'
      translations:
        sv:
          description: "Certifieringsorgan som avses i punkt 1 f\xE5r ackrediteras\
            \ i enlighet med den punkten endast om de har"
    - urn: urn:intuitem:risk:req_node:gdpr:43.2.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.2
      ref_id: 43.2.a
      description: demonstrated their independence and expertise in relation to the
        subject-matter of the certification to the satisfaction of the competent supervisory
        authority;
      translations:
        sv:
          description: "visat oberoende och expertis i f\xF6rh\xE5llande till certifieringens\
            \ syfte p\xE5 ett s\xE4tt som den beh\xF6riga tillsynsmyndigheten finner\
            \ tillfredsst\xE4llande,"
    - urn: urn:intuitem:risk:req_node:gdpr:43.2.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.2
      ref_id: 43.2.b
      description: undertaken to respect the criteria referred to in Article 42(5)
        and approved by the supervisory authority which is competent pursuant to Article
        55 or 56 or by the Board pursuant to Article 63;
      translations:
        sv:
          description: "f\xF6rbundit sig att respektera de kriterier som avses i artikel\
            \ 42.5 och godk\xE4nts av den tillsynsmyndighet som \xE4r beh\xF6rig enligt\
            \ artikel 55 eller 56, eller av styrelsen enligt artikel 63,"
    - urn: urn:intuitem:risk:req_node:gdpr:43.2.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.2
      ref_id: 43.2.c
      description: established procedures for the issuing, periodic review and withdrawal
        of data protection certification, seals and marks;
      translations:
        sv:
          description: "uppr\xE4ttat f\xF6rfaranden f\xF6r utf\xE4rdande, periodisk\
            \ \xF6versyn och \xE5terkallande av certifiering, sigill och m\xE4rkningar\
            \ f\xF6r dataskydd,"
    - urn: urn:intuitem:risk:req_node:gdpr:43.2.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.2
      ref_id: 43.2.d
      description: established procedures and structures to handle complaints about
        infringements of the certification or the manner in which the certification
        has been, or is being, implemented by the controller or processor, and to
        make those procedures and structures transparent to data subjects and the
        public; and
      translations:
        sv:
          description: "uppr\xE4ttat f\xF6rfaranden och strukturer f\xF6r att hantera\
            \ klagom\xE5l om \xF6vertr\xE4delser av certifieringen eller det s\xE4\
            tt p\xE5 vilket certifieringen har till\xE4mpats, eller till\xE4mpas,\
            \ av en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de, och\
            \ f\xF6r att g\xF6ra dessa f\xF6rfaranden och strukturer synliga f\xF6\
            r registrerade och f\xF6r allm\xE4nheten, och"
    - urn: urn:intuitem:risk:req_node:gdpr:43.2.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:43.2
      ref_id: 43.2.e
      description: demonstrated, to the satisfaction of the competent supervisory
        authority, that their tasks and duties do not result in a conflict of interests.
      translations:
        sv:
          description: "p\xE5 ett s\xE4tt som den beh\xF6riga tillsynsmyndigheten\
            \ finner tillfredsst\xE4llande visat att deras uppgifter och uppdrag inte\
            \ leder till en intressekonflikt."
    - urn: urn:intuitem:risk:req_node:gdpr:43.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.3'
      description: The accreditation of certification bodies as referred to in paragraphs
        1 and 2 of this Article shall take place on the basis of requirements approved
        by the supervisory authority which is competent pursuant to Article 55 or
        56 or by the Board pursuant to Article 63. In the case of accreditation pursuant
        to point (b) of paragraph 1 of this Article, those requirements shall complement
        those envisaged in Regulation (EC) No 765/2008 and the technical rules that
        describe the methods and procedures of the certification bodies.
      translations:
        sv:
          description: "Ackrediteringen av certifieringsorgan som avses i punkterna\
            \ 1 och 2 i denna artikel ska ske p\xE5 grundval av kriterier som godk\xE4\
            nts av den tillsynsmyndighet som \xE4r beh\xF6rig enligt artikel 55 eller\_\
            56, eller av styrelsen enligt artikel\_63. I h\xE4ndelse av ackreditering\
            \ enligt punkt 1 b i\_den h\xE4r artikeln ska dessa krav komplettera dem\
            \ som f\xF6reskrivs i f\xF6rordning (EG) nr\_765/2008 och de tekniska\
            \ regler som beskriver certifieringsorganens metoder och f\xF6rfaranden."
    - urn: urn:intuitem:risk:req_node:gdpr:43.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.4'
      description: The certification bodies referred to in paragraph 1 shall be responsible
        for the proper assessment leading to the certification or the withdrawal of
        such certification without prejudice to the responsibility of the controller
        or processor for compliance with this Regulation. The accreditation shall
        be issued for a maximum period of five years and may be renewed on the same
        conditions provided that the certification body meets the requirements set
        out in this Article.
      translations:
        sv:
          description: "De certifieringsorgan som avses i punkt 1 ska ansvara f\xF6\
            r den korrekta bed\xF6mning som leder till certifieringen eller \xE5terkallelsen\
            \ av certifieringen, utan att det p\xE5verkar den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets ansvar att efterleva denna f\xF6rordning.\
            \ Ackrediteringen ska utf\xE4rdas f\xF6r en period p\xE5 h\xF6gst fem\
            \ \xE5r och f\xE5r f\xF6rnyas p\xE5 samma villkor under f\xF6ruts\xE4\
            ttning att certifieringsorganet uppfyller de krav som anges i\_denna artikel."
    - urn: urn:intuitem:risk:req_node:gdpr:43.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.5'
      description: The certification bodies referred to in paragraph 1 shall provide
        the competent supervisory authorities with the reasons for granting or withdrawing
        the requested certification.
      translations:
        sv:
          description: "De certifieringsorgan som avses i punkt 1 ska informera de\
            \ beh\xF6riga tillsynsmyndigheterna om orsakerna till beviljandet eller\
            \ \xE5terkallelsen av den beg\xE4rda certifieringen."
    - urn: urn:intuitem:risk:req_node:gdpr:43.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.6'
      description: The requirements referred to in paragraph 3 of this Article and
        the criteria referred to in Article 42(5) shall be made public by the supervisory
        authority in an easily accessible form. The supervisory authorities shall
        also transmit those requirements and criteria to the Board.
      translations:
        sv:
          description: "De krav som avses i punkt 3 i den h\xE4r artikeln och de kriterier\
            \ som avses i artikel 42.5 ska offentligg\xF6ras av tillsynsmyndigheten\
            \ i ett l\xE4ttillg\xE4ngligt format. Tillsynsmyndigheterna ska ocks\xE5\
            \ \xF6vers\xE4nda dessa krav och kriterier till styrelsen. Styrelsen ska\
            \ samla alla certifieringsmekanismer och sigill f\xF6r dataskydd i ett\
            \ register och offentligg\xF6ra dem p\xE5 l\xE4mpligt s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:43.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.7'
      description: Without prejudice to Chapter VIII, the competent supervisory authority
        or the national accreditation body shall revoke an accreditation of a certification
        body pursuant to paragraph 1 of this Article where the conditions for the
        accreditation are not, or are no longer, met or where actions taken by a certification
        body infringe this Regulation.
      translations:
        sv:
          description: "Utan att det p\xE5verkar till\xE4mpningen av kapitel VIII\
            \ ska den beh\xF6riga tillsynsmyndigheten eller det nationella ackrediteringsorganet\
            \ \xE5terkalla ett certifieringsorgans ackreditering enligt punkt 1 i\
            \ denna artikel om villkoren f\xF6r ackrediteringen inte, eller inte l\xE4\
            ngre, uppfylls eller om \xE5tg\xE4rder som vidtagits av certifieringsorganet\
            \ strider mot denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:43.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.8'
      description: The Commission shall be empowered to adopt delegated acts in accordance
        with Article 92 for the purpose of specifying the requirements to be taken
        into account for the data protection certification mechanisms referred to
        in Article 42(1).
      translations:
        sv:
          description: "Kommissionen ska ges befogenhet att anta delegerade akter\
            \ i enlighet med artikel 92 i\_syfte att n\xE4rmare ange de krav som ska\
            \ tas i beaktande f\xF6r de certifieringsmekanismer f\xF6r dataskydd som\
            \ avses i artikel 42.1."
    - urn: urn:intuitem:risk:req_node:gdpr:43.9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-43
      ref_id: '43.9'
      description: The Commission may adopt implementing acts laying down technical
        standards for certification mechanisms and data protection seals and marks,
        and mechanisms to promote and recognise those certification mechanisms, seals
        and marks. Those implementing acts shall be adopted in accordance with the
        examination procedure referred to in Article 93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r anta genomf\xF6randeakter f\xF6r att fastst\xE4\
            lla tekniska standarder f\xF6r certifieringsmekanismer och sigill och\
            \ m\xE4rkningar f\xF6r dataskydd samt rutiner f\xF6r att fr\xE4mja och\
            \ erk\xE4nna dessa certifieringsmekanismer, sigill och m\xE4rkningar.\
            \ Dessa genomf\xF6randeakter ska antas i enlighet med det granskningsf\xF6\
            rfarande som avses i\_artikel\_93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      assessable: false
      depth: 1
      ref_id: CHAPTER V
      description: Transfers of personal data to third countries or international
        organisations
      translations:
        sv:
          name: KAPITEL V
          description: "\xD6verf\xF6ring av personuppgifter till tredjel\xE4nder eller\
            \ internationella organisationer"
    - urn: urn:intuitem:risk:req_node:gdpr:article-44
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 44
      description: General principle for transfers
      translations:
        sv:
          name: Artikel 44
          description: "Allm\xE4n princip f\xF6r \xF6verf\xF6ring av uppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:node654
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-44
      description: Any transfer of personal data which are undergoing processing or
        are intended for processing after transfer to a third country or to an international
        organisation shall take place only if, subject to the other provisions of
        this Regulation, the conditions laid down in this Chapter are complied with
        by the controller and processor, including for onward transfers of personal
        data from the third country or an international organisation to another third
        country or to another international organisation. All provisions in this Chapter
        shall be applied in order to ensure that the level of protection of natural
        persons guaranteed by this Regulation is not undermined.
      translations:
        sv:
          description: "\xD6verf\xF6ring av personuppgifter som \xE4r under behandling\
            \ eller \xE4r avsedda att behandlas efter det att de \xF6verf\xF6rts till\
            \ ett tredjeland eller en internationell organisation f\xE5r bara ske\
            \ under f\xF6ruts\xE4ttning att den personuppgiftsansvarige och personuppgiftsbitr\xE4\
            det, med f\xF6rbeh\xE5ll f\xF6r \xF6vriga best\xE4mmelser i\_denna f\xF6\
            rordning, uppfyller villkoren i detta kapitel, inklusive f\xF6r vidare\
            \ \xF6verf\xF6ring av personuppgifter fr\xE5n tredjelandet eller den internationella\
            \ organisationen till ett annat tredjeland eller en annan internationell\
            \ organisation. Alla best\xE4mmelser i detta kapitel ska till\xE4mpas\
            \ f\xF6r att s\xE4kerst\xE4lla att den niv\xE5 p\xE5 skyddet av fysiska\
            \ personer som s\xE4kerst\xE4lls genom denna f\xF6rordning inte undergr\xE4\
            vs."
    - urn: urn:intuitem:risk:req_node:gdpr:article-45
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 45
      description: Transfers on the basis of an adequacy decision
      translations:
        sv:
          name: Artikel 45
          description: "\xD6verf\xF6ring p\xE5 grundval av ett beslut om adekvat skyddsniv\xE5"
    - urn: urn:intuitem:risk:req_node:gdpr:45.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.1'
      description: A transfer of personal data to a third country or an international
        organisation may take place where the Commission has decided that the third
        country, a territory or one or more specified sectors within that third country,
        or the international organisation in question ensures an adequate level of
        protection. Such a transfer shall not require any specific authorisation.
      annotation: "The European Commission has the power to determine, whether a country\
        \ outside the EU offers an adequate level of data protection.\nEuropean Commission\
        \ has so far recognised Andorra, Argentina, Canada (commercial organisations),\
        \ Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand,\
        \ Republic of Korea, Switzerland , the United Kingdom under the GDPR and the\
        \ LED, the United States (commercial organisations participating in the EU-US\
        \ Data Privacy Framework)  and Uruguay as providing adequate protection.\n\
        https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en\
        \ \nHere is the link to the implementing act : https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914\n\
        The Court of Justice of the European Union in the case Schrems II, stated\
        \ that standard contractual clauses (SCCs) can generally be used for transferring\
        \ data to third countries. However, the CJEU emphasized that data exporters\
        \ and importers must assess whether the third country's legislation ensures\
        \ the required level of protection according to EU law and the SCCs' guarantees."
      translations:
        sv:
          description: "Personuppgifter f\xE5r \xF6verf\xF6ras till ett tredjeland\
            \ eller en internationell organisation om kommissionen har beslutat att\
            \ tredjelandet, ett territorium eller en eller flera specificerade sektorer\
            \ i tredjelandet, eller den internationella organisationen i fr\xE5ga\
            \ s\xE4kerst\xE4ller en adekvat skyddsniv\xE5. En s\xE5dan \xF6verf\xF6\
            ring ska inte kr\xE4va n\xE5got s\xE4rskilt tillst\xE5nd."
          annotation: "The European Commission has the power to determine, whether\
            \ a country outside the EU offers an adequate level of data protection.\n\
            European Commission has so far recognised Andorra, Argentina, Canada (commercial\
            \ organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan,\
            \ Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom\
            \ under the GDPR and the LED, the United States (commercial organisations\
            \ participating in the EU-US Data Privacy Framework)  and Uruguay as providing\
            \ adequate protection.\nhttps://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en\
            \ \nHere is the link to the implementing act : https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914\n\
            The Court of Justice of the European Union in the case Schrems II, stated\
            \ that standard contractual clauses (SCCs) can generally be used for transferring\
            \ data to third countries. However, the CJEU emphasized that data exporters\
            \ and importers must assess whether the third country's legislation ensures\
            \ the required level of protection according to EU law and the SCCs' guarantees."
    - urn: urn:intuitem:risk:req_node:gdpr:45.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.2'
      description: 'When assessing the adequacy of the level of protection, the Commission
        shall, in particular, take account of the following elements:'
      translations:
        sv:
          description: "N\xE4r kommissionen bed\xF6mer om en adekvat skyddsniv\xE5\
            \ f\xF6religger ska den s\xE4rskilt beakta"
    - urn: urn:intuitem:risk:req_node:gdpr:45.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:45.2
      ref_id: 45.2.a
      description: the rule of law, respect for human rights and fundamental freedoms,
        relevant legislation, both general and sectoral, including concerning public
        security, defence, national security and criminal law and the access of public
        authorities to personal data, as well as the implementation of such legislation,
        data protection rules, professional rules and security measures, including
        rules for the onward transfer of personal data to another third country or
        international organisation which are complied with in that country or international
        organisation, case-law, as well as effective and enforceable data subject
        rights and effective administrative and judicial redress for the data subjects
        whose personal data are being transferred;
      translations:
        sv:
          description: "r\xE4ttsstatsprincipen, respekten f\xF6r de m\xE4nskliga r\xE4\
            ttigheterna och de grundl\xE4ggande friheterna, relevant lagstiftning,\
            \ b\xE5de allm\xE4n lagstiftning och sektorslagstiftning, inklusive avseende\
            \ allm\xE4n s\xE4kerhet, f\xF6rsvar, nationell s\xE4kerhet och straffr\xE4\
            tt och offentliga myndigheters tillg\xE5ng till personuppgifter samt till\xE4\
            mpningen av s\xE5dan lagstiftning, dataskyddsregler, yrkesregler och s\xE4\
            kerhetsbest\xE4mmelser, inbegripet regler f\xF6r vidare \xF6verf\xF6ring\
            \ av personuppgifter till ett annat tredjeland eller en annan internationell\
            \ organisation, som ska f\xF6ljas i det landet eller den internationella\
            \ organisationen, r\xE4ttspraxis samt faktiska och verkst\xE4llbara r\xE4\
            ttigheter f\xF6r registrerade och effektiv administrativ och r\xE4ttslig\
            \ pr\xF6vning f\xF6r de registrerade vars personuppgifter \xF6verf\xF6\
            rs,"
    - urn: urn:intuitem:risk:req_node:gdpr:45.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:45.2
      ref_id: 45.2.b
      description: the existence and effective functioning of one or more independent
        supervisory authorities in the third country or to which an international
        organisation is subject, with responsibility for ensuring and enforcing compliance
        with the data protection rules, including adequate enforcement powers, for
        assisting and advising the data subjects in exercising their rights and for
        cooperation with the supervisory authorities of the Member States; and
      translations:
        sv:
          description: "huruvida det finns en eller flera effektivt fungerande oberoende\
            \ tillsynsmyndigheter i\_tredjelandet, eller som ut\xF6var tillsyn \xF6\
            ver den internationella organisationen, som har ansvar f\xF6r att s\xE4\
            kerst\xE4lla och kontrollera att dataskyddsregler f\xF6ljs, inklusive\
            \ l\xE4mpliga verkst\xE4llighetsbefogenheter, ge de registrerade r\xE5\
            d och assistans n\xE4r det g\xE4ller ut\xF6vandet av deras r\xE4ttigheter\
            \ och samarbeta med medlemsstaternas tillsynsmyndigheter, och"
    - urn: urn:intuitem:risk:req_node:gdpr:45.2.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:45.2
      ref_id: 45.2.c
      description: the international commitments the third country or international
        organisation concerned has entered into, or other obligations arising from
        legally binding conventions or instruments as well as from its participation
        in multilateral or regional systems, in particular in relation to the protection
        of personal data.
      translations:
        sv:
          description: "vilka internationella \xE5taganden det ber\xF6rda tredjelandet\
            \ eller den ber\xF6rda internationella organisationen har gjort, eller\
            \ andra skyldigheter som f\xF6ljer av r\xE4ttsligt bindande konventioner\
            \ eller instrument samt av dess deltagande i multilaterala eller regionala\
            \ system, s\xE4rskilt r\xF6rande skydd av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:45.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.3'
      description: The Commission, after assessing the adequacy of the level of protection,
        may decide, by means of implementing act, that a third country, a territory
        or one or more specified sectors within a third country, or an international
        organisation ensures an adequate level of protection within the meaning of
        paragraph 2 of this Article. The implementing act shall provide for a mechanism
        for a periodic review, at least every four years, which shall take into account
        all relevant developments in the third country or international organisation.
        The implementing act shall specify its territorial and sectoral application
        and, where applicable, identify the supervisory authority or authorities referred
        to in point (b) of paragraph 2 of this Article. The implementing act shall
        be adopted in accordance with the examination procedure referred to in Article
        93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r, efter att ha bed\xF6mt om det f\xF6religger\
            \ en adekvat skyddsniv\xE5, genom en genomf\xF6randeakt besluta att ett\
            \ tredjeland, ett territorium eller en eller flera specificerade sektorer\
            \ inom ett tredjeland, eller en internationell organisation s\xE4kerst\xE4\
            ller en adekvat skyddsniv\xE5 i den mening som avses i punkt 2 i den h\xE4\
            r artikeln. Genomf\xF6randeakten ska inr\xE4tta en mekanism f\xF6r regelbunden\
            \ \xF6versyn, minst vart fj\xE4rde \xE5r, som ska beakta all relevant\
            \ utveckling i det tredjelandet eller den internationella organisationen.\
            \ Beslutets territoriella och sektorsm\xE4ssiga till\xE4mpning ska regleras\
            \ i genomf\xF6randeakten, d\xE4r det ocks\xE5 i f\xF6rekommande fall ska\
            \ anges vilken eller vilka myndigheter som \xE4r tillsynsmyndighet(er)\
            \ enligt punkt 2 b i den h\xE4r artikeln. Genomf\xF6randeakten ska antas\
            \ i\_enlighet med det granskningsf\xF6rfarande som avses i artikel 93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:45.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.4'
      description: The Commission shall, on an ongoing basis, monitor developments
        in third countries and international organisations that could affect the functioning
        of decisions adopted pursuant to paragraph 3 of this Article and decisions
        adopted on the basis of Article 25(6) of Directive 95/46/EC.
      translations:
        sv:
          description: "Kommissionen ska fortl\xF6pande \xF6vervaka utveckling i tredjel\xE4\
            nder och internationella organisationer vilken kan p\xE5verka hur beslut\
            \ som antagits enligt punkt 3 i den h\xE4r artikeln och beslut som antagits\
            \ p\xE5 grundval av artikel 25.6 i direktiv 95/46/EG fungerar."
    - urn: urn:intuitem:risk:req_node:gdpr:45.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.5'
      description: The Commission shall, where available information reveals, in particular
        following the review referred to in paragraph 3 of this Article, that a third
        country, a territory or one or more specified sectors within a third country,
        or an international organisation no longer ensures an adequate level of protection
        within the meaning of paragraph 2 of this Article, to the extent necessary,
        repeal, amend or suspend the decision referred to in paragraph 3 of this Article
        by means of implementing acts without retro-active effect. Those implementing
        acts shall be adopted in accordance with the examination procedure referred
        to in Article 93(2).
      translations:
        sv:
          description: "Kommissionen ska, n\xE4r tillg\xE4nglig information visar,\
            \ i synnerhet efter den \xF6versyn som avses i punkt 3 i den h\xE4r artikeln,\
            \ att ett tredjeland, ett territorium eller en eller flera specificerade\
            \ sektorer inom tredjelandet i fr\xE5ga eller en internationell organisation\
            \ inte l\xE4ngre s\xE4kerst\xE4ller adekvat skydd i den mening som avses\
            \ i punkt 2 i den h\xE4r artikeln och, i\_den m\xE5n det beh\xF6vs, genom\
            \ genomf\xF6randeakter \xE5terkalla, \xE4ndra eller upph\xE4va det beslut\
            \ som avses i punkt 3 i den h\xE4r artikeln utan retroaktiv verkan. Dessa\
            \ genomf\xF6randeakter ska antas i enlighet med det granskningsf\xF6rfarande\
            \ som avses i artikel 93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:node664
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      description: On duly justified imperative grounds of urgency, the Commission
        shall adopt immediately applicable implementing acts in accordance with the
        procedure referred to in Article 93(3).
      translations:
        sv:
          description: "N\xE4r det f\xF6religger vederb\xF6rligen motiverade och tvingande\
            \ sk\xE4l till skyndsamhet ska kommissionen anta omedelbart till\xE4mpliga\
            \ genomf\xF6randeakter i enlighet med det f\xF6rfarande som avses i\_\
            artikel 93.3."
    - urn: urn:intuitem:risk:req_node:gdpr:45.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.6'
      description: The Commission shall enter into consultations with the third country
        or international organisation with a view to remedying the situation giving
        rise to the decision made pursuant to paragraph 5.
      translations:
        sv:
          description: "Kommissionen ska samr\xE5da med tredjelandet eller den internationella\
            \ organisationen i\_fr\xE5ga f\xF6r att l\xF6sa den situation som lett\
            \ till beslutet enligt punkt 5."
    - urn: urn:intuitem:risk:req_node:gdpr:45.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.7'
      description: A decision pursuant to paragraph 5 of this Article is without prejudice
        to transfers of personal data to the third country, a territory or one or
        more specified sectors within that third country, or the international organisation
        in question pursuant to Articles 46 to 49.
      translations:
        sv:
          description: "Beslut enligt punkt 5 i den h\xE4r artikeln ska inte p\xE5\
            verka \xF6verf\xF6ring av personuppgifter till tredjelandet, ett territorium\
            \ eller en eller flera specificerade sektorer inom tredjelandet, eller\
            \ den internationella organisationen i fr\xE5ga enligt artiklarna 46\u2013\
            49."
    - urn: urn:intuitem:risk:req_node:gdpr:45.8
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.8'
      description: The Commission shall publish in the Official Journal of the European
        Union and on its website a list of the third countries, territories and specified
        sectors within a third country and international organisations for which it
        has decided that an adequate level of protection is or is no longer ensured.
      translations:
        sv:
          description: "Kommissionen ska i\_Europeiska unionens officiella tidning\_\
            och p\xE5 sin webbplats offentligg\xF6ra en f\xF6rteckning \xF6ver de\
            \ tredjel\xE4nder och de territorier och specificerade sektorer i ett\
            \ givet tredjeland samt de internationella organisationer f\xF6r vilka\
            \ den har fastst\xE4llt att en adekvat skyddsniv\xE5 inte eller inte l\xE4\
            ngre s\xE4kerst\xE4lls."
    - urn: urn:intuitem:risk:req_node:gdpr:45.9
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-45
      ref_id: '45.9'
      description: Decisions adopted by the Commission on the basis of Article 25(6)
        of Directive 95/46/EC shall remain in force until amended, replaced or repealed
        by a Commission Decision adopted in accordance with paragraph 3 or 5 of this
        Article.
      translations:
        sv:
          description: "De beslut som antas av kommissionen p\xE5 grundval av artikel\
            \ 25.6 i direktiv 95/46/EG ska f\xF6rbli i kraft tills de \xE4ndrats,\
            \ ersatts eller upph\xE4vts av ett kommissionsbeslut som antagits i\_\
            enlighet med punkt 3 eller 5 i den h\xE4r artikeln."
    - urn: urn:intuitem:risk:req_node:gdpr:article-46
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 46
      description: Transfers subject to appropriate safeguards
      translations:
        sv:
          name: Artikel 46
          description: "\xD6verf\xF6ring som omfattas av l\xE4mpliga skydds\xE5tg\xE4\
            rder"
    - urn: urn:intuitem:risk:req_node:gdpr:46.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-46
      ref_id: '46.1'
      description: In the absence of a decision pursuant to Article 45(3), a controller
        or processor may transfer personal data to a third country or an international
        organisation only if the controller or processor has provided appropriate
        safeguards, and on condition that enforceable data subject rights and effective
        legal remedies for data subjects are available.
      annotation: The Court of Justice of the European Union in the case Schrems II,
        stated that standard contractual clauses (SCCs) can generally be used for
        transferring data to third countries. However, the CJEU emphasized that data
        exporters and importers must assess whether the third country's legislation
        ensures the required level of protection according to EU law and the SCCs'
        guarantees.
      translations:
        sv:
          description: "I avsaknad av ett beslut i enlighet med artikel 45.3, f\xE5\
            r en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de endast\
            \ \xF6verf\xF6ra personuppgifter till ett tredjeland eller en internationell\
            \ organisation efter att ha vidtagit l\xE4mpliga skydds\xE5tg\xE4rder,\
            \ och p\xE5 villkor att lagstadgade r\xE4ttigheter f\xF6r registrerade\
            \ och effektiva r\xE4ttsmedel f\xF6r registrerade finns tillg\xE4ngliga."
          annotation: The Court of Justice of the European Union in the case Schrems
            II, stated that standard contractual clauses (SCCs) can generally be used
            for transferring data to third countries. However, the CJEU emphasized
            that data exporters and importers must assess whether the third country's
            legislation ensures the required level of protection according to EU law
            and the SCCs' guarantees.
    - urn: urn:intuitem:risk:req_node:gdpr:46.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-46
      ref_id: '46.2'
      description: 'The appropriate safeguards referred to in paragraph 1 may be provided
        for, without requiring any specific authorisation from a supervisory authority,
        by:'
      translations:
        sv:
          description: "L\xE4mpliga skydds\xE5tg\xE4rder enligt punkt 1 f\xE5r, utan\
            \ att det kr\xE4vs s\xE4rskilt tillst\xE5nd fr\xE5n en \xF6vervakningsmyndighet,\
            \ ta formen av"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.a
      description: a legally binding and enforceable instrument between public authorities
        or bodies;
      translations:
        sv:
          description: "ett r\xE4ttsligt bindande och verkst\xE4llbart instrument\
            \ mellan offentliga myndigheter eller organ,"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.b
      description: binding corporate rules in accordance with Article 47;
      translations:
        sv:
          description: "bindande f\xF6retagsbest\xE4mmelser i enlighet med artikel\
            \ 47,"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.c
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.c
      description: standard data protection clauses adopted by the Commission in accordance
        with the examination procedure referred to in Article 93(2);
      translations:
        sv:
          description: "standardiserade dataskyddsbest\xE4mmelser som antas av kommissionen\
            \ i enlighet med det granskningsf\xF6rfarande som avses i artikel 93.2,"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.d
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.d
      description: standard data protection clauses adopted by a supervisory authority
        and approved by the Commission pursuant to the examination procedure referred
        to in Article 93(2);
      translations:
        sv:
          description: "standardiserade dataskyddsbest\xE4mmelser som antagits av\
            \ en tillsynsmyndighet och godk\xE4nts av kommissionen i enlighet med\
            \ det granskningsf\xF6rfarande som avses i\_artikel\_93.2,"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.e
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.e
      description: an approved code of conduct pursuant to Article 40 together with
        binding and enforceable commitments of the controller or processor in the
        third country to apply the appropriate safeguards, including as regards data
        subjects' rights; or
      translations:
        sv:
          description: "en godk\xE4nd uppf\xF6randekod enlig artikel 40 tillsammans\
            \ med r\xE4ttsligt bindande och verkst\xE4llbara \xE5taganden f\xF6r den\
            \ personuppgiftsansvarige eller personuppgiftsbitr\xE4det i tredjelandet\
            \ att till\xE4mpa l\xE4mpliga skydds\xE5tg\xE4rder, \xE4ven n\xE4r det\
            \ g\xE4ller registrerades r\xE4ttigheter, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:46.2.f
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.2
      ref_id: 46.2.f
      description: an approved certification mechanism pursuant to Article 42 together
        with binding and enforceable commitments of the controller or processor in
        the third country to apply the appropriate safeguards, including as regards
        data subjects' rights.
      translations:
        sv:
          description: "en godk\xE4nd certifieringsmekanism enlig artikel 42 tillsammans\
            \ med r\xE4ttsligt bindande och verkst\xE4llbara \xE5taganden f\xF6r den\
            \ personuppgiftsansvarige, personuppgiftsbitr\xE4det i tredjelandet att\
            \ till\xE4mpa l\xE4mpliga skydds\xE5tg\xE4rder, \xE4ven n\xE4r det g\xE4\
            ller de registrerades r\xE4ttigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:46.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-46
      ref_id: '46.3'
      description: 'Subject to the authorisation from the competent supervisory authority,
        the appropriate safeguards referred to in paragraph 1 may also be provided
        for, in particular, by:'
      translations:
        sv:
          description: "Med f\xF6rbeh\xE5ll f\xF6r tillst\xE5nd fr\xE5n den beh\xF6\
            riga tillsynsmyndigheten, f\xE5r l\xE4mpliga skydds\xE5tg\xE4rder enligt\
            \ punkt 1 ocks\xE5 i synnerhet ta formen av"
    - urn: urn:intuitem:risk:req_node:gdpr:46.3.a
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.3
      ref_id: 46.3.a
      description: contractual clauses between the controller or processor and the
        controller, processor or the recipient of the personal data in the third country
        or international organisation; or
      translations:
        sv:
          description: "avtalsklausuler mellan den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det och den personuppgiftsansvarige, personuppgiftsbitr\xE4det eller mottagaren\
            \ av personuppgifterna i tredjelandet eller den internationella organisationen,\
            \ eller"
    - urn: urn:intuitem:risk:req_node:gdpr:46.3.b
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:46.3
      ref_id: 46.3.b
      description: provisions to be inserted into administrative arrangements between
        public authorities or bodies which include enforceable and effective data
        subject rights.
      translations:
        sv:
          description: "best\xE4mmelser som ska inf\xF6ras i administrativa \xF6verenskommelser\
            \ mellan offentliga myndigheter eller organ vilka inbegriper verkst\xE4\
            llbara och faktiska r\xE4ttigheter f\xF6r registrerade."
    - urn: urn:intuitem:risk:req_node:gdpr:46.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-46
      ref_id: '46.4'
      description: The supervisory authority shall apply the consistency mechanism
        referred to in Article 63 in the cases referred to in paragraph 3 of this
        Article.
      translations:
        sv:
          description: "Tillsynsmyndigheten ska till\xE4mpa den mekanism f\xF6r enhetlighet\
            \ som avses i artikel 63 i de fall som avses i punkt 3 i den h\xE4r artikeln."
    - urn: urn:intuitem:risk:req_node:gdpr:46.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-46
      ref_id: '46.5'
      description: Authorisations by a Member State or supervisory authority on the
        basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended,
        replaced or repealed, if necessary, by that supervisory authority. Decisions
        adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC
        shall remain in force until amended, replaced or repealed, if necessary, by
        a Commission Decision adopted in accordance with paragraph 2 of this Article.
      translations:
        sv:
          description: "Tillst\xE5nd fr\xE5n en medlemsstat eller tillsynsmyndighet\
            \ p\xE5 grundval av artikel 26.2 i\_direktiv\_95/46/EG ska f\xF6rbli giltigt\
            \ tills det, vid behov, \xE4ndrats, ersatts eller upph\xE4vts av den tillsynsmyndigheten.\
            \ De beslut som fattas av kommissionen p\xE5 grundval av artikel\_26.4\
            \ i\_direktiv\_95/46/EG ska f\xF6rbli i kraft tills de, vid behov, \xE4\
            ndrats, ersatts eller upph\xE4vts av ett kommissionsbeslut som antagits\
            \ i enlighet med punkt 2 i den h\xE4r artikeln."
    - urn: urn:intuitem:risk:req_node:gdpr:article-47
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 47
      description: Binding corporate rules
      translations:
        sv:
          name: Artikel 47
          description: "Bindande f\xF6retagsbest\xE4mmelser"
    - urn: urn:intuitem:risk:req_node:gdpr:47.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-47
      ref_id: '47.1'
      description: 'The competent supervisory authority shall approve binding corporate
        rules in accordance with the consistency mechanism set out in Article 63,
        provided that they:'
      translations:
        sv:
          description: "Den beh\xF6riga tillsynsmyndigheten ska godk\xE4nna bindande\
            \ f\xF6retagsbest\xE4mmelser i enlighet med den mekanism f\xF6r enhetlighet\
            \ som f\xF6reskrivs i artikel 63 under f\xF6ruts\xE4ttning att de"
    - urn: urn:intuitem:risk:req_node:gdpr:47.1.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.1
      ref_id: 47.1.a
      description: are legally binding and apply to and are enforced by every member
        concerned of the group of undertakings, or group of enterprises engaged in
        a joint economic activity, including their employees;
      translations:
        sv:
          description: "\xE4r r\xE4ttslig bindande, till\xE4mpas p\xE5, och verkst\xE4\
            lls av alla delar som ber\xF6rs inom den koncern eller grupp av f\xF6\
            retag som deltar i gemensam ekonomisk verksamhet, inklusive deras anst\xE4\
            llda,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.1.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.1
      ref_id: 47.1.b
      description: expressly confer enforceable rights on data subjects with regard
        to the processing of their personal data; and
      translations:
        sv:
          description: "inneh\xE5ller uttryckliga best\xE4mmelser om de registrerades\
            \ lagstadgade r\xE4ttigheter n\xE4r det g\xE4ller behandlingen av deras\
            \ personuppgifter, och"
    - urn: urn:intuitem:risk:req_node:gdpr:47.1.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.1
      ref_id: 47.1.c
      description: fulfil the requirements laid down in paragraph 2.
      translations:
        sv:
          description: uppfyller villkoren i punkt 2.
    - urn: urn:intuitem:risk:req_node:gdpr:47.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-47
      ref_id: '47.2'
      description: 'The binding corporate rules referred to in paragraph 1 shall specify
        at least:'
      translations:
        sv:
          description: "De bindande f\xF6retagsbest\xE4mmelser som avses i punkt 1\
            \ ska n\xE4rmare ange \xE5tminstone f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.a
      description: the structure and contact details of the group of undertakings,
        or group of enterprises engaged in a joint economic activity and of each of
        its members;
      translations:
        sv:
          description: "struktur och kontaktuppgifter f\xF6r den koncern eller grupp\
            \ av f\xF6retag som deltar i\_gemensam ekonomisk verksamhet och f\xF6\
            r var och en av dess medlemmar,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.b
      description: the data transfers or set of transfers, including the categories
        of personal data, the type of processing and its purposes, the type of data
        subjects affected and the identification of the third country or countries
        in question;
      translations:
        sv:
          description: "vilka \xF6verf\xF6ringar eller upps\xE4ttningar av \xF6verf\xF6\
            ringar av uppgifter som omfattas, inklusive kategorierna av personuppgifter,\
            \ typen av behandling och dess \xE4ndam\xE5l, den typ av registrerade\
            \ som ber\xF6rs samt vilket eller vilka tredjel\xE4nder som avses,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.c
      description: their legally binding nature, both internally and externally;
      translations:
        sv:
          description: "best\xE4mmelsernas r\xE4ttsligt bindande natur, s\xE5v\xE4\
            l internt som externt,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.d
      description: the application of the general data protection principles, in particular
        purpose limitation, data minimisation, limited storage periods, data quality,
        data protection by design and by default, legal basis for processing, processing
        of special categories of personal data, measures to ensure data security,
        and the requirements in respect of onward transfers to bodies not bound by
        the binding corporate rules;
      translations:
        sv:
          description: "till\xE4mpningen av allm\xE4nna principer f\xF6r dataskydd,\
            \ s\xE4rskilt avgr\xE4nsning av syften, uppgiftsminimering, begr\xE4nsade\
            \ lagringsperioder, datakvalitet, inbyggt dataskydd och dataskydd som\
            \ standard, r\xE4ttslig grund f\xF6r behandling, behandling av s\xE4rskilda\
            \ kategorier av personuppgifter, \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4\
            lla datas\xE4kerhet och villkoren n\xE4r det g\xE4ller vidare \xF6verf\xF6\
            ring av uppgifter till organ som inte \xE4r bundna av bindande f\xF6retagsbest\xE4\
            mmelser,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.e
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.e
      description: the rights of data subjects in regard to processing and the means
        to exercise those rights, including the right not to be subject to decisions
        based solely on automated processing, including profiling in accordance with
        Article 22, the right to lodge a complaint with the competent supervisory
        authority and before the competent courts of the Member States in accordance
        with Article 79, and to obtain redress and, where appropriate, compensation
        for a breach of the binding corporate rules;
      translations:
        sv:
          description: "de registrerades r\xE4ttigheter avseende behandling och medlen\
            \ f\xF6r att ut\xF6va dessa r\xE4ttigheter, inklusive r\xE4tten att inte\
            \ bli f\xF6rem\xE5l f\xF6r beslut grundade enbart p\xE5 automatisk behandling,\
            \ inklusive profilering, enligt artikel 22, r\xE4tten att inge klagom\xE5\
            l till den beh\xF6riga tillsynsmyndigheten och till beh\xF6riga domstolar\
            \ i\_medlemsstaterna enligt artikel 79, r\xE4tten till pr\xF6vning samt\
            \ i\_f\xF6rekommande fall r\xE4tten till kompensation f\xF6r \xF6vertr\xE4\
            delse av de bindande f\xF6retagsbest\xE4mmelserna,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.f
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.f
      description: the acceptance by the controller or processor established on the
        territory of a Member State of liability for any breaches of the binding corporate
        rules by any member concerned not established in the Union; the controller
        or the processor shall be exempt from that liability, in whole or in part,
        only if it proves that that member is not responsible for the event giving
        rise to the damage;
      translations:
        sv:
          description: "att den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det som \xE4r etablerad inom en medlemsstats territorium tar p\xE5 sig\
            \ ansvaret om en ber\xF6rd enhet som inte \xE4r etablerad inom unionen\
            \ bryter mot de bindande f\xF6retagsbest\xE4mmelserna; den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det f\xE5r helt eller delvis undantas fr\xE5\
            n denna skyldighet endast p\xE5 villkor att det kan visas att den ber\xF6\
            rda enheten i\_f\xF6retagsgruppen inte kan h\xE5llas ansvarig f\xF6r den\
            \ skada som har uppkommit,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.g
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.g
      description: how the information on the binding corporate rules, in particular
        on the provisions referred to in points (d), (e) and (f) of this paragraph
        is provided to the data subjects in addition to Articles 13 and 14;
      translations:
        sv:
          description: "hur de registrerade ska informeras om inneh\xE5llet i de bindande\
            \ f\xF6retagsbest\xE4mmelserna, s\xE4rskilt de best\xE4mmelser som avses\
            \ i leden d, e och f i denna punkt ut\xF6ver den information som avses\
            \ i artiklarna 13 och 14,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.h
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.h
      description: the tasks of any data protection officer designated in accordance
        with Article 37 or any other person or entity in charge of the monitoring
        compliance with the binding corporate rules within the group of undertakings,
        or group of enterprises engaged in a joint economic activity, as well as monitoring
        training and complaint-handling;
      translations:
        sv:
          description: "uppgifterna f\xF6r varje dataskyddsombud som utsetts i enlighet\
            \ med artikel 37, eller varje annan person eller enhet med ansvar f\xF6\
            r kontrollen av att de bindande f\xF6retagsbest\xE4mmelserna f\xF6ljs\
            \ inom den koncern eller grupp av f\xF6retag som deltar i\_gemensam ekonomisk\
            \ verksamhet, samt i fr\xE5ga om utbildning och hantering av klagom\xE5\
            l,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.i
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.i
      description: the complaint procedures;
      translations:
        sv:
          description: "f\xF6rfaranden f\xF6r klagom\xE5l,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.j
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.j
      description: the mechanisms within the group of undertakings, or group of enterprises
        engaged in a joint economic activity for ensuring the verification of compliance
        with the binding corporate rules. Such mechanisms shall include data protection
        audits and methods for ensuring corrective actions to protect the rights of
        the data subject. Results of such verification should be communicated to the
        person or entity referred to in point (h) and to the board of the controlling
        undertaking of a group of undertakings, or of the group of enterprises engaged
        in a joint economic activity, and should be available upon request to the
        competent supervisory authority;
      translations:
        sv:
          description: "rutinerna inom den koncern eller grupp av f\xF6retag som deltar\
            \ i gemensam ekonomisk verksamhet f\xF6r att kontrollera att de bindande\
            \ f\xF6retagsreglerna f\xF6ljs; s\xE5dana rutiner ska inbegripa dataskyddstillsyn\
            \ och metoder f\xF6r att s\xE4kerst\xE4lla korrigerande \xE5tg\xE4rder\
            \ f\xF6r att skydda de registrerades r\xE4ttigheter; resultaten av s\xE5\
            dana kontroller b\xF6r meddelas den person eller enhet som avses i led\
            \ h och styrelsen i det kontrollerande f\xF6retaget i koncernen eller\
            \ gruppen av f\xF6retag som deltar i gemensam ekonomisk verksamhet, och\
            \ b\xF6r p\xE5 beg\xE4ran vara tillg\xE4nglig f\xF6r den beh\xF6riga tillsynsmyndigheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.k
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.k
      description: the mechanisms for reporting and recording changes to the rules
        and reporting those changes to the supervisory authority;
      translations:
        sv:
          description: "rutinerna f\xF6r att rapportera och dokumentera \xE4ndringar\
            \ i best\xE4mmelserna, samt rutinerna f\xF6r att rapportera dessa \xE4\
            ndringar till tillsynsmyndigheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.l
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.l
      description: the cooperation mechanism with the supervisory authority to ensure
        compliance by any member of the group of undertakings, or group of enterprises
        engaged in a joint economic activity, in particular by making available to
        the supervisory authority the results of verifications of the measures referred
        to in point (j);
      translations:
        sv:
          description: "rutinerna f\xF6r att samarbeta med tillsynsmyndigheten i syfte\
            \ att se till att alla medlemmar i\_den koncern eller grupp av f\xF6retag\
            \ som deltar i gemensam ekonomisk verksamhet f\xF6ljer reglerna, s\xE4\
            rskilt genom att meddela tillsynsmyndigheten resultaten av kontroller\
            \ av de \xE5tg\xE4rder som avses i led j,"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.m
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.m
      description: the mechanisms for reporting to the competent supervisory authority
        any legal requirements to which a member of the group of undertakings, or
        group of enterprises engaged in a joint economic activity is subject in a
        third country which are likely to have a substantial adverse effect on the
        guarantees provided by the binding corporate rules; and
      translations:
        sv:
          description: "rutinerna f\xF6r att till den beh\xF6riga tillsynsmyndigheten\
            \ rapportera alla r\xE4ttsliga krav som en medlem i koncernen eller gruppen\
            \ av f\xF6retag som deltar i gemensam ekonomisk verksamhet \xE4r underkastad\
            \ i ett tredjeland och som sannolikt kommer att ha en avsev\xE4rd negativ\
            \ inverkan p\xE5 de garantier som ges genom de bindande f\xF6retagsbest\xE4\
            mmelserna, och"
    - urn: urn:intuitem:risk:req_node:gdpr:47.2.n
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:47.2
      ref_id: 47.2.n
      description: he appropriate data protection training to personnel having permanent
        or regular access to personal data.
      translations:
        sv:
          description: "l\xE4mplig utbildning om dataskydd f\xF6r personal som har\
            \ st\xE4ndig eller regelbunden tillg\xE5ng till personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:47.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-47
      ref_id: '47.3'
      description: The Commission may specify the format and procedures for the exchange
        of information between controllers, processors and supervisory authorities
        for binding corporate rules within the meaning of this Article. Those implementing
        acts shall be adopted in accordance with the examination procedure set out
        in Article 93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r n\xE4rmare ange vilket format och vilka\
            \ rutiner som ska anv\xE4ndas f\xF6r de personuppgiftsansvarigas, personuppgiftsbitr\xE4\
            denas och tillsynsmyndigheternas utbyte av information om bindande f\xF6\
            retagsbest\xE4mmelser i den mening som avses i denna artikel. Dessa genomf\xF6\
            randeakter ska antas i enlighet med det granskningsf\xF6rfarande som avses\
            \ i artikel\_93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:article-48
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 48
      description: Transfers or disclosures not authorised by Union law
      translations:
        sv:
          name: Artikel 48
          description: "\xD6verf\xF6ringar och utl\xE4mnanden som inte \xE4r till\xE5\
            tna enligt unionsr\xE4tten"
    - urn: urn:intuitem:risk:req_node:gdpr:node705
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-48
      description: Any judgment of a court or tribunal and any decision of an administrative
        authority of a third country requiring a controller or processor to transfer
        or disclose personal data may only be recognised or enforceable in any manner
        if based on an international agreement, such as a mutual legal assistance
        treaty, in force between the requesting third country and the Union or a Member
        State, without prejudice to other grounds for transfer pursuant to this Chapter.
      translations:
        sv:
          description: "Domstolsbeslut eller beslut fr\xE5n myndigheter i tredjeland\
            \ d\xE4r det kr\xE4vs att en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de \xF6verf\xF6r eller l\xE4mnar ut personuppgifter f\xE5r erk\xE4nnas\
            \ eller genomf\xF6ras p\xE5 n\xE5got som helst s\xE4tt endast om det grundar\
            \ sig p\xE5 en internationell \xF6verenskommelse, s\xE5som ett avtal om\
            \ \xF6msesidig r\xE4ttslig hj\xE4lp, som g\xE4ller mellan det beg\xE4\
            rande tredjelandet och unionen eller en medlemsstat, utan att detta p\xE5\
            verkar andra grunder f\xF6r \xF6verf\xF6ring enligt detta kapitel."
    - urn: urn:intuitem:risk:req_node:gdpr:article-49
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 49
      description: Derogations for specific situations
      translations:
        sv:
          name: Artikel 49
          description: "Undantag i s\xE4rskilda situationer"
    - urn: urn:intuitem:risk:req_node:gdpr:49.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.1'
      description: 'In the absence of an adequacy decision pursuant to Article 45(3),
        or of appropriate safeguards pursuant to Article 46, including binding corporate
        rules, a transfer or a set of transfers of personal data to a third country
        or an international organisation shall take place only on one of the following
        conditions:'
      translations:
        sv:
          description: "Om det inte f\xF6religger n\xE5got beslut om adekvat skyddsniv\xE5\
            \ enligt artikel 45.3, eller om l\xE4mpliga skydds\xE5tg\xE4rder enligt\
            \ artikel 46, inbegripet bindande f\xF6retagsbest\xE4mmelser, f\xE5r en\
            \ \xF6verf\xF6ring eller upps\xE4ttning av \xF6verf\xF6ringar av personuppgifter\
            \ till ett tredjeland eller en internationell organisation endast ske\
            \ om n\xE5got av f\xF6ljande villkor \xE4r uppfyllt:"
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.a
      description: the data subject has explicitly consented to the proposed transfer,
        after having been informed of the possible risks of such transfers for the
        data subject due to the absence of an adequacy decision and appropriate safeguards;
      translations:
        sv:
          description: "Den registrerade har uttryckligen samtyckt till att uppgifterna\
            \ f\xE5r \xF6verf\xF6ras, efter att f\xF6rst ha blivit informerad om de\
            \ eventuella riskerna med s\xE5dana \xF6verf\xF6ringar f\xF6r den registrerade\
            \ n\xE4r det inte f\xF6religger n\xE5got beslut om adekvat skyddsniv\xE5\
            \ eller l\xE4mpliga skydds\xE5tg\xE4rder."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.b
      description: the transfer is necessary for the performance of a contract between
        the data subject and the controller or the implementation of pre-contractual
        measures taken at the data subject's request;
      translations:
        sv:
          description: "\xD6verf\xF6ringen \xE4r n\xF6dv\xE4ndig f\xF6r att fullg\xF6\
            ra ett avtal mellan den registrerade och den personuppgiftsansvarige eller\
            \ f\xF6r att genomf\xF6ra \xE5tg\xE4rder som f\xF6reg\xE5r ett s\xE5dant\
            \ avtal p\xE5 den registrerades beg\xE4ran."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.c
      description: the transfer is necessary for the conclusion or performance of
        a contract concluded in the interest of the data subject between the controller
        and another natural or legal person;
      translations:
        sv:
          description: "\xD6verf\xF6ringen \xE4r n\xF6dv\xE4ndig f\xF6r att ing\xE5\
            \ eller fullg\xF6ra ett avtal mellan den personuppgiftsansvarige och en\
            \ annan fysisk eller juridisk person i den registrerades intresse."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.d
      description: the transfer is necessary for important reasons of public interest;
      translations:
        sv:
          description: "\xD6verf\xF6ringen \xE4r n\xF6dv\xE4ndig av viktiga sk\xE4\
            l som r\xF6r allm\xE4nintresset."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.e
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.e
      description: the transfer is necessary for the establishment, exercise or defence
        of legal claims;
      translations:
        sv:
          description: "\xD6verf\xF6ringen \xE4r n\xF6dv\xE4ndig f\xF6r att kunna\
            \ fastst\xE4lla, g\xF6ra g\xE4llande eller f\xF6rsvara r\xE4ttsliga anspr\xE5\
            k."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.f
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.f
      description: the transfer is necessary in order to protect the vital interests
        of the data subject or of other persons, where the data subject is physically
        or legally incapable of giving consent;
      translations:
        sv:
          description: "\xD6verf\xF6ringen \xE4r n\xF6dv\xE4ndig f\xF6r att skydda\
            \ den registrerades eller andra personers grundl\xE4ggande intressen,\
            \ n\xE4r den registrerade \xE4r fysiskt eller r\xE4ttsligt f\xF6rhindrad\
            \ att ge sitt samtycke."
    - urn: urn:intuitem:risk:req_node:gdpr:49.1.g
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:49.1
      ref_id: 49.1.g
      description: the transfer is made from a register which according to Union or
        Member State law is intended to provide information to the public and which
        is open to consultation either by the public in general or by any person who
        can demonstrate a legitimate interest, but only to the extent that the conditions
        laid down by Union or Member State law for consultation are fulfilled in the
        particular case.
      translations:
        sv:
          description: "\xD6verf\xF6ringen g\xF6rs fr\xE5n ett register som enligt\
            \ unionsr\xE4tten eller medlemsstaternas nationella r\xE4tt \xE4r avsett\
            \ att ge allm\xE4nheten information och som \xE4r tillg\xE4ngligt antingen\
            \ f\xF6r allm\xE4nheten eller f\xF6r var och en som kan styrka ett ber\xE4\
            ttigat intresse, men endast i den utstr\xE4ckning som de i unionsr\xE4\
            tten eller i medlemsstaternas nationella r\xE4tt angivna villkoren f\xF6\
            r tillg\xE4nglighet uppfylls i det enskilda fallet."
    - urn: urn:intuitem:risk:req_node:gdpr:node715
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      description: Where a transfer could not be based on a provision in Article 45
        or 46, including the provisions on binding corporate rules, and none of the
        derogations for a specific situation referred to in the first subparagraph
        of this paragraph is applicable, a transfer to a third country or an international
        organisation may take place only if the transfer is not repetitive, concerns
        only a limited number of data subjects, is necessary for the purposes of compelling
        legitimate interests pursued by the controller which are not overridden by
        the interests or rights and freedoms of the data subject, and the controller
        has assessed all the circumstances surrounding the data transfer and has on
        the basis of that assessment provided suitable safeguards with regard to the
        protection of personal data. The controller shall inform the supervisory authority
        of the transfer. The controller shall, in addition to providing the information
        referred to in Articles 13 and 14, inform the data subject of the transfer
        and on the compelling legitimate interests pursued.
      translations:
        sv:
          description: "N\xE4r en \xF6verf\xF6ring inte skulle kunna grundas p\xE5\
            \ en best\xE4mmelse i artikel 45 eller 46, inklusive best\xE4mmelserna\
            \ om bindande f\xF6retagsbest\xE4mmelser, och inget av undantagen f\xF6\
            r en s\xE4rskild situation som avses i f\xF6rsta stycket i den h\xE4r\
            \ punkten \xE4r till\xE4mpligt, f\xE5r en \xF6verf\xF6ring till ett tredjeland\
            \ eller en internationell organisation \xE4ga rum endast om\xF6verf\xF6\
            ringen inte \xE4r repetitiv, endast g\xE4ller ett begr\xE4nsat antal registrerade,\
            \ \xE4r n\xF6dv\xE4ndig f\xF6r \xE4ndam\xE5l som r\xF6r den personuppgiftsansvariges\
            \ tvingande ber\xE4ttigade intressen och den registrerades intressen eller\
            \ r\xE4ttigheter och friheter inte v\xE4ger tyngre, och den personuppgiftsansvarige\
            \ har bed\xF6mt samtliga omst\xE4ndigheter kring \xF6verf\xF6ringen av\
            \ uppgifter och p\xE5 grundval av denna bed\xF6mning vidtagit l\xE4mpliga\
            \ skydds\xE5tg\xE4rder f\xF6r att skydda personuppgifter. Den personuppgiftsansvarige\
            \ ska informera tillsynsmyndigheten om \xF6verf\xF6ringen. Den personuppgiftsansvarige\
            \ ska ut\xF6ver tillhandah\xE5llande av den information som avses i\_\
            artiklarna 13 och 14 informera den registrerade om \xF6verf\xF6ringen\
            \ och om de tvingande ber\xE4ttigade intressen som efterstr\xE4vas."
    - urn: urn:intuitem:risk:req_node:gdpr:49.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.2'
      description: A transfer pursuant to point (g) of the first subparagraph of paragraph
        1 shall not involve the entirety of the personal data or entire categories
        of the personal data contained in the register. Where the register is intended
        for consultation by persons having a legitimate interest, the transfer shall
        be made only at the request of those persons or if they are to be the recipients.
      translations:
        sv:
          description: "En \xF6verf\xF6ring enligt led g i punkt 1 f\xF6rsta stycket\
            \ f\xE5r inte omfatta alla personuppgifter eller hela kategorier av personuppgifter\
            \ som finns i registret. Om registret \xE4r avsett att vara tillg\xE4\
            ngligt f\xF6r personer med ett ber\xE4ttigat intresse ska \xF6verf\xF6\
            ringen g\xF6ras endast p\xE5 beg\xE4ran av dessa personer eller om de\
            \ sj\xE4lva \xE4r mottagarna."
    - urn: urn:intuitem:risk:req_node:gdpr:49.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.3'
      description: Points (a), (b) and (c) of the first subparagraph of paragraph
        1 and the second subparagraph thereof shall not apply to activities carried
        out by public authorities in the exercise of their public powers.
      translations:
        sv:
          description: "Leden a, b och c i punkt 1 f\xF6rsta stycket samt andra stycket\
            \ i samma punkt ska inte g\xE4lla \xE5tg\xE4rder som vidtas av offentliga\
            \ myndigheter som ett led i myndighetsut\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:49.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.4'
      description: The public interest referred to in point (d) of the first subparagraph
        of paragraph 1 shall be recognised in Union law or in the law of the Member
        State to which the controller is subject.
      translations:
        sv:
          description: "Det allm\xE4nintresse som avses i led d i punkt 1 f\xF6rsta\
            \ stycket ska vara erk\xE4nt i unionsr\xE4tten eller i den nationella\
            \ r\xE4tt som den personuppgiftsansvarige omfattas av."
    - urn: urn:intuitem:risk:req_node:gdpr:49.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.5'
      description: In the absence of an adequacy decision, Union or Member State law
        may, for important reasons of public interest, expressly set limits to the
        transfer of specific categories of personal data to a third country or an
        international organisation. Member States shall notify such provisions to
        the Commission.
      translations:
        sv:
          description: "Saknas beslut om adekvat skyddsniv\xE5, f\xE5r unionsr\xE4\
            tten eller medlemsstaternas nationella r\xE4tt med h\xE4nsyn till viktiga\
            \ allm\xE4nintressen uttryckligen fastst\xE4lla gr\xE4nser f\xF6r \xF6\
            verf\xF6ringen av specifika kategorier av personuppgifter till ett tredjeland\
            \ eller en internationell organisation. Medlemsstaterna ska underr\xE4\
            tta kommissionen om s\xE5dana best\xE4mmelser."
    - urn: urn:intuitem:risk:req_node:gdpr:49.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-49
      ref_id: '49.6'
      description: The controller or processor shall document the assessment as well
        as the suitable safeguards referred to in the second subparagraph of paragraph
        1 of this Article in the records referred to in Article 30.
      translations:
        sv:
          description: "Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det\
            \ ska bevara uppgifter b\xE5de om bed\xF6mningen och om de l\xE4mpliga\
            \ skydds\xE5tg\xE4rder som avses i punkt 1 andra stycket i den h\xE4r\
            \ artikeln i det register som avses i artikel 30."
    - urn: urn:intuitem:risk:req_node:gdpr:article-50
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-v
      ref_id: Article 50
      description: International cooperation for the protection of personal data
      translations:
        sv:
          name: Artikel 50
          description: "Internationellt samarbete f\xF6r skydd av personuppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:node722
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-50
      description: 'In relation to third countries and international organisations,
        the Commission and supervisory authorities shall take appropriate steps to:'
      translations:
        sv:
          description: "N\xE4r det g\xE4ller tredjel\xE4nder och internationella organisationer\
            \ ska kommissionen och tillsynsmyndigheterna vidta l\xE4mpliga \xE5tg\xE4\
            rder f\xF6r att"
    - urn: urn:intuitem:risk:req_node:gdpr:50.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node722
      ref_id: 50.a
      description: develop international cooperation mechanisms to facilitate the
        effective enforcement of legislation for the protection of personal data;
      translations:
        sv:
          description: "utveckla rutiner f\xF6r det internationella samarbetet f\xF6\
            r att underl\xE4tta en effektiv till\xE4mpning av lagstiftningen om skydd\
            \ av personuppgifter,"
    - urn: urn:intuitem:risk:req_node:gdpr:50.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node722
      ref_id: 50.b
      description: provide international mutual assistance in the enforcement of legislation
        for the protection of personal data, including through notification, complaint
        referral, investigative assistance and information exchange, subject to appropriate
        safeguards for the protection of personal data and other fundamental rights
        and freedoms;
      translations:
        sv:
          description: "p\xE5 internationell niv\xE5 erbjuda \xF6msesidigt bist\xE5\
            nd f\xF6r en effektiv till\xE4mpning av lagstiftningen om skydd av personuppgifter,\
            \ bland annat genom underr\xE4ttelse, h\xE4nskjutande av klagom\xE5l,\
            \ bist\xE5nd vid utredningar samt informationsutbyte, med iakttagande\
            \ av l\xE4mpliga skydds\xE5tg\xE4rder f\xF6r personuppgifter samt skyddet\
            \ av andra grundl\xE4ggande r\xE4ttigheter och friheter,"
    - urn: urn:intuitem:risk:req_node:gdpr:50.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node722
      ref_id: 50.c
      description: engage relevant stakeholders in discussion and activities aimed
        at furthering international cooperation in the enforcement of legislation
        for the protection of personal data;
      translations:
        sv:
          description: "involvera ber\xF6rda akt\xF6rer i diskussioner och \xE5tg\xE4\
            rder som syftar till att \xF6ka det internationella samarbetet n\xE4r\
            \ det g\xE4ller till\xE4mpningen av lagstiftningen om skydd av personuppgifter,"
    - urn: urn:intuitem:risk:req_node:gdpr:50.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:node722
      ref_id: 50.d
      description: promote the exchange and documentation of personal data protection
        legislation and practice, including on jurisdictional conflicts with third
        countries.
      translations:
        sv:
          description: "fr\xE4mja utbyte och dokumentation om lagstiftning och praxis\
            \ f\xF6r skydd av personuppgifter, inklusive avseende beh\xF6righetskonflikter\
            \ med tredjel\xE4nder."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-vi
      assessable: false
      depth: 1
      ref_id: CHAPTER VI
      description: Independent supervisory authorities
      translations:
        sv:
          name: KAPITEL VI
          description: Oberoende tillsynsmyndigheter
    - urn: urn:intuitem:risk:req_node:gdpr:node728
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-vi
      name: Section 1
      description: Independent status
      translations:
        sv:
          name: Avsnitt 1
          description: "Oberoende st\xE4llning"
    - urn: urn:intuitem:risk:req_node:gdpr:article-51
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node728
      ref_id: Article 51
      description: Supervisory authority
      translations:
        sv:
          name: Artikel 51
          description: Tillsynsmyndighet
    - urn: urn:intuitem:risk:req_node:gdpr:51.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-51
      ref_id: '51.1'
      description: "Each Member State shall provide for one or more independent public\
        \ authorities to be responsible for monitoring the application of this Regulation,\
        \ in order to protect the fundamental rights and freedoms of natural persons\
        \ in relation to processing and to facilitate the free flow of personal data\
        \ within the Union (\u2018supervisory authority\u2019)."
      translations:
        sv:
          description: "Varje medlemsstat ska f\xF6reskriva att en eller flera offentliga\
            \ myndigheter ska vara ansvariga f\xF6r att \xF6vervaka till\xE4mpningen\
            \ av denna f\xF6rordning, i syfte att skydda fysiska personers grundl\xE4\
            ggande r\xE4ttigheter och friheter i samband med behandling samt att underl\xE4\
            tta det fria fl\xF6det av s\xE5dana uppgifter inom unionen (nedan kallad\_\
            tillsynsmyndighet)."
    - urn: urn:intuitem:risk:req_node:gdpr:51.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-51
      ref_id: '51.2'
      description: Each supervisory authority shall contribute to the consistent application
        of this Regulation throughout the Union. For that purpose, the supervisory
        authorities shall cooperate with each other and the Commission in accordance
        with Chapter VII.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska bidra till en enhetlig till\xE4\
            mpning av denna f\xF6rordning i hela unionen. F\xF6r detta \xE4ndam\xE5\
            l ska tillsynsmyndigheterna samarbeta s\xE5v\xE4l sinsemellan som med\
            \ kommissionen i enlighet med kapitel VII."
    - urn: urn:intuitem:risk:req_node:gdpr:51.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-51
      ref_id: '51.3'
      description: Where more than one supervisory authority is established in a Member
        State, that Member State shall designate the supervisory authority which is
        to represent those authorities in the Board and shall set out the mechanism
        to ensure compliance by the other authorities with the rules relating to the
        consistency mechanism referred to in Article 63.
      translations:
        sv:
          description: "Om det finns fler \xE4n en tillsynsmyndighet i en medlemsstat\
            \ ska medlemsstaten utse den tillsynsmyndighet som ska f\xF6retr\xE4da\
            \ dessa myndigheter i styrelsen; medlemsstaten ska ocks\xE5 uppr\xE4tta\
            \ en rutin f\xF6r att se till att \xF6vriga myndigheter f\xF6ljer reglerna\
            \ f\xF6r den mekanism f\xF6r enhetlighet som avses i artikel 63."
    - urn: urn:intuitem:risk:req_node:gdpr:51.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-51
      ref_id: '51.4'
      description: Each Member State shall notify to the Commission the provisions
        of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without
        delay, any subsequent amendment affecting them.
      translations:
        sv:
          description: "Varje medlemsstat ska senast den 25 maj 2018 anm\xE4la till\
            \ kommissionen vilka nationella best\xE4mmelser den antar i\_enlighet\
            \ med detta kapitel, och alla framtida \xE4ndringar som r\xF6r dessa best\xE4\
            mmelser ska anm\xE4las utan dr\xF6jsm\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:article-52
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node728
      ref_id: Article 52
      description: Independence
      translations:
        sv:
          name: Artikel 52
          description: Oberoende
    - urn: urn:intuitem:risk:req_node:gdpr:52.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.1'
      description: Each supervisory authority shall act with complete independence
        in performing its tasks and exercising its powers in accordance with this
        Regulation.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska vara fullst\xE4ndigt oberoende\
            \ i utf\xF6randet av sina uppgifter och ut\xF6vandet av sina befogenheter\
            \ i enlighet med denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:52.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.2'
      description: The member or members of each supervisory authority shall, in the
        performance of their tasks and exercise of their powers in accordance with
        this Regulation, remain free from external influence, whether direct or indirect,
        and shall neither seek nor take instructions from anybody.
      translations:
        sv:
          description: "Varje tillsynsmyndighets ledamot eller ledam\xF6ter ska i\
            \ utf\xF6randet av sina uppgifter och ut\xF6vandet av sina befogenheter\
            \ i enlighet med denna f\xF6rordning st\xE5 fria fr\xE5n utomst\xE5ende\
            \ p\xE5verkan, direkt s\xE5v\xE4l som indirekt, och f\xE5r varken beg\xE4\
            ra eller ta emot instruktioner av n\xE5gon."
    - urn: urn:intuitem:risk:req_node:gdpr:52.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.3'
      description: Member or members of each supervisory authority shall refrain from
        any action incompatible with their duties and shall not, during their term
        of office, engage in any incompatible occupation, whether gainful or not.
      translations:
        sv:
          description: "Tillsynsmyndighetens ledam\xF6ter ska avh\xE5lla sig fr\xE5\
            n alla handlingar som \xE4r of\xF6renliga med deras skyldigheter och under\
            \ sin mandattid avst\xE5 fr\xE5n all annan avl\xF6nad eller oavl\xF6nad\
            \ yrkesverksamhet som st\xE5r i strid med deras tj\xE4nsteut\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:52.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.4'
      description: Each Member State shall ensure that each supervisory authority
        is provided with the human, technical and financial resources, premises and
        infrastructure necessary for the effective performance of its tasks and exercise
        of its powers, including those to be carried out in the context of mutual
        assistance, cooperation and participation in the Board.
      translations:
        sv:
          description: "Varje medlemsstat ska s\xE4kerst\xE4lla att varje tillsynsmyndighet\
            \ f\xF6rfogar \xF6ver de personella, tekniska och finansiella resurser\
            \ samt de lokaler och den infrastruktur som beh\xF6vs f\xF6r att myndigheten\
            \ ska kunna utf\xF6ra sina uppgifter och ut\xF6va sina befogenheter, inklusive\
            \ inom ramen f\xF6r det \xF6msesidiga bist\xE5ndet, samarbetet och deltagandet\
            \ i styrelsens verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:52.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.5'
      description: Each Member State shall ensure that each supervisory authority
        chooses and has its own staff which shall be subject to the exclusive direction
        of the member or members of the supervisory authority concerned.
      translations:
        sv:
          description: "Varje medlemsstat ska s\xE4kerst\xE4lla att varje tillsynsmyndighet\
            \ v\xE4ljer och f\xF6rfogar \xF6ver egen personal, som ska ta instruktioner\
            \ uteslutande fr\xE5n den ber\xF6rda tillsynsmyndighetens ledamot eller\
            \ ledam\xF6ter."
    - urn: urn:intuitem:risk:req_node:gdpr:52.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-52
      ref_id: '52.6'
      description: Each Member State shall ensure that each supervisory authority
        is subject to financial control which does not affect its independence and
        that it has separate, public annual budgets, which may be part of the overall
        state or national budget.
      translations:
        sv:
          description: "Varje medlemsstat ska s\xE4kerst\xE4lla att varje tillsynsmyndighet\
            \ blir f\xF6rem\xE5l f\xF6r finansiell kontroll, utan att detta p\xE5\
            verkar tillsynsmyndighetens oberoende och att de f\xF6rfogar \xF6ver en\
            \ separat, offentlig \xE5rsbudget som kan ing\xE5 i den \xF6vergripande\
            \ statsbudgeten eller nationella budgeten."
    - urn: urn:intuitem:risk:req_node:gdpr:article-53
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node728
      ref_id: Article 53
      description: General conditions for the members of the supervisory authority
      translations:
        sv:
          name: Artikel 53
          description: "Allm\xE4nna villkor f\xF6r tillsynsmyndighetens ledam\xF6\
            ter"
    - urn: urn:intuitem:risk:req_node:gdpr:53.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      ref_id: '53.1'
      description: 'Member States shall provide for each member of their supervisory
        authorities to be appointed by means of a transparent procedure by:'
      translations:
        sv:
          description: "Medlemsstaterna ska f\xF6reskriva att varje ledamot av deras\
            \ tillsynsmyndigheter ska utn\xE4mnas genom ett genom ett \xF6ppet f\xF6\
            rfarande med insyn av"
    - urn: urn:intuitem:risk:req_node:gdpr:node743
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      description: "\u2014 their parliament;"
      translations:
        sv:
          description: "\u2014 deras parlament,"
    - urn: urn:intuitem:risk:req_node:gdpr:node744
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      description: "\u2014 their government;"
      translations:
        sv:
          description: "\u2014 \t\nderas regering,"
    - urn: urn:intuitem:risk:req_node:gdpr:node745
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      description: "\u2014 their head of State; or"
      translations:
        sv:
          description: "\u2014 \t\nderas statschef, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:node746
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      description: "\u2014 an independent body entrusted with the appointment under\
        \ Member State law."
      translations:
        sv:
          description: "\u2014 ett oberoende organ som genom medlemsstatens nationella\
            \ r\xE4tt anf\xF6rtrotts utn\xE4mningen."
    - urn: urn:intuitem:risk:req_node:gdpr:53.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      ref_id: '53.2'
      description: Each member shall have the qualifications, experience and skills,
        in particular in the area of the protection of personal data, required to
        perform its duties and exercise its powers.
      translations:
        sv:
          description: "Varje ledamot ska ha de kvalifikationer, den erfarenhet och\
            \ den kompetens, s\xE4rskilt p\xE5 omr\xE5det skydd av personuppgifter,\
            \ som kr\xE4vs f\xF6r att ledamoten ska kunna utf\xF6ra sitt uppdrag och\
            \ ut\xF6va sina befogenheter."
    - urn: urn:intuitem:risk:req_node:gdpr:53.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      ref_id: '53.3'
      description: The duties of a member shall end in the event of the expiry of
        the term of office, resignation or compulsory retirement, in accordance with
        the law of the Member State concerned.
      translations:
        sv:
          description: "En ledamots uppdrag ska upph\xF6ra d\xE5 mandattiden l\xF6\
            per ut eller om ledamoten avg\xE5r eller avs\xE4tts fr\xE5n sin tj\xE4\
            nst i enlighet med den ber\xF6rda medlemsstatens nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:53.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-53
      ref_id: '53.4'
      description: A member shall be dismissed only in cases of serious misconduct
        or if the member no longer fulfils the conditions required for the performance
        of the duties.
      translations:
        sv:
          description: "En ledamot f\xE5r avs\xE4ttas endast p\xE5 grund av grov f\xF6\
            rsummelse eller n\xE4r ledamoten inte l\xE4ngre uppfyller de villkor som\
            \ kr\xE4vs f\xF6r att utf\xF6ra uppdraget."
    - urn: urn:intuitem:risk:req_node:gdpr:article-54
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node728
      ref_id: Article 54
      description: Rules on the establishment of the supervisory authority
      translations:
        sv:
          name: Artikel 54
          description: "Regler f\xF6r inr\xE4ttandet av en tillsynsmyndighet"
    - urn: urn:intuitem:risk:req_node:gdpr:54.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-54
      ref_id: '54.1'
      description: 'Each Member State shall provide by law for all of the following:'
      translations:
        sv:
          description: "Varje medlemsstat ska fastst\xE4lla f\xF6ljande i lag:"
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.a
      description: the establishment of each supervisory authority;
      translations:
        sv:
          description: "Varje tillsynsmyndighets inr\xE4ttande."
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.b
      description: the qualifications and eligibility conditions required to be appointed
        as member of each supervisory authority;
      translations:
        sv:
          description: "De kvalifikationer och de villkor f\xF6r l\xE4mplighet som\
            \ kr\xE4vs f\xF6r att n\xE5gon ska kunna utn\xE4mnas till ledamot av en\
            \ tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.c
      description: the rules and procedures for the appointment of the member or members
        of each supervisory authority;
      translations:
        sv:
          description: "Regler och f\xF6rfaranden f\xF6r att utse varje tillsynsmyndighets\
            \ ledamot eller ledam\xF6ter."
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.d
      description: the duration of the term of the member or members of each supervisory
        authority of no less than four years, except for the first appointment after
        24 May 2016, part of which may take place for a shorter period where that
        is necessary to protect the independence of the supervisory authority by means
        of a staggered appointment procedure;
      translations:
        sv:
          description: "Mandattiden f\xF6r varje tillsynsmyndighets ledamot eller\
            \ ledam\xF6ter, vilken inte f\xE5r understiga fyra \xE5r, utom vid tills\xE4\
            ttandet av de f\xF6rsta ledam\xF6terna efter den 24 maj 2016, d\xE5 ett\
            \ stegvis tills\xE4ttningsf\xF6rfarande med kortare perioder f\xF6r n\xE5\
            gra av ledam\xF6terna f\xE5r till\xE4mpas om detta \xE4r n\xF6dv\xE4ndigt\
            \ f\xF6r att s\xE4kerst\xE4lla myndighetens oberoende."
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.e
      description: whether and, if so, for how many terms the member or members of
        each supervisory authority is eligible for reappointment;
      translations:
        sv:
          description: "Huruvida varje tillsynsmyndighets ledamot eller ledam\xF6\
            ter f\xE5r ges f\xF6rnyat mandat, och om s\xE5 \xE4r fallet, f\xF6r hur\
            \ m\xE5nga perioder."
    - urn: urn:intuitem:risk:req_node:gdpr:54.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:54.1
      ref_id: 54.1.f
      description: the conditions governing the obligations of the member or members
        and staff of each supervisory authority, prohibitions on actions, occupations
        and benefits incompatible therewith during and after the term of office and
        rules governing the cessation of employment.
      translations:
        sv:
          description: "Vilka villkor som g\xE4ller f\xF6r de skyldigheter som varje\
            \ tillsynsmyndighets ledamot eller ledam\xF6ter och personal har, f\xF6\
            rbud mot handlingar, yrkesverksamhet och f\xF6rm\xE5ner som st\xE5r i\
            \ strid d\xE4rmed under och efter mandattiden och vilka best\xE4mmelser\
            \ som g\xE4ller f\xF6r anst\xE4llningens upph\xF6rande."
    - urn: urn:intuitem:risk:req_node:gdpr:54.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-54
      ref_id: '54.2'
      description: The member or members and the staff of each supervisory authority
        shall, in accordance with Union or Member State law, be subject to a duty
        of professional secrecy both during and after their term of office, with regard
        to any confidential information which has come to their knowledge in the course
        of the performance of their tasks or exercise of their powers. During their
        term of office, that duty of professional secrecy shall in particular apply
        to reporting by natural persons of infringements of this Regulation.
      translations:
        sv:
          description: "Varje tillsynsmyndighets ledamot eller ledam\xF6ter och personal\
            \ ska i enlighet med unionsr\xE4tten eller medlemsstaternas nationella\
            \ r\xE4tt omfattas av tystnadsplikt b\xE5de under och efter sin mandattid\
            \ vad avser konfidentiell information som de f\xE5tt kunskap om under\
            \ utf\xF6randet av deras uppgifter eller ut\xF6vandet av deras befogenheter.\
            \ Under mandatperioden ska denna tystnadsplikt i synnerhet g\xE4lla rapportering\
            \ fr\xE5n fysiska personer om \xF6vertr\xE4delser av denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:node759
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-vi
      name: Section 2
      description: Competence, tasks and powers
      translations:
        sv:
          name: Avsnitt 2
          description: "Beh\xF6righet, uppgifter och befogenheter"
    - urn: urn:intuitem:risk:req_node:gdpr:article-55
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node759
      ref_id: Article 55
      description: Competence
      translations:
        sv:
          name: Artikel 55
          description: "Beh\xF6righet"
    - urn: urn:intuitem:risk:req_node:gdpr:55.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-55
      ref_id: '55.1'
      description: Each supervisory authority shall be competent for the performance
        of the tasks assigned to and the exercise of the powers conferred on it in
        accordance with this Regulation on the territory of its own Member State.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska vara beh\xF6rig att utf\xF6ra\
            \ de uppgifter och ut\xF6va de befogenheter som tilldelas den enligt denna\
            \ f\xF6rordning inom sin egen medlemsstats territorium."
    - urn: urn:intuitem:risk:req_node:gdpr:55.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-55
      ref_id: '55.2'
      description: Where processing is carried out by public authorities or private
        bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory
        authority of the Member State concerned shall be competent. In such cases
        Article 56 does not apply.
      translations:
        sv:
          description: "Om behandling utf\xF6rs av myndigheter eller privata organ\
            \ som agerar p\xE5 grundval av artikel\_6.1\_c eller e ska tillsynsmyndigheten\
            \ i den ber\xF6rda medlemsstaten vara beh\xF6rig. I\_s\xE5dana fall ska\
            \ artikel 56 inte till\xE4mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:55.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-55
      ref_id: '55.3'
      description: Supervisory authorities shall not be competent to supervise processing
        operations of courts acting in their judicial capacity.
      translations:
        sv:
          description: "Tillsynsmyndigheterna ska inte vara beh\xF6riga att ut\xF6\
            va tillsyn \xF6ver domstolar som behandlar personuppgifter i sin d\xF6\
            mande verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-56
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node759
      ref_id: Article 56
      description: Competence of the lead supervisory authority
      translations:
        sv:
          name: Artikel 56
          description: "Den ansvariga tillsynsmyndighetens beh\xF6righet"
    - urn: urn:intuitem:risk:req_node:gdpr:56.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.1'
      description: Without prejudice to Article 55, the supervisory authority of the
        main establishment or of the single establishment of the controller or processor
        shall be competent to act as lead supervisory authority for the cross-border
        processing carried out by that controller or processor in accordance with
        the procedure provided in Article 60.
      translations:
        sv:
          description: "Utan att det p\xE5verkar till\xE4mpningen av artikel 55 ska\
            \ tillsynsmyndigheten f\xF6r den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets huvudsakliga verksamhetsst\xE4lle eller enda verksamhetsst\xE4lle\
            \ vara beh\xF6rig att agera som ansvarig tillsynsmyndighet f\xF6r den\
            \ personuppgiftsansvariges eller personuppgiftsbitr\xE4dets gr\xE4ns\xF6\
            verskridande behandling i\_enlighet med det f\xF6rfarande som f\xF6reskrivs\
            \ i artikel 60."
    - urn: urn:intuitem:risk:req_node:gdpr:56.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.2'
      description: By derogation from paragraph 1, each supervisory authority shall
        be competent to handle a complaint lodged with it or a possible infringement
        of this Regulation, if the subject matter relates only to an establishment
        in its Member State or substantially affects data subjects only in its Member
        State.
      translations:
        sv:
          description: "Genom undantag fr\xE5n punkt 1 ska varje tillsynsmyndighet\
            \ vara beh\xF6rig att behandla ett klagom\xE5l som l\xE4mnats in till\
            \ denna eller en eventuell \xF6vertr\xE4delse av denna f\xF6rordning,\
            \ om sakfr\xE5gan i \xE4rendet endast r\xF6r ett verksamhetsst\xE4lle\
            \ i medlemsstaten eller i\_v\xE4sentlig grad p\xE5verkar registrerade\
            \ endast i medlemsstaten."
    - urn: urn:intuitem:risk:req_node:gdpr:56.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.3'
      description: In the cases referred to in paragraph 2 of this Article, the supervisory
        authority shall inform the lead supervisory authority without delay on that
        matter. Within a period of three weeks after being informed the lead supervisory
        authority shall decide whether or not it will handle the case in accordance
        with the procedure provided in Article 60, taking into account whether or
        not there is an establishment of the controller or processor in the Member
        State of which the supervisory authority informed it.
      translations:
        sv:
          description: "I de fall som avses i punkt 2 i den h\xE4r artikeln ska tillsynsmyndigheten\
            \ utan dr\xF6jsm\xE5l informera den ansvariga tillsynsmyndigheten om detta\
            \ \xE4rende. Inom tre veckor fr\xE5n det att den underr\xE4ttats ska den\
            \ ansvariga tillsynsmyndigheten besluta huruvida den kommer att behandla\
            \ \xE4rendet i enlighet med det f\xF6rfarande som f\xF6reskrivs i artikel\
            \ 60, med h\xE4nsyn till huruvida den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det har eller inte har ett verksamhetsst\xE4lle som \xE4r bel\xE4get i\
            \ den medlemsstat d\xE4r den tillsynsmyndighet som l\xE4mnat informationen\
            \ \xE4r bel\xE4gen."
    - urn: urn:intuitem:risk:req_node:gdpr:56.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.4'
      description: Where the lead supervisory authority decides to handle the case,
        the procedure provided in Article 60 shall apply. The supervisory authority
        which informed the lead supervisory authority may submit to the lead supervisory
        authority a draft for a decision. The lead supervisory authority shall take
        utmost account of that draft when preparing the draft decision referred to
        in Article 60(3).
      translations:
        sv:
          description: "Om den ansvariga tillsynsmyndigheten beslutar att behandla\
            \ \xE4rendet ska det ske i enlighet med det f\xF6rfarande som f\xF6reskrivs\
            \ i artikel 60. Den tillsynsmyndighet som underr\xE4ttade den ansvariga\
            \ tillsynsmyndigheten f\xE5r l\xE4mna in ett utkast till beslut till den\
            \ ansvariga tillsynsmyndigheten. Den ansvariga tillsynsmyndigheten ska\
            \ ta st\xF6rsta m\xF6jliga h\xE4nsyn till detta utkast till beslut n\xE4\
            r det utarbetar det utkast till beslut som avses i artikel 60.3."
    - urn: urn:intuitem:risk:req_node:gdpr:56.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.5'
      description: Where the lead supervisory authority decides not to handle the
        case, the supervisory authority which informed the lead supervisory authority
        shall handle it according to Articles 61 and 62.
      translations:
        sv:
          description: "Om den ansvariga tillsynsmyndigheten beslutar att inte behandla\
            \ \xE4rendet ska den tillsynsmyndighet som underr\xE4ttade den ansvariga\
            \ tillsynsmyndigheten behandla \xE4rendet i\_enlighet med artiklarna 61\
            \ och 62."
    - urn: urn:intuitem:risk:req_node:gdpr:56.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-56
      ref_id: '56.6'
      description: The lead supervisory authority shall be the sole interlocutor of
        the controller or processor for the cross-border processing carried out by
        that controller or processor.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten ska vara den personuppgiftsansvariges\
            \ eller personuppgiftsbitr\xE4dets enda motpart n\xE4r det g\xE4ller den\
            \ registreringsansvariges eller den personuppgiftsbitr\xE4dets gr\xE4\
            ns\xF6verskridande behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:article-57
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node759
      ref_id: Article 57
      description: Tasks
      translations:
        sv:
          name: Artikel 57
          description: Uppgifter
    - urn: urn:intuitem:risk:req_node:gdpr:57.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-57
      ref_id: '57.1'
      description: 'Without prejudice to other tasks set out under this Regulation,
        each supervisory authority shall on its territory:'
      translations:
        sv:
          description: "Utan att det p\xE5verkar de andra uppgifter som f\xF6reskrivs\
            \ i denna f\xF6rordning ska varje tillsynsmyndighet p\xE5 sitt territorium\
            \ ansvara f\xF6r f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.a
      description: monitor and enforce the application of this Regulation;
      translations:
        sv:
          description: "\xD6vervaka och verkst\xE4lla till\xE4mpningen av denna f\xF6\
            rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.b
      description: promote public awareness and understanding of the risks, rules,
        safeguards and rights in relation to processing. Activities addressed specifically
        to children shall receive specific attention;
      translations:
        sv:
          description: "\xD6ka allm\xE4nhetens medvetenhet om och f\xF6rst\xE5else\
            \ f\xF6r risker, regler, skydds\xE5tg\xE4rder och r\xE4ttigheter i fr\xE5\
            ga om behandling. S\xE4rskild uppm\xE4rksamhet ska \xE4gnas \xE5t insatser\
            \ som riktar sig till barn."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.c
      description: advise, in accordance with Member State law, the national parliament,
        the government, and other institutions and bodies on legislative and administrative
        measures relating to the protection of natural persons' rights and freedoms
        with regard to processing;
      translations:
        sv:
          description: "I enlighet med medlemsstatens nationella r\xE4tt ge r\xE5\
            dgivning \xE5t det nationella parlamentet, regeringen och andra institutioner\
            \ och organ om lagstiftnings\xE5tg\xE4rder och administrativa \xE5tg\xE4\
            rder r\xF6rande skyddet av fysiska personers r\xE4ttigheter och friheter\
            \ n\xE4r det g\xE4ller behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.d
      description: promote the awareness of controllers and processors of their obligations
        under this Regulation;
      translations:
        sv:
          description: "\xD6ka personuppgiftsansvarigas och personuppgiftsbitr\xE4\
            dens medvetenhet om sina skyldigheter enligt denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.e
      description: upon request, provide information to any data subject concerning
        the exercise of their rights under this Regulation and, if appropriate, cooperate
        with the supervisory authorities in other Member States to that end;
      translations:
        sv:
          description: "P\xE5 beg\xE4ran tillhandah\xE5lla information till registrerade\
            \ om hur de ska ut\xF6va sina r\xE4ttigheter enligt denna f\xF6rordning,\
            \ och om s\xE5 kr\xE4vs samarbeta med tillsynsmyndigheter i andra medlemsstater\
            \ f\xF6r detta \xE4ndam\xE5l."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.f
      description: handle complaints lodged by a data subject, or by a body, organisation
        or association in accordance with Article 80, and investigate, to the extent
        appropriate, the subject matter of the complaint and inform the complainant
        of the progress and the outcome of the investigation within a reasonable period,
        in particular if further investigation or coordination with another supervisory
        authority is necessary;
      translations:
        sv:
          description: "Behandla klagom\xE5l fr\xE5n en registrerad eller fr\xE5n\
            \ ett organ, en organisation eller en sammanslutning enligt artikel 80,\
            \ och d\xE4r s\xE5 \xE4r l\xE4mpligt unders\xF6ka den sakfr\xE5ga som\
            \ klagom\xE5let g\xE4ller och inom rimlig tid underr\xE4tta den enskilde\
            \ om hur unders\xF6kningen fortskrider och om resultatet, i synnerhet\
            \ om det kr\xE4vs ytterligare unders\xF6kningar eller samordning med en\
            \ annan tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.g
      description: cooperate with, including sharing information and provide mutual
        assistance to, other supervisory authorities with a view to ensuring the consistency
        of application and enforcement of this Regulation;
      translations:
        sv:
          description: "Samarbeta, inbegripet utbyta information, med och ge \xF6\
            msesidigt bist\xE5nd till andra tillsynsmyndigheter f\xF6r att se till\
            \ att denna f\xF6rordning till\xE4mpas och verkst\xE4lls p\xE5 ett enhetligt\
            \ s\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.h
      description: conduct investigations on the application of this Regulation, including
        on the basis of information received from another supervisory authority or
        other public authority;
      translations:
        sv:
          description: "Utf\xF6ra unders\xF6kningar om till\xE4mpningen av denna f\xF6\
            rordning, inbegripet p\xE5 grundval av information som erh\xE5lls fr\xE5\
            n en annan tillsynsmyndighet eller annan myndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.i
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.i
      description: monitor relevant developments, insofar as they have an impact on
        the protection of personal data, in particular the development of information
        and communication technologies and commercial practices;
      translations:
        sv:
          description: "F\xF6lja s\xE5dan utveckling som p\xE5verkar skyddet av personuppgifter,\
            \ bland annat inom informations- och kommunikationsteknik och aff\xE4\
            rspraxis."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.j
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.j
      description: adopt standard contractual clauses referred to in Article 28(8)
        and in point (d) of Article 46(2);
      translations:
        sv:
          description: "Anta s\xE5dana standardavtalsklausuler som avses i artiklarna\
            \ 28.8 och 46.2 d."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.k
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.k
      description: establish and maintain a list in relation to the requirement for
        data protection impact assessment pursuant to Article 35(4);
      translations:
        sv:
          description: "Uppr\xE4tta och f\xF6ra en f\xF6rteckning n\xE4r det g\xE4\
            ller kravet p\xE5 en konsekvensbed\xF6mning avseende dataskydd enligt\
            \ artikel\_35.4."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.l
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.l
      description: give advice on the processing operations referred to in Article
        36(2);
      translations:
        sv:
          description: "Ge r\xE5d om behandling av personuppgifter enligt artikel\_\
            36.2."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.m
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.m
      description: encourage the drawing up of codes of conduct pursuant to Article
        40(1) and provide an opinion and approve such codes of conduct which provide
        sufficient safeguards, pursuant to Article 40(5);
      translations:
        sv:
          description: "Fr\xE4mja framtagande av uppf\xF6randekoder enligt artikel\
            \ 40.1 samt yttra sig \xF6ver och godk\xE4nna s\xE5dana uppf\xF6randekoder\
            \ som tillhandah\xE5ller tillr\xE4ckliga garantier, i\_enlighet med artikel\
            \ 40.5."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.n
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.n
      description: encourage the establishment of data protection certification mechanisms
        and of data protection seals and marks pursuant to Article 42(1), and approve
        the criteria of certification pursuant to Article 42(5);
      translations:
        sv:
          description: "Uppmuntra till inr\xE4ttandet av certifieringsmekanismer f\xF6\
            r dataskydd och av sigill och m\xE4rkningar f\xF6r dataskydd i enlighet\
            \ med artikel 42.1 samt godk\xE4nna certifieringskriterierna i enlighet\
            \ med artikel 42.5."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.o
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.o
      description: where applicable, carry out a periodic review of certifications
        issued in accordance with Article 42(7);
      translations:
        sv:
          description: "I till\xE4mpliga fall genomf\xF6ra en periodisk \xF6versyn\
            \ av certifieringar som utf\xE4rdats i\_enlighet med artikel 42.7."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.p
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.p
      description: draft and publish the requirements for accreditation of a body
        for monitoring codes of conduct pursuant to Article 41 and of a certification
        body pursuant to Article 43;
      translations:
        sv:
          description: "Utarbeta och offentligg\xF6ra kriterier f\xF6r ackreditering\
            \ av ett organ f\xF6r \xF6vervakning av uppf\xF6randekoder enligt artikel\_\
            41 och ett certifieringsorgan enligt artikel 43."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.q
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.q
      description: conduct the accreditation of a body for monitoring codes of conduct
        pursuant to Article 41 and of a certification body pursuant to Article 43;
      translations:
        sv:
          description: "Ackreditera ett organ f\xF6r \xF6vervakning av uppf\xF6randekoder\
            \ enligt artikel 41 och ett certifieringsorgan enligt artikel\_43."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.r
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.r
      description: authorise contractual clauses and provisions referred to in Article
        46(3);
      translations:
        sv:
          description: "Godk\xE4nna s\xE5dana avtalsklausuler och best\xE4mmelser\
            \ som avses i artikel 46.3."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.s
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.s
      description: approve binding corporate rules pursuant to Article 47;
      translations:
        sv:
          description: "Godk\xE4nna s\xE5dana bindande f\xF6retagsbest\xE4mmelser\
            \ som avses i artikel 47."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.t
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.t
      description: contribute to the activities of the Board;
      translations:
        sv:
          description: Bidra till styrelsens verksamhet.
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.u
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.u
      description: keep internal records of infringements of this Regulation and of
        measures taken in accordance with Article 58(2); and
      translations:
        sv:
          description: "H\xE5lla arkiv \xF6ver \xF6vertr\xE4delser av denna f\xF6\
            rordning och \xE5tg\xE4rder som vidtagits i\_enlighet med artikel 58.2."
    - urn: urn:intuitem:risk:req_node:gdpr:57.1.v
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:57.1
      ref_id: 57.1.v
      description: fulfil any other tasks related to the protection of personal data.
      translations:
        sv:
          description: "Utf\xF6ra eventuella andra uppgifter som r\xF6r skyddet av\
            \ personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:57.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-57
      ref_id: '57.2'
      description: Each supervisory authority shall facilitate the submission of complaints
        referred to in point (f) of paragraph 1 by measures such as a complaint submission
        form which can also be completed electronically, without excluding other means
        of communication.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska underl\xE4tta inl\xE4mningen av\
            \ klagom\xE5l enligt punkt 1 f genom \xE5tg\xE4rder s\xE5som ett s\xE4\
            rskilt formul\xE4r f\xF6r \xE4ndam\xE5let, vilket ocks\xE5 kan fyllas\
            \ i elektroniskt, utan att andra kommunikationsformer utesluts."
    - urn: urn:intuitem:risk:req_node:gdpr:57.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-57
      ref_id: '57.3'
      description: The performance of the tasks of each supervisory authority shall
        be free of charge for the data subject and, where applicable, for the data
        protection officer.
      translations:
        sv:
          description: "Utf\xF6randet av alla tillsynsmyndigheters uppgifter ska vara\
            \ avgiftsfritt f\xF6r den registrerade och, i till\xE4mpliga fall, f\xF6\
            r dataskyddsombudet."
    - urn: urn:intuitem:risk:req_node:gdpr:57.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-57
      ref_id: '57.4'
      description: Where requests are manifestly unfounded or excessive, in particular
        because of their repetitive character, the supervisory authority may charge
        a reasonable fee based on administrative costs, or refuse to act on the request.
        The supervisory authority shall bear the burden of demonstrating the manifestly
        unfounded or excessive character of the request.
      translations:
        sv:
          description: "Om en beg\xE4ran \xE4r uppenbart ogrundad eller orimlig, s\xE4\
            rskilt p\xE5 grund av dess repetitiva karakt\xE4r, f\xE5r tillsynsmyndigheten\
            \ ta ut en rimlig avgift grundad p\xE5 de administrativa kostnaderna eller\
            \ v\xE4gra att tillm\xF6tesg\xE5 beg\xE4ran. Det \xE5ligger tillsynsmyndigheten\
            \ att visa att beg\xE4ran \xE4r uppenbart ogrundad eller orimlig."
    - urn: urn:intuitem:risk:req_node:gdpr:article-58
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node759
      ref_id: Article 58
      description: Powers
      translations:
        sv:
          name: Artikel 58
          description: Befogenheter
    - urn: urn:intuitem:risk:req_node:gdpr:58.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.1'
      description: 'Each supervisory authority shall have all of the following investigative
        powers:'
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska ha samtliga f\xF6ljande utredningsbefogenheter"
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.a
      description: to order the controller and the processor, and, where applicable,
        the controller's or the processor's representative to provide any information
        it requires for the performance of its tasks;
      translations:
        sv:
          description: "Beordra den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det, och i till\xE4mpliga fall den personuppgiftsansvariges eller personuppgiftsbitr\xE4\
            dets f\xF6retr\xE4dare, att l\xE4mna all information som myndigheten beh\xF6\
            ver f\xF6r att kunna fullg\xF6ra sina uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.b
      description: to carry out investigations in the form of data protection audits;
      translations:
        sv:
          description: "Genomf\xF6ra unders\xF6kningar i form av dataskyddstillsyn."
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.c
      description: to carry out a review on certifications issued pursuant to Article
        42(7);
      translations:
        sv:
          description: "Genomf\xF6ra en \xF6versyn av certifieringar som utf\xE4rdats\
            \ i enlighet med artikel 42.7."
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.d
      description: to notify the controller or the processor of an alleged infringement
        of this Regulation;
      translations:
        sv:
          description: "Meddela den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det om en p\xE5st\xE5dd \xF6vertr\xE4delse av denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.e
      description: to obtain, from the controller and the processor, access to all
        personal data and to all information necessary for the performance of its
        tasks;
      translations:
        sv:
          description: "Fr\xE5n den personuppgiftsansvarige och personuppgiftsbitr\xE4\
            det f\xE5 tillg\xE5ng till alla personuppgifter och all information som\
            \ tillsynsmyndigheten beh\xF6ver f\xF6r att kunna fullg\xF6ra sina uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:58.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.1
      ref_id: 58.1.f
      description: to obtain access to any premises of the controller and the processor,
        including to any data processing equipment and means, in accordance with Union
        or Member State procedural law.
      translations:
        sv:
          description: "F\xE5 tilltr\xE4de till alla lokaler som tillh\xF6r den personuppgiftsansvarige\
            \ och personuppgiftsbitr\xE4det, inbegripet tillg\xE5ng till all utrustning\
            \ och alla andra medel f\xF6r behandling av personuppgifter i\_\xF6verensst\xE4\
            mmelse med unionens processr\xE4tt eller medlemsstaternas nationella processr\xE4\
            tt."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.2'
      description: 'Each supervisory authority shall have all of the following corrective
        powers:'
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska ha samtliga f\xF6ljande korrigerande\
            \ befogenheter"
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.a
      description: to issue warnings to a controller or processor that intended processing
        operations are likely to infringe provisions of this Regulation;
      translations:
        sv:
          description: "Utf\xE4rda varningar till en personuppgiftsansvarig eller\
            \ personuppgiftsbitr\xE4det om att planerade behandlingar sannolikt kommer\
            \ att bryta mot best\xE4mmelserna i denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.b
      description: to issue reprimands to a controller or a processor where processing
        operations have infringed provisions of this Regulation;
      translations:
        sv:
          description: "Utf\xE4rda reprimander till en personuppgiftsansvarig eller\
            \ personuppgiftsbitr\xE4det om behandling bryter mot best\xE4mmelserna\
            \ i denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.c
      description: to order the controller or the processor to comply with the data
        subject's requests to exercise his or her rights pursuant to this Regulation;
      translations:
        sv:
          description: "F\xF6rel\xE4gga den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det att tillm\xF6tesg\xE5 den registrerades beg\xE4ran att f\xE5 ut\xF6\
            va sina r\xE4ttigheter enligt denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.d
      description: to order the controller or processor to bring processing operations
        into compliance with the provisions of this Regulation, where appropriate,
        in a specified manner and within a specified period;
      translations:
        sv:
          description: "F\xF6rel\xE4gga en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de att se till att behandlingen sker i\_enlighet med best\xE4mmelserna\
            \ i denna f\xF6rordning och om s\xE5 kr\xE4vs p\xE5 ett specifikt s\xE4\
            tt och inom en specifik period,"
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.e
      description: to order the controller to communicate a personal data breach to
        the data subject;
      translations:
        sv:
          description: "F\xF6rel\xE4gga den personuppgiftsansvarige att meddela den\
            \ registrerade att en personuppgiftsincident har intr\xE4ffat."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.f
      description: to impose a temporary or definitive limitation including a ban
        on processing;
      translations:
        sv:
          description: "Inf\xF6ra en tillf\xE4llig eller definitiv begr\xE4nsning\
            \ av, inklusive ett f\xF6rbud mot, behandling."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.g
      description: to order the rectification or erasure of personal data or restriction
        of processing pursuant to Articles 16, 17 and 18 and the notification of such
        actions to recipients to whom the personal data have been disclosed pursuant
        to Article 17(2) and Article 19;
      translations:
        sv:
          description: "F\xF6rel\xE4gga om r\xE4ttelse eller radering av personuppgifter\
            \ samt begr\xE4nsning av behandling enligt artiklarna 16, 17 och\_18 och\
            \ underr\xE4tta mottagare till vilka personuppgifterna har l\xE4mnats\
            \ ut om dessa \xE5tg\xE4rder enligt artiklarna\_17.2 och\_19."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.h
      description: to withdraw a certification or to order the certification body
        to withdraw a certification issued pursuant to Articles 42 and 43, or to order
        the certification body not to issue certification if the requirements for
        the certification are not or are no longer met;
      translations:
        sv:
          description: "\xC5terkalla en certifiering eller beordra certifieringsorganet\
            \ att \xE5terkalla en certifiering som utf\xE4rdats enligt artikel 42\
            \ eller 43, eller beordra certifieringsorganet att inte utf\xE4rda certifiering\
            \ om kraven f\xF6r certifiering inte eller inte l\xE4ngre uppfylls."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.i
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.i
      description: to impose an administrative fine pursuant to Article 83, in addition
        to, or instead of measures referred to in this paragraph, depending on the
        circumstances of each individual case;
      translations:
        sv:
          description: "P\xE5f\xF6ra administrativa sanktionsavgifter i enlighet med\
            \ artikel 83 ut\xF6ver eller i st\xE4llet f\xF6r de \xE5tg\xE4rder som\
            \ avses i detta stycke, beroende p\xE5 omst\xE4ndigheterna i varje enskilt\
            \ fall."
    - urn: urn:intuitem:risk:req_node:gdpr:58.2.j
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.2
      ref_id: 58.2.j
      description: to order the suspension of data flows to a recipient in a third
        country or to an international organisation.
      translations:
        sv:
          description: "F\xF6rel\xE4gga om att fl\xF6det av uppgifter till en mottagare\
            \ i tredje land eller en internationell organisation ska avbrytas."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.3'
      description: 'Each supervisory authority shall have all of the following authorisation
        and advisory powers:'
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska ha samtliga f\xF6ljande befogenheter\
            \ att utf\xE4rda tillst\xE5nd och att ge r\xE5d:"
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.a
      description: to advise the controller in accordance with the prior consultation
        procedure referred to in Article 36;
      translations:
        sv:
          description: "Ge r\xE5d till den personuppgiftsansvarige i enlighet med\
            \ det f\xF6rfarande f\xF6r f\xF6rhandssamr\xE5d som avses i artikel 36."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.b
      description: to issue, on its own initiative or on request, opinions to the
        national parliament, the Member State government or, in accordance with Member
        State law, to other institutions and bodies as well as to the public on any
        issue related to the protection of personal data;
      translations:
        sv:
          description: "P\xE5 eget initiativ eller p\xE5 beg\xE4ran avge yttranden\
            \ till det nationella parlamentet, medlemsstatens regering eller, i enlighet\
            \ med medlemsstatens nationella r\xE4tt, till andra institutioner och\
            \ organ samt till allm\xE4nheten, i fr\xE5gor som r\xF6r skydd av personuppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.c
      description: to authorise processing referred to in Article 36(5), if the law
        of the Member State requires such prior authorisation;
      translations:
        sv:
          description: "Ge tillst\xE5nd till behandling enligt artikel 36.5 om medlemsstatens\
            \ r\xE4tt kr\xE4ver ett s\xE5dant f\xF6rhandstillst\xE5nd."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.d
      description: to issue an opinion and approve draft codes of conduct pursuant
        to Article 40(5);
      translations:
        sv:
          description: "Avge ett yttrande om och godk\xE4nna utkast till uppf\xF6\
            randekoder enligt artikel 40.5."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.e
      description: to accredit certification bodies pursuant to Article 43;
      translations:
        sv:
          description: Ackreditera certifieringsorgan i enlighet med artikel 43.
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.f
      description: to issue certifications and approve criteria of certification in
        accordance with Article 42(5);
      translations:
        sv:
          description: "Utf\xE4rda certifieringar och godk\xE4nna kriterier f\xF6\
            r certifiering i enlighet med artikel\_42.5."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.g
      description: to adopt standard data protection clauses referred to in Article
        28(8) and in point (d) of Article 46(2);
      translations:
        sv:
          description: "Anta standardiserade dataskyddsbest\xE4mmelser enligt artiklarna\
            \ 28.8 och 46.2 d."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.h
      description: to authorise contractual clauses referred to in point (a) of Article
        46(3);
      translations:
        sv:
          description: "Godk\xE4nna avtalsklausuler enligt artikel 46.3 a."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.i
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.i
      description: to authorise administrative arrangements referred to in point (b)
        of Article 46(3);
      translations:
        sv:
          description: "Godk\xE4nna administrativa \xF6verenskommelser enligt artikel\
            \ 46.3 b."
    - urn: urn:intuitem:risk:req_node:gdpr:58.3.j
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:58.3
      ref_id: 58.3.j
      description: to approve binding corporate rules pursuant to Article 47.
      translations:
        sv:
          description: "Godk\xE4nna bindande f\xF6retagsbest\xE4mmelser enligt artikel\
            \ 47."
    - urn: urn:intuitem:risk:req_node:gdpr:58.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.4'
      description: The exercise of the powers conferred on the supervisory authority
        pursuant to this Article shall be subject to appropriate safeguards, including
        effective judicial remedy and due process, set out in Union and Member State
        law in accordance with the Charter.
      translations:
        sv:
          description: "Ut\xF6vandet av de befogenheter som tillsynsmyndigheten tilldelas\
            \ enligt denna artikel ska omfattas av l\xE4mpliga skydds\xE5tg\xE4rder,\
            \ inbegripet effektiva r\xE4ttsmedel och r\xE4ttss\xE4kerhet, som fastst\xE4\
            lls i unionsr\xE4tten och i medlemsstaternas nationella r\xE4tt i enlighet\
            \ med stadgan."
    - urn: urn:intuitem:risk:req_node:gdpr:58.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.5'
      description: Each Member State shall provide by law that its supervisory authority
        shall have the power to bring infringements of this Regulation to the attention
        of the judicial authorities and where appropriate, to commence or engage otherwise
        in legal proceedings, in order to enforce the provisions of this Regulation.
      translations:
        sv:
          description: "Varje medlemsstat ska i lagstiftning fastst\xE4lla att dess\
            \ tillsynsmyndighet ska ha befogenhet att upplysa de r\xE4ttsliga myndigheterna\
            \ om \xF6vertr\xE4delser av denna f\xF6rordning och vid behov att inleda\
            \ eller p\xE5 \xF6vrigt vis delta i r\xE4ttsliga f\xF6rfaranden, f\xF6\
            r att verkst\xE4lla best\xE4mmelserna i\_denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:58.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-58
      ref_id: '58.6'
      description: Each Member State may provide by law that its supervisory authority
        shall have additional powers to those referred to in paragraphs 1, 2 and 3.
        The exercise of those powers shall not impair the effective operation of Chapter
        VII.
      translations:
        sv:
          description: "Varje medlemsstat f\xE5r i lagstiftning f\xF6reskriva att\
            \ dess tillsynsmyndighet ska ha ytterligare befogenheter ut\xF6ver dem\
            \ som avses i punkterna 1, 2 och 3. Ut\xF6vandet av dessa befogenheter\
            \ ska inte p\xE5verka den effektiva till\xE4mpningen av kapitel VII."
    - urn: urn:intuitem:risk:req_node:gdpr:article-59
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node759
      ref_id: Article 59
      description: Activity reports
      translations:
        sv:
          name: Artikel 59
          description: Verksamhetsrapporter
    - urn: urn:intuitem:risk:req_node:gdpr:node832
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-59
      description: Each supervisory authority shall draw up an annual report on its
        activities, which may include a list of types of infringement notified and
        types of measures taken in accordance with Article 58(2). Those reports shall
        be transmitted to the national parliament, the government and other authorities
        as designated by Member State law. They shall be made available to the public,
        to the Commission and to the Board.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska uppr\xE4tta en \xE5rlig rapport\
            \ om sin verksamhet, vilken kan omfatta en f\xF6rteckning \xF6ver typer\
            \ av anm\xE4lda \xF6vertr\xE4delser och typer av \xE5tg\xE4rder som vidtagits\
            \ i enlighet med artikel 58.2. Rapporterna ska \xF6vers\xE4ndas till det\
            \ nationella parlamentet, regeringen och andra myndigheter som utsetts\
            \ genom medlemsstatens nationella r\xE4tt. De ska g\xF6ras tillg\xE4ngliga\
            \ f\xF6r allm\xE4nheten, kommissionen och styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-vii
      assessable: false
      depth: 1
      ref_id: CHAPTER VII
      description: Cooperation and consistency
      translations:
        sv:
          name: KAPITEL VII
          description: Samarbete och enhetlighet
    - urn: urn:intuitem:risk:req_node:gdpr:node834
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-vii
      name: Section 1
      description: Cooperation
      translations:
        sv:
          name: Avsnitt 1
          description: Samarbete
    - urn: urn:intuitem:risk:req_node:gdpr:article-60
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node834
      ref_id: Article 60
      description: Cooperation between the lead supervisory authority and the other
        supervisory authorities concerned
      translations:
        sv:
          name: Artikel 60
          description: "Samarbete mellan den ansvariga tillsynsmyndigheten och de\
            \ andra ber\xF6rda tillsynsmyndigheterna"
    - urn: urn:intuitem:risk:req_node:gdpr:60.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.1'
      description: The lead supervisory authority shall cooperate with the other supervisory
        authorities concerned in accordance with this Article in an endeavour to reach
        consensus. The lead supervisory authority and the supervisory authorities
        concerned shall exchange all relevant information with each other.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten ska samarbeta med de andra\
            \ ber\xF6rda tillsynsmyndigheterna i enlighet med denna artikel i en str\xE4\
            van att uppn\xE5 samf\xF6rst\xE5nd. Den ansvariga tillsynsmyndigheten\
            \ och de ber\xF6rda tillsynsmyndigheterna ska utbyta all relevant information\
            \ med varandra."
    - urn: urn:intuitem:risk:req_node:gdpr:60.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.2'
      description: The lead supervisory authority may request at any time other supervisory
        authorities concerned to provide mutual assistance pursuant to Article 61
        and may conduct joint operations pursuant to Article 62, in particular for
        carrying out investigations or for monitoring the implementation of a measure
        concerning a controller or processor established in another Member State.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten f\xE5r n\xE4r som helst\
            \ beg\xE4ra att andra ber\xF6rda tillsynsmyndigheter ger \xF6msesidigt\
            \ bist\xE5nd i enlighet med artikel 61 och f\xE5r genomf\xF6ra gemensamma\
            \ insatser i enlighet med artikel 62, i synnerhet f\xF6r att utf\xF6ra\
            \ utredningar eller \xF6vervaka genomf\xF6randet av en \xE5tg\xE4rd som\
            \ avser en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de som\
            \ \xE4r etablerad i en annan medlemsstat."
    - urn: urn:intuitem:risk:req_node:gdpr:60.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.3'
      description: The lead supervisory authority shall, without delay, communicate
        the relevant information on the matter to the other supervisory authorities
        concerned. It shall without delay submit a draft decision to the other supervisory
        authorities concerned for their opinion and take due account of their views.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten ska utan dr\xF6jsm\xE5l\
            \ meddela de andra ber\xF6rda tillsynsmyndigheterna den relevanta informationen\
            \ i \xE4rendet. Den ska utan dr\xF6jsm\xE5l l\xE4gga fram ett utkast till\
            \ beslut f\xF6r de andra ber\xF6rda tillsynsmyndigheterna s\xE5 att de\
            \ kan avge ett yttrande och ta vederb\xF6rlig h\xE4nsyn till deras synpunkter."
    - urn: urn:intuitem:risk:req_node:gdpr:60.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.4'
      description: Where any of the other supervisory authorities concerned within
        a period of four weeks after having been consulted in accordance with paragraph
        3 of this Article, expresses a relevant and reasoned objection to the draft
        decision, the lead supervisory authority shall, if it does not follow the
        relevant and reasoned objection or is of the opinion that the objection is
        not relevant or reasoned, submit the matter to the consistency mechanism referred
        to in Article 63.
      translations:
        sv:
          description: "Om n\xE5gon av de andra ber\xF6rda tillsynsmyndigheterna inom\
            \ en period av fyra veckor efter att de har r\xE5dfr\xE5gats i enlighet\
            \ med punkt 3 i den h\xE4r artikeln uttrycker en relevant och motiverad\
            \ inv\xE4ndning mot utkastet till beslut ska den ansvariga tillsynsmyndigheten,\
            \ om den inte inst\xE4mmer i den relevanta och motiverade inv\xE4ndningen\
            \ eller anser att inv\xE4ndningen inte \xE4r relevant eller motiverad,\
            \ \xF6verl\xE4mna \xE4rendet till den mekanism f\xF6r enhetlighet som\
            \ avses i\_artikel\_63."
    - urn: urn:intuitem:risk:req_node:gdpr:60.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.5'
      description: Where the lead supervisory authority intends to follow the relevant
        and reasoned objection made, it shall submit to the other supervisory authorities
        concerned a revised draft decision for their opinion. That revised draft decision
        shall be subject to the procedure referred to in paragraph 4 within a period
        of two weeks.
      translations:
        sv:
          description: "Om den ansvariga tillsynsmyndigheten avser att f\xF6lja den\
            \ relevanta och motiverade inv\xE4ndningen ska den till de andra ber\xF6\
            rda tillsynsmyndigheterna \xF6verl\xE4mna ett reviderat utkast till beslut\
            \ s\xE5 att de kan avge ett yttrande. Detta reviderade utkast till beslut\
            \ ska omfattas av det f\xF6rfarande som avses i punkt\_4 inom en period\
            \ av tv\xE5 veckor."
    - urn: urn:intuitem:risk:req_node:gdpr:60.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.6'
      description: Where none of the other supervisory authorities concerned has objected
        to the draft decision submitted by the lead supervisory authority within the
        period referred to in paragraphs 4 and 5, the lead supervisory authority and
        the supervisory authorities concerned shall be deemed to be in agreement with
        that draft decision and shall be bound by it.
      translations:
        sv:
          description: "Om ingen av de andra ber\xF6rda tillsynsmyndigheterna har\
            \ gjort inv\xE4ndningar mot det utkast till beslut som den ansvariga tillsynsmyndigheten\
            \ har lagt fram inom den period som avses i\_punkterna 4 och 5 ska den\
            \ ansvariga tillsynsmyndigheten och de ber\xF6rda tillsynsmyndigheterna\
            \ anses samtycka till detta utkast till beslut och ska vara bundna av\
            \ det."
    - urn: urn:intuitem:risk:req_node:gdpr:60.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.7'
      description: The lead supervisory authority shall adopt and notify the decision
        to the main establishment or single establishment of the controller or processor,
        as the case may be and inform the other supervisory authorities concerned
        and the Board of the decision in question, including a summary of the relevant
        facts and grounds. The supervisory authority with which a complaint has been
        lodged shall inform the complainant on the decision.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten ska anta och meddela beslutet\
            \ till den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets huvudsakliga\
            \ eller enda verksamhetsst\xE4lle, allt efter omst\xE4ndigheterna, och\
            \ underr\xE4tta de andra ber\xF6rda tillsynsmyndigheterna och styrelsen\
            \ om beslutet i fr\xE5ga, inbegripet en sammanfattning av relevanta fakta\
            \ och en relevant motivering. Den tillsynsmyndighet till vilken ett klagom\xE5\
            l har l\xE4mnats in ska underr\xE4tta den enskilde om beslutet."
    - urn: urn:intuitem:risk:req_node:gdpr:60.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.8'
      description: By derogation from paragraph 7, where a complaint is dismissed
        or rejected, the supervisory authority with which the complaint was lodged
        shall adopt the decision and notify it to the complainant and shall inform
        the controller thereof.
      translations:
        sv:
          description: "Om ett klagom\xE5l avvisas eller avsl\xE5s ska den tillsynsmyndighet\
            \ till vilken klagom\xE5let l\xE4mnades in, genom undantag fr\xE5n punkt\
            \ 7, anta beslutet och meddela den enskilde samt informera den personuppgiftsansvarige."
    - urn: urn:intuitem:risk:req_node:gdpr:60.9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.9'
      description: Where the lead supervisory authority and the supervisory authorities
        concerned agree to dismiss or reject parts of a complaint and to act on other
        parts of that complaint, a separate decision shall be adopted for each of
        those parts of the matter. The lead supervisory authority shall adopt the
        decision for the part concerning actions in relation to the controller, shall
        notify it to the main establishment or single establishment of the controller
        or processor on the territory of its Member State and shall inform the complainant
        thereof, while the supervisory authority of the complainant shall adopt the
        decision for the part concerning dismissal or rejection of that complaint,
        and shall notify it to that complainant and shall inform the controller or
        processor thereof.
      translations:
        sv:
          description: "Om den ansvariga tillsynsmyndigheten och de ber\xF6rda tillsynsmyndigheterna\
            \ \xE4r \xF6verens om att avvisa eller avsl\xE5 delar av ett klagom\xE5\
            l och att vidta \xE5tg\xE4rder betr\xE4ffande andra delar av klagom\xE5\
            let ska ett separat beslut antas f\xF6r var och en av dessa delar av fr\xE5\
            gan. Den ansvariga tillsynsmyndigheten ska anta beslutet om den del som\
            \ g\xE4ller \xE5tg\xE4rder som avser den personuppgiftsansvarige och meddela\
            \ det till den personuppgiftsansvariges eller personuppgiftsbitr\xE4dets\
            \ huvudsakliga eller enda verksamhetsst\xE4lle p\xE5 medlemsstatens territorium\
            \ och underr\xE4tta den enskilde om detta, medan den enskildes tillsynsmyndighet\
            \ ska anta beslutet f\xF6r den del som g\xE4ller avvisande av eller avslag\
            \ p\xE5 klagom\xE5let och meddela det till den enskilde och underr\xE4\
            tta den personuppgiftsansvarige eller personuppgiftsbitr\xE4det om detta."
    - urn: urn:intuitem:risk:req_node:gdpr:60.10
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.10'
      description: After being notified of the decision of the lead supervisory authority
        pursuant to paragraphs 7 and 9, the controller or processor shall take the
        necessary measures to ensure compliance with the decision as regards processing
        activities in the context of all its establishments in the Union. The controller
        or processor shall notify the measures taken for complying with the decision
        to the lead supervisory authority, which shall inform the other supervisory
        authorities concerned.
      translations:
        sv:
          description: "Efter att den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det har meddelats om den ansvariga myndighetens beslut i enlighet med\
            \ punkterna 7 och 9 ska den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det vidta n\xF6dv\xE4ndiga \xE5tg\xE4rder f\xF6r att se till att beslutet\
            \ efterlevs vad g\xE4ller behandling med koppling till alla deras verksamhetsst\xE4\
            llen i unionen. Den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det ska meddela den ansvariga tillsynsmyndigheten vilka \xE5tg\xE4rder\
            \ som har vidtagits f\xF6r att efterleva beslutet, och den ansvariga tillsynsmyndigheten\
            \ ska informera de andra ber\xF6rda tillsynsmyndigheterna."
    - urn: urn:intuitem:risk:req_node:gdpr:60.11
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.11'
      description: Where, in exceptional circumstances, a supervisory authority concerned
        has reasons to consider that there is an urgent need to act in order to protect
        the interests of data subjects, the urgency procedure referred to in Article
        66 shall apply.
      translations:
        sv:
          description: "Om en ber\xF6rd tillsynsmyndighet under exceptionella omst\xE4\
            ndigheter har sk\xE4l att anse att det finns ett br\xE5dskande behov av\
            \ att agera f\xF6r att skydda registrerades intressen ska det skyndsamma\
            \ f\xF6rfarande som avses i artikel 66 till\xE4mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:60.12
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-60
      ref_id: '60.12'
      description: The lead supervisory authority and the other supervisory authorities
        concerned shall supply the information required under this Article to each
        other by electronic means, using a standardised format.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten och de andra ber\xF6rda\
            \ tillsynsmyndigheterna ska f\xF6rse varandra med den information som\
            \ kr\xE4vs enligt denna artikel p\xE5 elektronisk v\xE4g med anv\xE4ndning\
            \ av ett\_standardiserat format."
    - urn: urn:intuitem:risk:req_node:gdpr:article-61
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node834
      ref_id: Article 61
      description: Mutual assistance
      translations:
        sv:
          name: Artikel 61
          description: "\xD6msesidigt bist\xE5nd"
    - urn: urn:intuitem:risk:req_node:gdpr:61.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.1'
      description: Supervisory authorities shall provide each other with relevant
        information and mutual assistance in order to implement and apply this Regulation
        in a consistent manner, and shall put in place measures for effective cooperation
        with one another. Mutual assistance shall cover, in particular, information
        requests and supervisory measures, such as requests to carry out prior authorisations
        and consultations, inspections and investigations.
      translations:
        sv:
          description: "Tillsynsmyndigheterna ska utbyta relevant information och\
            \ ge \xF6msesidigt bist\xE5nd i arbetet f\xF6r att genomf\xF6ra och till\xE4\
            mpa denna f\xF6rordning p\xE5 ett enhetligt s\xE4tt, och ska inf\xF6ra\
            \ \xE5tg\xE4rder som bidrar till ett verkningsfullt samarbete. Det \xF6\
            msesidiga bist\xE5ndet ska i\_synnerhet omfatta beg\xE4randen om information\
            \ och tillsyns\xE5tg\xE4rder, till exempel beg\xE4randen om utf\xF6rande\
            \ av f\xF6rhandstillst\xE5nd och f\xF6rhandssamr\xE5d, inspektioner och\
            \ utredningar."
    - urn: urn:intuitem:risk:req_node:gdpr:61.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.2'
      description: Each supervisory authority shall take all appropriate measures
        required to reply to a request of another supervisory authority without undue
        delay and no later than one month after receiving the request. Such measures
        may include, in particular, the transmission of relevant information on the
        conduct of an investigation.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska vidta l\xE4mpliga \xE5tg\xE4rder\
            \ som kr\xE4vs f\xF6r att besvara en beg\xE4ran fr\xE5n en annan tillsynsmyndighet\
            \ utan on\xF6digt dr\xF6jsm\xE5l och inte senare \xE4n en m\xE5nad efter\
            \ det att den tagit emot beg\xE4ran. Till s\xE5dana \xE5tg\xE4rder h\xF6\
            r bland annat att \xF6vers\xE4nda relevant information om genomf\xF6randet\
            \ av en p\xE5g\xE5ende utredning."
    - urn: urn:intuitem:risk:req_node:gdpr:61.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.3'
      description: Requests for assistance shall contain all the necessary information,
        including the purpose of and reasons for the request. Information exchanged
        shall be used only for the purpose for which it was requested.
      translations:
        sv:
          description: "En beg\xE4ran om bist\xE5nd ska inneh\xE5lla all n\xF6dv\xE4\
            ndig information, inklusive syftet med beg\xE4ran och sk\xE4len till denna.\
            \ Information som utbytts f\xE5r endast anv\xE4ndas f\xF6r det syfte f\xF6\
            r vilket den har beg\xE4rts."
    - urn: urn:intuitem:risk:req_node:gdpr:61.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.4'
      description: 'The requested supervisory authority shall not refuse to comply
        with the request unless:'
      translations:
        sv:
          description: "Den tillsynsmyndighet som tar emot en beg\xE4ran f\xE5r endast\
            \ v\xE4gra att tillm\xF6tesg\xE5 beg\xE4ran om"
    - urn: urn:intuitem:risk:req_node:gdpr:61.4.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:61.4
      ref_id: 61.4.a
      description: it is not competent for the subject-matter of the request or for
        the measures it is requested to execute; or
      translations:
        sv:
          description: "den inte \xE4r beh\xF6rig att behandla den sakfr\xE5ga som\
            \ beg\xE4ran avser eller de \xE5tg\xE4rder som det beg\xE4rs att den ska\
            \ utf\xF6ra, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:61.4.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:61.4
      ref_id: 61.4.b
      description: compliance with the request would infringe this Regulation or Union
        or Member State law to which the supervisory authority receiving the request
        is subject.
      translations:
        sv:
          description: "det skulle st\xE5 i strid med denna f\xF6rordning eller unionsr\xE4\
            tten eller den nationella r\xE4tt i en medlemsstat som tillsynsmyndigheten\
            \ omfattas av att tillm\xF6tesg\xE5 beg\xE4ran."
    - urn: urn:intuitem:risk:req_node:gdpr:61.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.5'
      description: The requested supervisory authority shall inform the requesting
        supervisory authority of the results or, as the case may be, of the progress
        of the measures taken in order to respond to the request. The requested supervisory
        authority shall provide reasons for any refusal to comply with a request pursuant
        to paragraph 4.
      translations:
        sv:
          description: "Den tillsynsmyndighet som tagit emot beg\xE4ran ska meddela\
            \ den myndighet som beg\xE4ran kommer ifr\xE5n om resultatet eller, allt\
            \ efter omst\xE4ndigheterna, om hur de \xE5tg\xE4rder som vidtagits f\xF6\
            r att tillm\xF6tesg\xE5 beg\xE4ran fortskrider. Den tillsynsmyndighet\
            \ som tagit emot beg\xE4ran ska redog\xF6ra f\xF6r sina sk\xE4l f\xF6\
            r att v\xE4gra tillm\xF6tesg\xE5 beg\xE4ran i enlighet med punkt\_4."
    - urn: urn:intuitem:risk:req_node:gdpr:61.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.6'
      description: Requested supervisory authorities shall, as a rule, supply the
        information requested by other supervisory authorities by electronic means,
        using a standardised format.
      translations:
        sv:
          description: "Den tillsynsmyndighet som tar emot en beg\xE4ran ska som regel\
            \ tillhandah\xE5lla den information som beg\xE4rts av andra tillsynsmyndigheter\
            \ p\xE5 elektronisk v\xE4g med anv\xE4ndning av ett standardiserat format."
    - urn: urn:intuitem:risk:req_node:gdpr:61.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.7'
      description: Requested supervisory authorities shall not charge a fee for any
        action taken by them pursuant to a request for mutual assistance. Supervisory
        authorities may agree on rules to indemnify each other for specific expenditure
        arising from the provision of mutual assistance in exceptional circumstances.
      translations:
        sv:
          description: "Tillsynsmyndigheter som tar emot en beg\xE4ran f\xE5r inte\
            \ ta ut n\xE5gon avgift f\xF6r \xE5tg\xE4rder som vidtagits av dem till\
            \ f\xF6ljd av en beg\xE4ran om \xF6msesidigt bist\xE5nd. Tillsynsmyndigheter\
            \ f\xE5r i\_undantagsfall komma \xF6verens med andra tillsynsmyndigheter\
            \ om regler f\xF6r ers\xE4ttning fr\xE5n varandra f\xF6r vissa utgifter\
            \ i samband med tillhandah\xE5llande av \xF6msesidigt bist\xE5nd."
    - urn: urn:intuitem:risk:req_node:gdpr:61.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.8'
      description: Where a supervisory authority does not provide the information
        referred to in paragraph 5 of this Article within one month of receiving the
        request of another supervisory authority, the requesting supervisory authority
        may adopt a provisional measure on the territory of its Member State in accordance
        with Article 55(1). In that case, the urgent need to act under Article 66(1)
        shall be presumed to be met and require an urgent binding decision from the
        Board pursuant to Article 66(2).
      translations:
        sv:
          description: "Om en tillsynsmyndighet inte tillhandah\xE5ller den information\
            \ som avses i punkt 5 i denna artikel inom en m\xE5nad efter det att den\
            \ erh\xE5llit beg\xE4ran fr\xE5n en annan tillsynsmyndighet f\xE5r den\
            \ beg\xE4rande myndigheten anta en provisorisk \xE5tg\xE4rd p\xE5 sin\
            \ medlemsstats territorium i enlighet med artikel 55.1. I\_detta fall\
            \ ska det br\xE5dskande behov av att agera enligt artikel 66.1 anses vara\
            \ uppfyllt och kr\xE4va ett br\xE5dskande bindande beslut fr\xE5n styrelsen\
            \ i enlighet med artikel\_66.2."
    - urn: urn:intuitem:risk:req_node:gdpr:61.9
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-61
      ref_id: '61.9'
      description: The Commission may, by means of implementing acts, specify the
        format and procedures for mutual assistance referred to in this Article and
        the arrangements for the exchange of information by electronic means between
        supervisory authorities, and between supervisory authorities and the Board,
        in particular the standardised format referred to in paragraph 6 of this Article.
        Those implementing acts shall be adopted in accordance with the examination
        procedure referred to in Article 93(2).
      translations:
        sv:
          description: "Kommissionen f\xE5r genom genomf\xF6randeakter n\xE4rmare\
            \ ange format och f\xF6rfaranden f\xF6r s\xE5dant \xF6msesidigt bist\xE5\
            nd som avses i\_denna artikel samt formerna f\xF6r elektronisk \xF6verf\xF6\
            ring av information tillsynsmyndigheter emellan, samt mellan tillsynsmyndigheter\
            \ och styrelsen, i synnerhet det standardiserade format som avses i punkt\
            \ 6 i den h\xE4r artikeln. Dessa genomf\xF6randeakter ska antas i enlighet\
            \ med det granskningsf\xF6rfarande som avses i\_artikel 93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:article-62
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node834
      ref_id: Article 62
      description: Joint operations of supervisory authorities
      translations:
        sv:
          name: Artikel 62
          description: Tillsynsmyndigheters gemensamma insatser
    - urn: urn:intuitem:risk:req_node:gdpr:62.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.1'
      description: The supervisory authorities shall, where appropriate, conduct joint
        operations including joint investigations and joint enforcement measures in
        which members or staff of the supervisory authorities of other Member States
        are involved.
      translations:
        sv:
          description: "Tillsynsmyndigheter ska vid behov genomf\xF6ra gemensamma\
            \ insatser, inbegripet gemensamma utredningar och gemensamma verkst\xE4\
            llighets\xE5tg\xE4rder i vilka ledam\xF6ter eller personal fr\xE5n andra\
            \ medlemsstaters tillsynsmyndigheter deltar."
    - urn: urn:intuitem:risk:req_node:gdpr:62.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.2'
      description: Where the controller or processor has establishments in several
        Member States or where a significant number of data subjects in more than
        one Member State are likely to be substantially affected by processing operations,
        a supervisory authority of each of those Member States shall have the right
        to participate in joint operations. The supervisory authority which is competent
        pursuant to Article 56(1) or (4) shall invite the supervisory authority of
        each of those Member States to take part in the joint operations and shall
        respond without delay to the request of a supervisory authority to participate.
      translations:
        sv:
          description: "Om den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det har verksamhetsst\xE4llen i flera medlemsstater eller om ett betydande\
            \ antal registrerade personer i mer \xE4n en medlemsstat sannolikt kommer\
            \ att p\xE5verkas i v\xE4sentlig grad av att uppgifter behandlas, ska\
            \ tillsynsmyndigheterna i var och en av dessa medlemsstater ha r\xE4tt\
            \ att delta i de gemensamma insatserna. Den tillsynsmyndighet som \xE4\
            r beh\xF6rig enligt artikel 56.1 eller\_56.4 ska bjuda in tillsynsmyndigheterna\
            \ i var och en av de ber\xF6rda medlemsstaterna att delta i de gemensamma\
            \ insatserna och ska utan dr\xF6jsm\xE5l svara p\xE5 en annan tillsynsmyndighets\
            \ beg\xE4ran att f\xE5 delta."
    - urn: urn:intuitem:risk:req_node:gdpr:62.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.3'
      description: A supervisory authority may, in accordance with Member State law,
        and with the seconding supervisory authority's authorisation, confer powers,
        including investigative powers on the seconding supervisory authority's members
        or staff involved in joint operations or, in so far as the law of the Member
        State of the host supervisory authority permits, allow the seconding supervisory
        authority's members or staff to exercise their investigative powers in accordance
        with the law of the Member State of the seconding supervisory authority. Such
        investigative powers may be exercised only under the guidance and in the presence
        of members or staff of the host supervisory authority. The seconding supervisory
        authority's members or staff shall be subject to the Member State law of the
        host supervisory authority.
      translations:
        sv:
          description: "En tillsynsmyndighet f\xE5r, i enlighet med medlemsstatens\
            \ nationella r\xE4tt och efter godk\xE4nnande fr\xE5n ursprungslandets\
            \ tillsynsmyndighet, tilldela befogenheter, inklusive utredningsbefogenheter,\
            \ till ledam\xF6ter eller personal fr\xE5n ursprungslandets tillsynsmyndighet\
            \ som deltar i gemensamma insatser eller, i den m\xE5n lagstiftningen\
            \ i den medlemsstat som \xE4r v\xE4rdland f\xF6r tillsynsmyndigheten till\xE5\
            ter detta, medge att ursprungslandets tillsynsmyndighets ledam\xF6ter\
            \ eller personal ut\xF6var utredningsbefogenheter enligt lagstiftningen\
            \ i ursprungslandets tillsynsmyndighets medlemsstat. S\xE5dana utredningsbefogenheter\
            \ f\xE5r endast ut\xF6vas under v\xE4gledning och i\_n\xE4rvaro av ledam\xF6\
            ter eller personal fr\xE5n v\xE4rdlandets tillsynsmyndighet. Ledam\xF6\
            ter och personal fr\xE5n ursprungslandets tillsynsmyndighet ska omfattas\
            \ av den medlemsstats nationella r\xE4tt som g\xE4ller f\xF6r v\xE4rdlandets\
            \ tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:62.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.4'
      description: Where, in accordance with paragraph 1, staff of a seconding supervisory
        authority operate in another Member State, the Member State of the host supervisory
        authority shall assume responsibility for their actions, including liability,
        for any damage caused by them during their operations, in accordance with
        the law of the Member State in whose territory they are operating.
      translations:
        sv:
          description: "Om personal fr\xE5n ursprungslandets tillsynsmyndighet verkar\
            \ i en annan medlemsstat i\_enlighet med punkt 1 ska v\xE4rdtillsynsmyndighetens\
            \ medlemsstat ansvara f\xF6r deras handlingar, vilket inbegriper ansvar\
            \ f\xF6r skador som personalen v\xE5llar i samband med insatserna, i enlighet\
            \ med r\xE4tten i den medlemsstat p\xE5 vars territorium personalen verkar."
    - urn: urn:intuitem:risk:req_node:gdpr:62.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.5'
      description: The Member State in whose territory the damage was caused shall
        make good such damage under the conditions applicable to damage caused by
        its own staff. The Member State of the seconding supervisory authority whose
        staff has caused damage to any person in the territory of another Member State
        shall reimburse that other Member State in full any sums it has paid to the
        persons entitled on their behalf.
      translations:
        sv:
          description: "Den medlemsstat p\xE5 vars territorium skadorna f\xF6rorsakades\
            \ ska ers\xE4tta s\xE5dana skador enligt de villkor som g\xE4ller f\xF6\
            r skador som f\xF6rorsakas av dess egen personal. Den medlemsstat vars\
            \ tillsynsmyndighets tj\xE4nstem\xE4n har orsakat en person skada p\xE5\
            \ n\xE5gon annan medlemsstats territorium ska fullt ut ers\xE4tta den\
            \ andra medlemsstaten f\xF6r det belopp som denna har betalat ut till\
            \ den personens r\xE4ttsinnehavare."
    - urn: urn:intuitem:risk:req_node:gdpr:62.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.6'
      description: "Without prejudice to the exercise of its rights vis-\xE0-vis third\
        \ parties and with the exception of paragraph 5, each Member State shall refrain,\
        \ in the case provided for in paragraph 1, from requesting reimbursement from\
        \ another Member State in relation to damage referred to in paragraph 4."
      translations:
        sv:
          description: "Utan att det p\xE5verkar r\xE4ttigheterna gentemot tredje\
            \ man och till\xE4mpningen av punkt 5, ska varje medlemsstat i de fall\
            \ som n\xE4mns i punkt 1 avst\xE5 fr\xE5n att kr\xE4va ers\xE4ttning fr\xE5\
            n en annan medlemsstat f\xF6r skador som avses i punkt 4."
    - urn: urn:intuitem:risk:req_node:gdpr:62.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-62
      ref_id: '62.7'
      description: Where a joint operation is intended and a supervisory authority
        does not, within one month, comply with the obligation laid down in the second
        sentence of paragraph 2 of this Article, the other supervisory authorities
        may adopt a provisional measure on the territory of its Member State in accordance
        with Article 55. In that case, the urgent need to act under Article 66(1)
        shall be presumed to be met and require an opinion or an urgent binding decision
        from the Board pursuant to Article 66(2).
      translations:
        sv:
          description: "Om en gemensam insats planeras och en tillsynsmyndighet inte\
            \ inom en m\xE5nad har uppfyllt sin skyldighet enligt punkt 2 i den h\xE4\
            r artikeln, andra meningen f\xE5r \xF6vriga tillsynsmyndigheter anta provisoriska\
            \ \xE5tg\xE4rder p\xE5 sina respektive medlemsstaters territorium i enlighet\
            \ med artikel\_55. I detta fall ska det br\xE5dskande behov av att agera\
            \ enligt artikel 66.1 anses vara uppfyllt och kr\xE4va ett yttrande eller\
            \ ett br\xE5dskande bindande beslut fr\xE5n styrelsen i enlighet med artikel\
            \ 66.2."
    - urn: urn:intuitem:risk:req_node:gdpr:node868
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-vii
      name: Section 2
      description: Consistency
      translations:
        sv:
          name: Avsnitt 2
          description: Enhetlighet
    - urn: urn:intuitem:risk:req_node:gdpr:article-63
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node868
      ref_id: Article 63
      description: Consistency mechanism
      translations:
        sv:
          name: Artikel 63
          description: "Mekanism f\xF6r enhetlighet"
    - urn: urn:intuitem:risk:req_node:gdpr:node870
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-63
      description: In order to contribute to the consistent application of this Regulation
        throughout the Union, the supervisory authorities shall cooperate with each
        other and, where relevant, with the Commission, through the consistency mechanism
        as set out in this Section.
      translations:
        sv:
          description: "F\xF6r att bidra till en enhetlig till\xE4mpning av denna\
            \ f\xF6rordning i hela unionen ska tillsynsmyndigheterna samarbeta med\
            \ varandra och, i f\xF6rekommande fall, med kommissionen, genom den mekanism\
            \ f\xF6r enhetlighet som f\xF6reskrivs i detta avsnitt."
    - urn: urn:intuitem:risk:req_node:gdpr:article-64
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node868
      ref_id: Article 64
      description: Opinion of the Board
      translations:
        sv:
          name: Artikel 64
          description: "Yttrande fr\xE5n Styrelsen"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.1'
      description: 'The Board shall issue an opinion where a competent supervisory
        authority intends to adopt any of the measures below. To that end, the competent
        supervisory authority shall communicate the draft decision to the Board, when
        it:'
      translations:
        sv:
          description: "Styrelsen ska avge ett yttrande n\xE4r en beh\xF6rig tillsynsmyndighet\
            \ avser att anta n\xE5gon av \xE5tg\xE4rderna nedan. I detta syfte ska\
            \ den beh\xF6riga tillsynsmyndigheten skicka utkastet till beslut till\
            \ styrelsen n\xE4r det"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.a
      description: aims to adopt a list of the processing operations subject to the
        requirement for a data protection impact assessment pursuant to Article 35(4);
      translations:
        sv:
          description: "syftar till att anta en f\xF6rteckning \xF6ver behandling\
            \ som omfattas av kravet p\xE5 en konsekvensbed\xF6mning avseende dataskydd\
            \ enligt artikel 35.4,"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.b
      description: concerns a matter pursuant to Article 40(7) whether a draft code
        of conduct or an amendment or extension to a code of conduct complies with
        this Regulation;
      translations:
        sv:
          description: "r\xF6r ett \xE4rende i enlighet med artikel 40.7 om huruvida\
            \ ett utkast till uppf\xF6randekoder eller en \xE4ndring eller f\xF6rl\xE4\
            ngning av en uppf\xF6randekod \xE4r f\xF6renlig med denna f\xF6rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.c
      description: aims to approve the requirements for accreditation of a body pursuant
        to Article 41(3), of a certification body pursuant to Article 43(3) or the
        criteria for certification referred to in Article 42(5);
      translations:
        sv:
          description: "syftar till att godk\xE4nna kriterierna f\xF6r ackreditering\
            \ av ett organ enligt artikel 41.3 eller ett certifieringsorgan enligt\
            \ artikel 43.3,"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.d
      description: aims to determine standard data protection clauses referred to
        in point (d) of Article 46(2) and in Article 28(8);
      translations:
        sv:
          description: "syftar till att fastst\xE4lla standardiserade dataskyddsbest\xE4\
            mmelser enligt artiklarna\_46.2 d och 28.8,"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.e
      description: aims to authorise contractual clauses referred to in point (a)
        of Article 46(3); or
      translations:
        sv:
          description: "syftar till att godk\xE4nna s\xE5dana avtalsklausuler som\
            \ avses i artikel 46.3 a, eller"
    - urn: urn:intuitem:risk:req_node:gdpr:64.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.1
      ref_id: 64.1.f
      description: aims to approve binding corporate rules within the meaning of Article
        47.
      translations:
        sv:
          description: "syftar till att godk\xE4nna bindande f\xF6retagsbest\xE4mmelser\
            \ enligt artikel 47."
    - urn: urn:intuitem:risk:req_node:gdpr:64.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.2'
      description: Any supervisory authority, the Chair of the Board or the Commission
        may request that any matter of general application or producing effects in
        more than one Member State be examined by the Board with a view to obtaining
        an opinion, in particular where a competent supervisory authority does not
        comply with the obligations for mutual assistance in accordance with Article
        61 or for joint operations in accordance with Article 62.
      translations:
        sv:
          description: "Varje tillsynsmyndighet, styrelsens ordf\xF6rande eller kommissionen\
            \ f\xE5r i syfte att erh\xE5lla ett yttrande beg\xE4ra att styrelsen granskar\
            \ en fr\xE5ga med allm\xE4n r\xE4ckvidd eller som har f\xF6ljder i\_mer\
            \ \xE4n en medlemsstat, i synnerhet om en beh\xF6rig myndighet inte uppfyller\
            \ sina skyldigheter i fr\xE5ga om \xF6msesidigt bist\xE5nd i enlighet\
            \ med artikel 61 eller i fr\xE5ga om gemensamma insatser i enlighet med\
            \ artikel 62."
    - urn: urn:intuitem:risk:req_node:gdpr:64.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.3'
      description: In the cases referred to in paragraphs 1 and 2, the Board shall
        issue an opinion on the matter submitted to it provided that it has not already
        issued an opinion on the same matter. That opinion shall be adopted within
        eight weeks by simple majority of the members of the Board. That period may
        be extended by a further six weeks, taking into account the complexity of
        the subject matter. Regarding the draft decision referred to in paragraph
        1 circulated to the members of the Board in accordance with paragraph 5, a
        member which has not objected within a reasonable period indicated by the
        Chair, shall be deemed to be in agreement with the draft decision.
      translations:
        sv:
          description: "I de fall som avses i punkterna 1 och 2 ska styrelsen avge\
            \ ett yttrande i den fr\xE5ga som ingivits till den, f\xF6rutsatt att\
            \ den inte redan har avgett ett yttrande i samma fr\xE5ga. Detta yttrande\
            \ ska antas med enkel majoritet av styrelsens ledam\xF6ter inom \xE5tta\
            \ veckor. Denna period f\xE5r f\xF6rl\xE4ngas med ytterligare sex veckor\
            \ med h\xE4nsyn till sakfr\xE5gans komplexitet. Vad g\xE4ller det utkast\
            \ till beslut som avses i punkt 1 som spridits till styrelsens ledam\xF6\
            ter i\_enlighet med punkt 5, ska en ledamot som inte har gjort inv\xE4\
            ndningar inom en rimlig period som ordf\xF6randen angett anses samtycka\
            \ till utkastet till beslut."
    - urn: urn:intuitem:risk:req_node:gdpr:64.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.4'
      description: Supervisory authorities and the Commission shall, without undue
        delay, communicate by electronic means to the Board, using a standardised
        format any relevant information, including as the case may be a summary of
        the facts, the draft decision, the grounds which make the enactment of such
        measure necessary, and the views of other supervisory authorities concerned.
      translations:
        sv:
          description: "Tillsynsmyndigheterna och kommissionen ska utan on\xF6digt\
            \ dr\xF6jsm\xE5l i ett standardiserat elektroniskt format till styrelsen\
            \ \xF6vers\xE4nda all relevant information, som allt efter omst\xE4ndigheterna\
            \ f\xE5r utg\xF6ras av en sammanfattning av sakf\xF6rh\xE5llanden, utkastet\
            \ till beslut, grunden till att en s\xE5dan \xE5tg\xE4rd \xE4r n\xF6dv\xE4\
            ndig och synpunkter fr\xE5n \xF6vriga ber\xF6rda tillsynsmyndigheter."
    - urn: urn:intuitem:risk:req_node:gdpr:64.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.5'
      description: 'The Chair of the Board shall, without undue, delay inform by electronic
        means:'
      translations:
        sv:
          description: "Styrelsens ordf\xF6rande ska utan on\xF6digt dr\xF6jsm\xE5\
            l och p\xE5 elektronisk v\xE4g upplysa"
    - urn: urn:intuitem:risk:req_node:gdpr:64.5.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.5
      ref_id: 64.5.a
      description: the members of the Board and the Commission of any relevant information
        which has been communicated to it using a standardised format. The secretariat
        of the Board shall, where necessary, provide translations of relevant information;
        and
      translations:
        sv:
          description: "styrelsens ledam\xF6ter samt kommissionen om all relevant\
            \ information som meddelats styrelsen i ett standardiserat format; styrelsens\
            \ sekretariat ska vid behov tillhandah\xE5lla \xF6vers\xE4ttningar av\
            \ relevant information; och"
    - urn: urn:intuitem:risk:req_node:gdpr:64.5.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:64.5
      ref_id: 64.5.b
      description: the supervisory authority referred to, as the case may be, in paragraphs
        1 and 2, and the Commission of the opinion and make it public.
      translations:
        sv:
          description: "den tillsynsmyndighet som, allt efter omst\xE4ndigheterna,\
            \ avses i punkterna 1 och 2 samt kommissionen om yttrandet, och ska ocks\xE5\
            \ offentligg\xF6ra det."
    - urn: urn:intuitem:risk:req_node:gdpr:64.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.6'
      description: The competent supervisory authority referred to in paragraph 1
        shall not adopt its draft decision referred to in paragraph 1 within the period
        referred to in paragraph 3.
      translations:
        sv:
          description: "Den beh\xF6riga tillsynsmyndigheten f\xE5r inte anta sitt\
            \ utkast till beslut enligt punkt 1 inom den period som avses i punkt\
            \ 3."
    - urn: urn:intuitem:risk:req_node:gdpr:64.7
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.7'
      description: The competent supervisory authority referred to in paragraph 1
        shall take utmost account of the opinion of the Board and shall, within two
        weeks after receiving the opinion, communicate to the Chair of the Board by
        electronic means whether it will maintain or amend its draft decision and,
        if any, the amended draft decision, using a standardised format.
      translations:
        sv:
          description: "Den tillsynsmyndighet som avses i punkt 1 ska ta st\xF6rsta\
            \ m\xF6jliga h\xE4nsyn till styrelsens yttrande och ska, inom tv\xE5 veckor\
            \ efter att yttrandet inkommit, i ett standardiserat elektroniskt format\
            \ meddela styrelsens ordf\xF6rande om huruvida den kommer att h\xE5lla\
            \ fast vid eller \xE4ndra sitt utkast till beslut, och i f\xF6rekommande\
            \ fall \xF6vers\xE4nda det \xE4ndrade utkastet till beslut."
    - urn: urn:intuitem:risk:req_node:gdpr:64.8
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-64
      ref_id: '64.8'
      description: Where the competent supervisory authority referred to in paragraph
        1 informs the Chair of the Board within the period referred to in paragraph
        7 of this Article that it does not intend to follow the opinion of the Board,
        in whole or in part, providing the relevant grounds, Article 65(1) shall apply.
      translations:
        sv:
          description: "Om den ber\xF6rda tillsynsmyndigheten underr\xE4ttar styrelsens\
            \ ordf\xF6rande inom den period som avses i punkt 7 i den h\xE4r artikeln\
            \ om att den inte avser att f\xF6lja styrelsens yttrande, helt eller delvis,\
            \ och tillhandah\xE5ller en relevant motivering, ska artikel 65.1 till\xE4\
            mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:article-65
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node868
      ref_id: Article 65
      description: Dispute resolution by the Board
      translations:
        sv:
          name: Artikel 65
          description: "Tvistl\xF6sning genom styrelsen"
    - urn: urn:intuitem:risk:req_node:gdpr:65.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.1'
      description: 'In order to ensure the correct and consistent application of this
        Regulation in individual cases, the Board shall adopt a binding decision in
        the following cases:'
      translations:
        sv:
          description: "F\xF6r att s\xE4kerst\xE4lla en korrekt och enhetlig till\xE4\
            mpning av denna f\xF6rordning i enskilda fall ska styrelsen anta ett bindande\
            \ beslut i f\xF6ljande fall:"
    - urn: urn:intuitem:risk:req_node:gdpr:65.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:65.1
      ref_id: 65.1.a
      description: where, in a case referred to in Article 60(4), a supervisory authority
        concerned has raised a relevant and reasoned objection to a draft decision
        of the lead supervisory authority and the lead supervisory authority has not
        followed the objection or has rejected such an objection as being not relevant
        or reasoned. The binding decision shall concern all the matters which are
        the subject of the relevant and reasoned objection, in particular whether
        there is an infringement of this Regulation;
      translations:
        sv:
          description: "Om en ber\xF6rd tillsynsmyndighet i ett fall som avses i artikel\
            \ 60.4 har gjort en relevant och motiverad inv\xE4ndning mot ett utkast\
            \ till beslut av den ansvariga myndigheten, eller om den ansvariga myndigheten\
            \ har avslagit denna inv\xE4ndning med motiveringen att den inte var relevant\
            \ eller motiverad. Det bindande beslutet ska avse alla \xE4renden som\
            \ \xE4r f\xF6rem\xE5l f\xF6r den relevanta och motiverade inv\xE4ndningen,\
            \ s\xE4rskilt fr\xE5gan om huruvida det f\xF6religger en \xF6vertr\xE4\
            delse av denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:65.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:65.1
      ref_id: 65.1.b
      description: where there are conflicting views on which of the supervisory authorities
        concerned is competent for the main establishment;
      translations:
        sv:
          description: "Om det finns motstridiga \xE5sikter om vilken av de ber\xF6\
            rda tillsynsmyndigheterna som \xE4r beh\xF6rig f\xF6r det huvudsakliga\
            \ verksamhetsst\xE4llet."
    - urn: urn:intuitem:risk:req_node:gdpr:65.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:65.1
      ref_id: 65.1.c
      description: where a competent supervisory authority does not request the opinion
        of the Board in the cases referred to in Article 64(1), or does not follow
        the opinion of the Board issued under Article 64. In that case, any supervisory
        authority concerned or the Commission may communicate the matter to the Board.
      translations:
        sv:
          description: "Om en beh\xF6rig tillsynsmyndighet inte beg\xE4r ett yttrande\
            \ fr\xE5n styrelsen i de fall som avses i artikel 64.1, eller inte f\xF6\
            ljer ett yttrande som styrelsen avger enligt artikel 64. I detta fall\
            \ f\xE5r varje ber\xF6rd tillsynsmyndighet eller kommissionen \xF6vers\xE4\
            nda \xE4rendet till styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:65.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.2'
      description: The decision referred to in paragraph 1 shall be adopted within
        one month from the referral of the subject-matter by a two-thirds majority
        of the members of the Board. That period may be extended by a further month
        on account of the complexity of the subject-matter. The decision referred
        to in paragraph 1 shall be reasoned and addressed to the lead supervisory
        authority and all the supervisory authorities concerned and binding on them.
      translations:
        sv:
          description: "Det beslut som avses i punkt 1 ska antas inom en m\xE5nad\
            \ efter det att sakfr\xE5gan h\xE4nskjutits med tv\xE5 tredjedels majoritet\
            \ av styrelsens ledam\xF6ter. Denna period f\xE5r f\xF6rl\xE4ngas med\
            \ ytterligare en m\xE5nad med h\xE4nsyn till sakfr\xE5gans komplexitet.\
            \ Det beslut som avses i\_punkt\_1 ska vara motiverat och riktat till\
            \ den ansvariga tillsynsmyndigheten och alla ber\xF6rda tillsynsmyndigheter\
            \ och ska vara bindande f\xF6r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:65.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.3'
      description: Where the Board has been unable to adopt a decision within the
        periods referred to in paragraph 2, it shall adopt its decision within two
        weeks following the expiration of the second month referred to in paragraph
        2 by a simple majority of the members of the Board. Where the members of the
        Board are split, the decision shall by adopted by the vote of its Chair.
      translations:
        sv:
          description: "Om styrelsen inte har kunnat anta n\xE5got beslut inom de\
            \ perioder som avses i punkt 2 ska den anta sitt beslut inom tv\xE5 veckor\
            \ efter utg\xE5ngen av den andra m\xE5nad som avses i\_punkt\_2 med enkel\
            \ majoritet av styrelsens ledam\xF6ter. Om styrelsens ledam\xF6ter \xE4\
            r delade i\_fr\xE5gan ska beslutet antas i enlighet med ordf\xF6randens\
            \ r\xF6st."
    - urn: urn:intuitem:risk:req_node:gdpr:65.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.4'
      description: The supervisory authorities concerned shall not adopt a decision
        on the subject matter submitted to the Board under paragraph 1 during the
        periods referred to in paragraphs 2 and 3.
      translations:
        sv:
          description: "De ber\xF6rda tillsynsmyndigheterna ska inte anta n\xE5got\
            \ beslut om den sakfr\xE5ga som ingivits till styrelsen i enlighet med\
            \ punkt 1 under de perioder som avses i punkterna 2 och 3."
    - urn: urn:intuitem:risk:req_node:gdpr:65.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.5'
      description: The Chair of the Board shall notify, without undue delay, the decision
        referred to in paragraph 1 to the supervisory authorities concerned. It shall
        inform the Commission thereof. The decision shall be published on the website
        of the Board without delay after the supervisory authority has notified the
        final decision referred to in paragraph 6.
      translations:
        sv:
          description: "Styrelsens ordf\xF6rande ska utan on\xF6digt dr\xF6jsm\xE5\
            l meddela de ber\xF6rda tillsynsmyndigheterna det beslut som avses i punkt\
            \ 1. Kommissionen ska informeras om detta. Beslutet ska utan dr\xF6jsm\xE5\
            l offentligg\xF6ras p\xE5 styrelsens webbplats efter att tillsynsmyndigheten\
            \ har meddelat det slutliga beslut som avses i punkt 6."
    - urn: urn:intuitem:risk:req_node:gdpr:65.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-65
      ref_id: '65.6'
      description: The lead supervisory authority or, as the case may be, the supervisory
        authority with which the complaint has been lodged shall adopt its final decision
        on the basis of the decision referred to in paragraph 1 of this Article, without
        undue delay and at the latest by one month after the Board has notified its
        decision. The lead supervisory authority or, as the case may be, the supervisory
        authority with which the complaint has been lodged, shall inform the Board
        of the date when its final decision is notified respectively to the controller
        or the processor and to the data subject. The final decision of the supervisory
        authorities concerned shall be adopted under the terms of Article 60(7), (8)
        and (9). The final decision shall refer to the decision referred to in paragraph
        1 of this Article and shall specify that the decision referred to in that
        paragraph will be published on the website of the Board in accordance with
        paragraph 5 of this Article. The final decision shall attach the decision
        referred to in paragraph 1 of this Article.
      translations:
        sv:
          description: "Den ansvariga tillsynsmyndigheten eller, allt efter omst\xE4\
            ndigheterna, den tillsynsmyndighet till vilken klagom\xE5let har ingetts\
            \ ska anta sitt slutliga beslut p\xE5 grundval av det beslut som avses\
            \ i punkt 1 i den h\xE4r artikeln, utan on\xF6digt dr\xF6jsm\xE5l och\
            \ senast en m\xE5nad efter det att styrelsen har meddelat sitt beslut.\
            \ Den ansvariga tillsynsmyndigheten eller, allt efter omst\xE4ndigheterna,\
            \ den tillsynsmyndighet till vilken klagom\xE5let har ingetts ska underr\xE4\
            tta styrelsen om vilken dag dess slutliga beslut meddelas till den personuppgiftsansvarige\
            \ respektive personuppgiftsbitr\xE4det och den registrerade. De ber\xF6\
            rda tillsynsmyndigheternas slutliga beslut ska antas i enlighet med best\xE4\
            mmelserna i\_artikel 60.7, 60.8 och 60.9. Det slutliga beslutet ska h\xE4\
            nvisa till det beslut som avses i\_punkt\_1 i den h\xE4r artikeln och\
            \ ska precisera att det beslut som avses i punkt 1 kommer att offentligg\xF6\
            ras p\xE5 styrelsens webbplats i enlighet med punkt 5 i den h\xE4r artikeln.\
            \ Det beslut som avses i punkt 1 i den h\xE4r artikeln ska fogas till\
            \ det slutliga beslutet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-66
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node868
      ref_id: Article 66
      description: Urgency procedure
      translations:
        sv:
          name: Artikel 66
          description: "Skyndsamt f\xF6rfarande"
    - urn: urn:intuitem:risk:req_node:gdpr:66.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-66
      ref_id: '66.1'
      description: In exceptional circumstances, where a supervisory authority concerned
        considers that there is an urgent need to act in order to protect the rights
        and freedoms of data subjects, it may, by way of derogation from the consistency
        mechanism referred to in Articles 63, 64 and 65 or the procedure referred
        to in Article 60, immediately adopt provisional measures intended to produce
        legal effects on its own territory with a specified period of validity which
        shall not exceed three months. The supervisory authority shall, without delay,
        communicate those measures and the reasons for adopting them to the other
        supervisory authorities concerned, to the Board and to the Commission.
      translations:
        sv:
          description: "Under exceptionella omst\xE4ndigheter f\xE5r en ber\xF6rd\
            \ tillsynsmyndighet med avvikelse fr\xE5n den mekanism f\xF6r enhetlighet\
            \ som avses i artiklarna 63, 64 och 65 eller det f\xF6rfarande som avses\
            \ i artikel 60 omedelbart vidta provisoriska \xE5tg\xE4rder avsedda att\
            \ ha r\xE4ttsverkan p\xE5 det egna territoriet och med f\xF6rutbest\xE4\
            md varaktighet som inte \xF6verskrider tre m\xE5nader, om den anser att\
            \ det finns ett br\xE5dskande behov av att agera f\xF6r att skydda registrerades\
            \ r\xE4ttigheter och friheter. Tillsynsmyndigheten ska utan dr\xF6jsm\xE5\
            l underr\xE4tta de andra ber\xF6rda tillsynsmyndigheterna, styrelsen och\
            \ kommissionen om dessa \xE5tg\xE4rder och om sk\xE4len till att de vidtas."
    - urn: urn:intuitem:risk:req_node:gdpr:66.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-66
      ref_id: '66.2'
      description: Where a supervisory authority has taken a measure pursuant to paragraph
        1 and considers that final measures need urgently be adopted, it may request
        an urgent opinion or an urgent binding decision from the Board, giving reasons
        for requesting such opinion or decision.
      translations:
        sv:
          description: "Om en tillsynsmyndighet har vidtagit en \xE5tg\xE4rd enligt\
            \ punkt 1 och anser att definitiva \xE5tg\xE4rder skyndsamt m\xE5ste antas,\
            \ f\xE5r den beg\xE4ra ett br\xE5dskande yttrande eller ett br\xE5dskande\
            \ bindande beslut fr\xE5n styrelsen; den ska d\xE5 motivera varf\xF6r\
            \ den beg\xE4r ett s\xE5dant yttrande eller beslut."
    - urn: urn:intuitem:risk:req_node:gdpr:66.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-66
      ref_id: '66.3'
      description: Any supervisory authority may request an urgent opinion or an urgent
        binding decision, as the case may be, from the Board where a competent supervisory
        authority has not taken an appropriate measure in a situation where there
        is an urgent need to act, in order to protect the rights and freedoms of data
        subjects, giving reasons for requesting such opinion or decision, including
        for the urgent need to act.
      translations:
        sv:
          description: "Om en beh\xF6rig tillsynsmyndighet inte har vidtagit n\xE5\
            gon l\xE4mplig \xE5tg\xE4rd i en situation som kr\xE4ver skyndsam handling\
            \ f\xF6r att skydda registrerades r\xE4ttigheter och friheter, f\xE5r\
            \ vilken tillsynsmyndighet som helst beg\xE4ra ett br\xE5dskande yttrande\
            \ eller, i till\xE4mpliga fall, ett br\xE5dskande bindande beslut fr\xE5\
            n styrelsen, varvid den ska motivera varf\xF6r den beg\xE4r ett s\xE5\
            dant yttrande eller beslut och varf\xF6r \xE5tg\xE4rden m\xE5ste vidtas\
            \ skyndsamt."
    - urn: urn:intuitem:risk:req_node:gdpr:66.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-66
      ref_id: '66.4'
      description: By derogation from Article 64(3) and Article 65(2), an urgent opinion
        or an urgent binding decision referred to in paragraphs 2 and 3 of this Article
        shall be adopted within two weeks by simple majority of the members of the
        Board.
      translations:
        sv:
          description: "Genom undantag fr\xE5n artiklarna 64.3 och 65.2 ska ett br\xE5\
            dskande yttrande eller ett br\xE5dskande beslut enligt punkterna 2 och\
            \ 3 i den h\xE4r artikeln antas inom tv\xE5 veckor med enkel majoritet\
            \ av styrelsens ledam\xF6ter."
    - urn: urn:intuitem:risk:req_node:gdpr:article-67
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node868
      ref_id: Article 67
      description: Exchange of information
      translations:
        sv:
          name: Artikel 67
          description: Utbyte av information
    - urn: urn:intuitem:risk:req_node:gdpr:node904
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-67
      description: The Commission may adopt implementing acts of general scope in
        order to specify the arrangements for the exchange of information by electronic
        means between supervisory authorities, and between supervisory authorities
        and the Board, in particular the standardised format referred to in Article
        64.
      translations:
        sv:
          description: "Kommissionen f\xE5r anta genomf\xF6randeakter med allm\xE4\
            n r\xE4ckvidd i syfte att n\xE4rmare ange tillv\xE4gag\xE5ngss\xE4tten\
            \ f\xF6r elektroniskt utbyte av information mellan tillsynsmyndigheter\
            \ samt mellan tillsynsmyndigheter och styrelsen, s\xE4rskilt det standardiserade\
            \ format som avses i artikel 64."
    - urn: urn:intuitem:risk:req_node:gdpr:node905
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-67
      description: Those implementing acts shall be adopted in accordance with the
        examination procedure referred to in Article 93(2).
      translations:
        sv:
          description: "Dessa genomf\xF6randeakter ska antas i enlighet med det granskningsf\xF6\
            rfarande som avses i\_artikel\_93.2."
    - urn: urn:intuitem:risk:req_node:gdpr:node906
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-vii
      name: Section 3
      description: European data protection board
      translations:
        sv:
          name: Avsnitt 3
          description: Europeiska dataskyddsstyrelsen
    - urn: urn:intuitem:risk:req_node:gdpr:article-68
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 68
      description: European Data Protection Board
      translations:
        sv:
          name: Artikel 68
          description: Europeiska dataskyddsstyrelsen
    - urn: urn:intuitem:risk:req_node:gdpr:68.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.1'
      description: "The European Data Protection Board (the \u2018Board\u2019) is\
        \ hereby established as a body of the Union and shall have legal personality."
      translations:
        sv:
          description: "Europeiska dataskyddsstyrelsen (nedan kallad\_styrelsen) inr\xE4\
            ttas h\xE4rmed som ett unionsorgan och ska ha st\xE4llning som juridisk\
            \ person."
    - urn: urn:intuitem:risk:req_node:gdpr:68.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.2'
      description: The Board shall be represented by its Chair.
      translations:
        sv:
          description: "Styrelsen ska f\xF6retr\xE4das av sin ordf\xF6rande."
    - urn: urn:intuitem:risk:req_node:gdpr:68.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.3'
      description: The Board shall be composed of the head of one supervisory authority
        of each Member State and of the European Data Protection Supervisor, or their
        respective representatives.
      translations:
        sv:
          description: "Styrelsen ska best\xE5 av chefen f\xF6r en tillsynsmyndighet\
            \ per medlemsstat och av Europeiska datatillsynsmannen eller deras respektive\
            \ f\xF6retr\xE4dare."
    - urn: urn:intuitem:risk:req_node:gdpr:68.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.4'
      description: Where in a Member State more than one supervisory authority is
        responsible for monitoring the application of the provisions pursuant to this
        Regulation, a joint representative shall be appointed in accordance with that
        Member State's law.
      translations:
        sv:
          description: "Om en medlemsstat har mer \xE4n en tillsynsmyndighet som ansvarar\
            \ f\xF6r att \xF6vervaka till\xE4mpningen av best\xE4mmelserna i denna\
            \ f\xF6rordning ska en gemensam f\xF6retr\xE4dare utses i\_enlighet med\
            \ den medlemsstatens nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:68.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.5'
      description: The Commission shall have the right to participate in the activities
        and meetings of the Board without voting right. The Commission shall designate
        a representative. The Chair of the Board shall communicate to the Commission
        the activities of the Board.
      translations:
        sv:
          description: "Kommissionen ska ha r\xE4tt att delta i styrelsens verksamhet\
            \ och m\xF6ten utan r\xF6str\xE4tt. Kommissionen ska utse en egen f\xF6\
            retr\xE4dare. Styrelsens ordf\xF6rande ska underr\xE4tta kommissionen\
            \ om styrelsens verksamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:68.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-68
      ref_id: '68.6'
      description: In the cases referred to in Article 65, the European Data Protection
        Supervisor shall have voting rights only on decisions which concern principles
        and rules applicable to the Union institutions, bodies, offices and agencies
        which correspond in substance to those of this Regulation.
      translations:
        sv:
          description: "I de fall som avses i artikel 65 ska Europeiska datatillsynsmannen\
            \ endast ha r\xF6str\xE4tt i fr\xE5ga om beslut som r\xF6r principer och\
            \ regler som \xE4r till\xE4mpliga p\xE5 unionens institutioner, organ\
            \ och byr\xE5er, och som i allt v\xE4sentligt motsvarar dem i denna f\xF6\
            rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:article-69
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 69
      description: Independence
      translations:
        sv:
          name: Artikel 69
          description: Oberoende
    - urn: urn:intuitem:risk:req_node:gdpr:69.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-69
      ref_id: '69.1'
      description: The Board shall act independently when performing its tasks or
        exercising its powers pursuant to Articles 70 and 71.
      translations:
        sv:
          description: "Styrelsen ska vara oberoende n\xE4r den fullg\xF6r sina uppgifter\
            \ eller ut\xF6var sina befogenheter i\_enlighet med artiklarna\_70 och\
            \ 71."
    - urn: urn:intuitem:risk:req_node:gdpr:69.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-69
      ref_id: '69.2'
      description: Without prejudice to requests by the Commission referred to in
        Article 70(1) and (2), the Board shall, in the performance of its tasks or
        the exercise of its powers, neither seek nor take instructions from anybody.
      translations:
        sv:
          description: "Utan att detta p\xE5verkar kommissionens r\xE4tt att l\xE4\
            mna en beg\xE4ran enligt artikel 70.1 b och\_70.2 ska styrelsen n\xE4\
            r den fullg\xF6r sina uppgifter eller ut\xF6var sina befogenheter varken\
            \ beg\xE4ra eller ta emot instruktioner av n\xE5gon."
    - urn: urn:intuitem:risk:req_node:gdpr:article-70
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 70
      description: Tasks of the Board
      translations:
        sv:
          name: Artikel 70
          description: Styrelsens uppgifter
    - urn: urn:intuitem:risk:req_node:gdpr:70.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-70
      ref_id: '70.1'
      description: 'The Board shall ensure the consistent application of this Regulation.
        To that end, the Board shall, on its own initiative or, where relevant, at
        the request of the Commission, in particular:'
      translations:
        sv:
          description: "Styrelsen ska se till att denna f\xF6rordning till\xE4mpas\
            \ enhetligt. F\xF6r detta \xE4ndam\xE5l ska styrelsen, p\xE5 eget initiativ\
            \ eller i f\xF6rekommande fall p\xE5 beg\xE4ran av kommissionen, i\_synnerhet"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.a
      description: monitor and ensure the correct application of this Regulation in
        the cases provided for in Articles 64 and 65 without prejudice to the tasks
        of national supervisory authorities;
      translations:
        sv:
          description: "\xF6vervaka och s\xE4kerst\xE4lla korrekt till\xE4mpning av\
            \ denna f\xF6rordning i de fall som avses i\_artiklarna 64 och 65 utan\
            \ att det p\xE5verkar de nationella tillsynsmyndigheternas uppgifter,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.b
      description: advise the Commission on any issue related to the protection of
        personal data in the Union, including on any proposed amendment of this Regulation;
      translations:
        sv:
          description: "ge kommissionen r\xE5d i alla fr\xE5gor som g\xE4ller skydd\
            \ av personuppgifter inom unionen, inklusive om eventuella f\xF6rslag\
            \ till \xE4ndring av denna f\xF6rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.c
      description: advise the Commission on the format and procedures for the exchange
        of information between controllers, processors and supervisory authorities
        for binding corporate rules;
      translations:
        sv:
          description: "ge kommissionen r\xE5d om format och f\xF6rfaranden f\xF6\
            r informationsutbyte mellan personuppgiftsansvariga, personuppgiftsbitr\xE4\
            den och tillsynsmyndigheter f\xF6r bindande f\xF6retagsbest\xE4mmelser,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.d
      description: issue guidelines, recommendations, and best practices on procedures
        for erasing links, copies or replications of personal data from publicly available
        communication services as referred to in Article 17(2);
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ betr\xE4ffande f\xF6rfaranden f\xF6r att radera l\xE4nkar, kopior eller\
            \ reproduktioner av personuppgifter fr\xE5n allm\xE4nt tillg\xE4ngliga\
            \ kommunikationstj\xE4nster enligt artikel 17.2,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.e
      description: examine, on its own initiative, on request of one of its members
        or on request of the Commission, any question covering the application of
        this Regulation and issue guidelines, recommendations and best practices in
        order to encourage consistent application of this Regulation;
      translations:
        sv:
          description: "p\xE5 eget initiativ eller p\xE5 beg\xE4ran av en av sina\
            \ ledam\xF6ter eller av kommissionen behandla fr\xE5gor om till\xE4mpningen\
            \ av denna f\xF6rordning och utf\xE4rda riktlinjer, rekommendationer och\
            \ b\xE4sta praxis i syfte att fr\xE4mja en enhetlig till\xE4mpning av\
            \ denna f\xF6rordning,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.f
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph for further specifying the criteria and conditions
        for decisions based on profiling pursuant to Article 22(2);
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt f\xF6r att n\xE4rmare ange kriterierna\
            \ och villkoren f\xF6r profileringsbaserade beslut enligt artikel 22.2,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.g
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph for establishing the personal data breaches
        and determining the undue delay referred to in Article 33(1) and (2) and for
        the particular circumstances in which a controller or a processor is required
        to notify the personal data breach;
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt f\xF6r att konstatera s\xE5dana personuppgiftsincidenter\
            \ och fastst\xE4lla s\xE5dant on\xF6digt dr\xF6jsm\xE5l som avses i artikel\
            \ 33.1 och 33.2 och f\xF6r de s\xE4rskilda omst\xE4ndigheter under vilka\
            \ en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4de \xE4r skyldig\
            \ att anm\xE4la personuppgiftsincidenten,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.h
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.h
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph as to the circumstances in which a personal
        data breach is likely to result in a high risk to the rights and freedoms
        of the natural persons referred to in Article 34(1).
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt ang\xE5ende de omst\xE4ndigheter\
            \ under vilka en personuppgiftsincident sannolikt kommer att leda till\
            \ h\xF6g risk f\xF6r r\xE4ttigheterna och friheterna f\xF6r de fysiska\
            \ personer som avses i artikel 34.1,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.i
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.i
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph for the purpose of further specifying the
        criteria and requirements for personal data transfers based on binding corporate
        rules adhered to by controllers and binding corporate rules adhered to by
        processors and on further necessary requirements to ensure the protection
        of personal data of the data subjects concerned referred to in Article 47;
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt f\xF6r att n\xE4rmare ange kriterierna\
            \ och kraven f\xF6r \xF6verf\xF6ringar av personuppgifter p\xE5 grundval\
            \ av bindande f\xF6retagsbest\xE4mmelser som personuppgiftsansvariga eller\
            \ personuppgiftsbitr\xE4den f\xF6ljer samt ytterligare n\xF6dv\xE4ndiga\
            \ krav f\xF6r att s\xE4kerst\xE4lla skyddet f\xF6r personuppgifter f\xF6\
            r ber\xF6rda registrerade enligt artikel 47,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.j
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.j
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph for the purpose of further specifying the
        criteria and requirements for the personal data transfers on the basis of
        Article 49(1);
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt f\xF6r att n\xE4rmare ange kriterierna\
            \ och villkoren f\xF6r \xF6verf\xF6ring av personuppgifter p\xE5 grundval\
            \ av artikel 49.1,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.k
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.k
      description: draw up guidelines for supervisory authorities concerning the application
        of measures referred to in Article 58(1), (2) and (3) and the setting of administrative
        fines pursuant to Article 83;
      translations:
        sv:
          description: "utforma riktlinjer f\xF6r tillsynsmyndigheterna i fr\xE5ga\
            \ om till\xE4mpningen av de \xE5tg\xE4rder som avses i artikel 58.1, 58.2\
            \ och 58.3 och fastst\xE4llandet av administrativa sanktionsavgifter i\
            \ enlighet med artikel 83,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.l
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.l
      description: review the practical application of the guidelines, recommendations
        and best practices;
      translations:
        sv:
          description: "se \xF6ver den praktiska till\xE4mpningen av de riktlinjer\
            \ och rekommendationer samt den b\xE4sta praxis som avses i leden\_e och\
            \ f,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.m
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.m
      description: issue guidelines, recommendations and best practices in accordance
        with point (e) of this paragraph for establishing common procedures for reporting
        by natural persons of infringements of this Regulation pursuant to Article
        54(2);
      translations:
        sv:
          description: "utf\xE4rda riktlinjer, rekommendationer och b\xE4sta praxis\
            \ i enlighet med led e i denna punkt f\xF6r att fastst\xE4lla gemensamma\
            \ f\xF6rfaranden f\xF6r fysiska personers rapportering av \xF6vertr\xE4\
            delser av denna f\xF6rordning enligt artikel 54.2,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.n
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.n
      description: encourage the drawing-up of codes of conduct and the establishment
        of data protection certification mechanisms and data protection seals and
        marks pursuant to Articles 40 and 42;
      translations:
        sv:
          description: "fr\xE4mja utarbetandet av uppf\xF6randekoder och inf\xF6randet\
            \ av certifieringsmekanismer f\xF6r dataskydd och sigill och m\xE4rkningar\
            \ f\xF6r dataskydd i enlighet med artiklarna\_40 och 42,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.o
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.o
      description: approve the criteria of certification pursuant to Article 42(5)
        and maintain a public register of certification mechanisms and data protection
        seals and marks pursuant to Article 42(8) and of the certified controllers
        or processors established in third countries pursuant to Article 42(7);
      translations:
        sv:
          description: "ackreditera certifieringsorgan och utf\xF6ra sin periodiska\
            \ \xF6versyn i enlighet med artikel\_43 och f\xF6ra ett offentligt register\
            \ \xF6ver ackrediterade organ i enlighet med artikel\_43.6 och \xF6ver\
            \ de ackrediterade personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            dena som \xE4r etablerade i\_tredjel\xE4nder i enlighet med artikel 42.7,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.p
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.p
      description: approve the requirements referred to in Article 43(3) with a view
        to the accreditation of certification bodies referred to in Article 43;
      translations:
        sv:
          description: "n\xE4rmare ange de krav som avses i artikel 43.3 i syfte att\
            \ ackreditera certifieringsorgan enligt artikel 42,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.q
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.q
      description: provide the Commission with an opinion on the certification requirements
        referred to in Article 43(8);
      translations:
        sv:
          description: avge ett yttrande till kommissionen om de certifieringskrav
            som avses i artikel 43.8,
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.r
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.r
      description: provide the Commission with an opinion on the icons referred to
        in Article 12(7);
      translations:
        sv:
          description: avge ett yttrande till kommissionen om de symboler som avses
            i artikel 12.7,
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.s
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.s
      description: provide the Commission with an opinion for the assessment of the
        adequacy of the level of protection in a third country or international organisation,
        including for the assessment whether a third country, a territory or one or
        more specified sectors within that third country, or an international organisation
        no longer ensures an adequate level of protection. To that end, the Commission
        shall provide the Board with all necessary documentation, including correspondence
        with the government of the third country, with regard to that third country,
        territory or specified sector, or with the international organisation.
      translations:
        sv:
          description: "avge ett yttrande till kommissionen f\xF6r bed\xF6mningen\
            \ av adekvat skyddsniv\xE5 i ett tredjeland eller en internationell organisation,\
            \ inklusive f\xF6r bed\xF6mningen av huruvida ett tredjeland, ett territorium\
            \ eller en eller flera specificerade sektorer inom det tredjelandet, eller\
            \ en internationell organisation inte l\xE4ngre s\xE4kerst\xE4ller en\
            \ adekvat skyddsniv\xE5; i detta syfte ska kommissionen l\xE4mna all n\xF6\
            dv\xE4ndig dokumentation till styrelsen, inklusive korrespondens med regeringen\
            \ i tredjelandet, med avseende p\xE5 tredjelandet, territoriet eller den\
            \ specificerade sektorn, eller till databehandlingssektorn i\_tredjelandet\
            \ eller den internationella organisationen,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.t
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.t
      description: issue opinions on draft decisions of supervisory authorities pursuant
        to the consistency mechanism referred to in Article 64(1), on matters submitted
        pursuant to Article 64(2) and to issue binding decisions pursuant to Article
        65, including in cases referred to in Article 66;
      translations:
        sv:
          description: "avge yttranden om utkast till beslut som l\xE4ggs fram av\
            \ tillsynsmyndigheter inom den mekanism f\xF6r enhetlighet som avses i\
            \ artikel 64.1, i \xE4renden som ingivits i enlighet med artikel\_64.2\
            \ och anta bindande beslut i enlighet med artikel 65, inbegripet de fall\
            \ som avses i artikel 66,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.u
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.u
      description: promote the cooperation and the effective bilateral and multilateral
        exchange of information and best practices between the supervisory authorities;
      translations:
        sv:
          description: "fr\xE4mja samarbete och effektivt bilateralt och multilateralt\
            \ utbyte av b\xE4sta praxis och information mellan tillsynsmyndigheterna,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.v
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.v
      description: promote common training programmes and facilitate personnel exchanges
        between the supervisory authorities and, where appropriate, with the supervisory
        authorities of third countries or with international organisations;
      translations:
        sv:
          description: "fr\xE4mja gemensamma utbildningsprogram och underl\xE4tta\
            \ personalutbyte mellan tillsynsmyndigheterna och d\xE4r s\xE5 \xE4r l\xE4\
            mpligt \xE4ven med tillsynsmyndigheter i\_tredjel\xE4nder eller internationella\
            \ organisationer,"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.w
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.w
      description: promote the exchange of knowledge and documentation on data protection
        legislation and practice with data protection supervisory authorities worldwide.
      translations:
        sv:
          description: "fr\xE4mja utbyte av kunskap och dokumentation om lagstiftning\
            \ om och praxis f\xF6r dataskydd med tillsynsmyndigheter f\xF6r dataskydd\
            \ i hela v\xE4rlden."
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.x
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.x
      description: issue opinions on codes of conduct drawn up at Union level pursuant
        to Article 40(9); and
      translations:
        sv:
          description: "avge yttranden \xF6ver de uppf\xF6randekoder som utarbetas\
            \ p\xE5 unionsniv\xE5 i enlighet med artikel\_40.9, och"
    - urn: urn:intuitem:risk:req_node:gdpr:70.1.y
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:70.1
      ref_id: 70.1.y
      description: maintain a publicly accessible electronic register of decisions
        taken by supervisory authorities and courts on issues handled in the consistency
        mechanism.
      translations:
        sv:
          description: "f\xF6ra ett offentligt elektroniskt register \xF6ver tillsynsmyndigheters\
            \ beslut och domstolars avg\xF6randen i fr\xE5gor som hanteras inom mekanismen\
            \ f\xF6r enhetlighet."
    - urn: urn:intuitem:risk:req_node:gdpr:70.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-70
      ref_id: '70.2'
      description: Where the Commission requests advice from the Board, it may indicate
        a time limit, taking into account the urgency of the matter.
      translations:
        sv:
          description: "N\xE4r kommissionen beg\xE4r r\xE5dgivning fr\xE5n styrelsen\
            \ f\xE5r den ange en tidsfrist med h\xE4nsyn till hur br\xE5dskande \xE4\
            rendet \xE4r."
    - urn: urn:intuitem:risk:req_node:gdpr:70.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-70
      ref_id: '70.3'
      description: The Board shall forward its opinions, guidelines, recommendations,
        and best practices to the Commission and to the committee referred to in Article
        93 and make them public.
      translations:
        sv:
          description: "Styrelsen ska vidarebefordra sina yttranden, riktlinjer, rekommendationer\
            \ och b\xE4sta praxis till kommissionen och till den kommitt\xE9 som avses\
            \ i artikel 93, samt offentligg\xF6ra dem."
    - urn: urn:intuitem:risk:req_node:gdpr:70.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-70
      ref_id: '70.4'
      description: The Board shall, where appropriate, consult interested parties
        and give them the opportunity to comment within a reasonable period. The Board
        shall, without prejudice to Article 76, make the results of the consultation
        procedure publicly available.
      translations:
        sv:
          description: "N\xE4r s\xE5 \xE4r l\xE4mpligt ska styrelsen samr\xE5da med\
            \ ber\xF6rda parter och ge dem m\xF6jlighet att yttra sig inom rimlig\
            \ tid. styrelsen ska, utan att det p\xE5verkar till\xE4mpningen av artikel\_\
            76, offentligg\xF6ra resultatet av samr\xE5dsf\xF6rfarandet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-71
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 71
      description: Reports
      translations:
        sv:
          name: Artikel 71
          description: Rapporter
    - urn: urn:intuitem:risk:req_node:gdpr:71.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-71
      ref_id: '71.1'
      description: The Board shall draw up an annual report regarding the protection
        of natural persons with regard to processing in the Union and, where relevant,
        in third countries and international organisations. The report shall be made
        public and be transmitted to the European Parliament, to the Council and to
        the Commission.
      translations:
        sv:
          description: "Styrelsen ska sammanst\xE4lla en \xE5rsrapport om skydd av\
            \ fysiska personer vid behandling inom unionen och, i f\xF6rekommande\
            \ fall, i tredjel\xE4nder och internationella organisationer. Rapporten\
            \ ska offentligg\xF6ras och \xF6vers\xE4ndas till Europaparlamentet, r\xE5\
            det och kommissionen."
    - urn: urn:intuitem:risk:req_node:gdpr:71.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-71
      ref_id: '71.2'
      description: The annual report shall include a review of the practical application
        of the guidelines, recommendations and best practices referred to in point
        (l) of Article 70(1) as well as of the binding decisions referred to in Article
        65.
      translations:
        sv:
          description: "\xC5rsrapporten ska ocks\xE5 inneh\xE5lla en \xF6versikt \xF6\
            ver den praktiska till\xE4mpningen av de riktlinjer och rekommendationer\
            \ och den b\xE4sta praxis som avses i artikel 70.1\_l liksom de bindande\
            \ beslut som avses i artikel 65."
    - urn: urn:intuitem:risk:req_node:gdpr:article-72
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 72
      description: Procedure
      translations:
        sv:
          name: Artikel 72
          description: "F\xF6rfarande"
    - urn: urn:intuitem:risk:req_node:gdpr:72.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-72
      ref_id: '72.1'
      description: The Board shall take decisions by a simple majority of its members,
        unless otherwise provided for in this Regulation.
      translations:
        sv:
          description: "Styrelsen ska fatta beslut med enkel majoritet av dess ledam\xF6\
            ter, om inte annat anges i\_denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:73.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-72
      ref_id: '73.2'
      description: The Board shall adopt its own rules of procedure by a two-thirds
        majority of its members and organise its own operational arrangements.
      translations:
        sv:
          description: "Styrelsen ska sj\xE4lv anta sin arbetsordning med tv\xE5 tredjedels\
            \ majoritet av sina ledam\xF6ter och fastst\xE4lla sina arbetsformer."
    - urn: urn:intuitem:risk:req_node:gdpr:article-73
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 73
      description: Chair
      translations:
        sv:
          name: Artikel 73
          description: "Ordf\xF6rande"
    - urn: urn:intuitem:risk:req_node:gdpr:73.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-73
      ref_id: '73.1'
      description: The Board shall elect a chair and two deputy chairs from amongst
        its members by simple majority.
      translations:
        sv:
          description: "Styrelsen ska med enkel majoritet v\xE4lja en ordf\xF6rande\
            \ och tv\xE5 vice ordf\xF6rande bland sina ledam\xF6ter."
    - urn: urn:intuitem:risk:req_node:gdpr:72.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-73
      ref_id: '72.2'
      description: The term of office of the Chair and of the deputy chairs shall
        be five years and be renewable once.
      translations:
        sv:
          description: "Ordf\xF6randens och de vice ordf\xF6randenas mandattid ska\
            \ vara fem \xE5r och kunna f\xF6rnyas en g\xE5ng."
    - urn: urn:intuitem:risk:req_node:gdpr:article-74
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 74
      description: Tasks of the Chair
      translations:
        sv:
          name: Artikel 74
          description: "Ordf\xF6randens uppgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:74.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-74
      ref_id: '74.1'
      description: 'The Chair shall have the following tasks:'
      translations:
        sv:
          description: "Ordf\xF6randen ska ha i uppgift att"
    - urn: urn:intuitem:risk:req_node:gdpr:74.1.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:74.1
      ref_id: 74.1.a
      description: to convene the meetings of the Board and prepare its agenda;
      translations:
        sv:
          description: "sammankalla till styrelsens m\xF6ten och planera dagordningen,"
    - urn: urn:intuitem:risk:req_node:gdpr:74.1.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:74.1
      ref_id: 74.1.b
      description: to notify decisions adopted by the Board pursuant to Article 65
        to the lead supervisory authority and the supervisory authorities concerned;
      translations:
        sv:
          description: "meddela beslut som antas av styrelsen i enlighet med artikel\
            \ 65 till den ansvariga tillsynsmyndigheten och de ber\xF6rda tillsynsmyndigheterna,"
    - urn: urn:intuitem:risk:req_node:gdpr:74.1.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:74.1
      ref_id: 74.1.c
      description: to ensure the timely performance of the tasks of the Board, in
        particular in relation to the consistency mechanism referred to in Article
        63.
      translations:
        sv:
          description: "se till att styrelsens uppgifter fullg\xF6rs i tid, s\xE4\
            rskilt i fr\xE5ga om den mekanism f\xF6r enhetlighet som avses i artikel\
            \ 63."
    - urn: urn:intuitem:risk:req_node:gdpr:74.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-74
      ref_id: '74.2'
      description: The Board shall lay down the allocation of tasks between the Chair
        and the deputy chairs in its rules of procedure.
      translations:
        sv:
          description: "F\xF6rdelningen av uppgifter mellan ordf\xF6randen och de\
            \ vice ordf\xF6randena ska fastst\xE4llas i\_styrelsens arbetsordning."
    - urn: urn:intuitem:risk:req_node:gdpr:article-75
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 75
      description: Secretariat
      translations:
        sv:
          name: Artikel 75
          description: Sekretariatet
    - urn: urn:intuitem:risk:req_node:gdpr:75.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.1'
      description: The Board shall have a secretariat, which shall be provided by
        the European Data Protection Supervisor.
      translations:
        sv:
          description: "Styrelsen ska f\xF6rfoga \xF6ver ett sekretariat som ska tillhandah\xE5\
            llas av Europeiska datatillsynsmannen."
    - urn: urn:intuitem:risk:req_node:gdpr:75.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.2'
      description: The secretariat shall perform its tasks exclusively under the instructions
        of the Chair of the Board.
      translations:
        sv:
          description: "Sekretariatet ska utf\xF6ra sina uppgifter enbart under ledning\
            \ av ordf\xF6randen f\xF6r styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:75.3
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.3'
      description: The staff of the European Data Protection Supervisor involved in
        carrying out the tasks conferred on the Board by this Regulation shall be
        subject to separate reporting lines from the staff involved in carrying out
        tasks conferred on the European Data Protection Supervisor.
      translations:
        sv:
          description: "Den personal vid Europeiska datatillsynsmannen som utf\xF6\
            r de uppgifter som styrelsen tilldelas genom denna f\xF6rordning ska f\xF6\
            lja separata rapporteringsv\xE4gar fr\xE5n den personal som utf\xF6r de\
            \ uppgifter som Europeiska datatillsynsmannen tilldelas."
    - urn: urn:intuitem:risk:req_node:gdpr:75.4
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.4'
      description: Where appropriate, the Board and the European Data Protection Supervisor
        shall establish and publish a Memorandum of Understanding implementing this
        Article, determining the terms of their cooperation, and applicable to the
        staff of the European Data Protection Supervisor involved in carrying out
        the tasks conferred on the Board by this Regulation.
      translations:
        sv:
          description: "N\xE4r s\xE5 \xE4r l\xE4mpligt ska styrelsen och Europeiska\
            \ datatillsynsmannen fastst\xE4lla och offentligg\xF6ra ett samf\xF6rst\xE5\
            ndsavtal f\xF6r genomf\xF6rande av denna artikel, som fastst\xE4ller villkoren\
            \ f\xF6r deras samarbete, och som ska till\xE4mpas p\xE5 den personal\
            \ vid Europeiska datatillsynsmannen som utf\xF6r de uppgifter som styrelsen\
            \ tilldelas genom denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:75.5
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.5'
      description: The secretariat shall provide analytical, administrative and logistical
        support to the Board.
      translations:
        sv:
          description: "Sekretariatet ska f\xF6rse styrelsen med analysst\xF6d samt\
            \ administrativt och logistiskt st\xF6d."
    - urn: urn:intuitem:risk:req_node:gdpr:75.6
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-75
      ref_id: '75.6'
      description: 'The secretariat shall be responsible in particular for:'
      translations:
        sv:
          description: "Sekretariatet ska s\xE4rskilt ansvara f\xF6r"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.a
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.a
      description: the day-to-day business of the Board;
      translations:
        sv:
          description: "styrelsens l\xF6pande arbete,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.b
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.b
      description: communication between the members of the Board, its Chair and the
        Commission;
      translations:
        sv:
          description: "kommunikationen mellan styrelsens ledam\xF6ter, dess ordf\xF6\
            rande och kommissionen,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.c
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.c
      description: communication with other institutions and the public;
      translations:
        sv:
          description: "kommunikationen med andra institutioner och med allm\xE4nheten,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.d
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.d
      description: the use of electronic means for the internal and external communication;
      translations:
        sv:
          description: "anv\xE4ndningen av elektroniska medel f\xF6r intern och extern\
            \ kommunikation,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.e
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.e
      description: the translation of relevant information;
      translations:
        sv:
          description: "\xF6vers\xE4ttning av relevant information,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.f
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.f
      description: the preparation and follow-up of the meetings of the Board;
      translations:
        sv:
          description: "f\xF6rberedelser och uppf\xF6ljning av styrelsens m\xF6ten,"
    - urn: urn:intuitem:risk:req_node:gdpr:75.6.g
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:gdpr:75.6
      ref_id: 75.6.g
      description: the preparation, drafting and publication of opinions, decisions
        on the settlement of disputes between supervisory authorities and other texts
        adopted by the Board.
      translations:
        sv:
          description: "f\xF6rberedelse, sammanst\xE4llning och offentligg\xF6rande\
            \ av yttranden, beslut om l\xF6sning av tvister mellan tillsynsmyndigheter\
            \ och andra texter som antas av styrelsen."
    - urn: urn:intuitem:risk:req_node:gdpr:article-76
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:node906
      ref_id: Article 76
      description: Confidentiality
      translations:
        sv:
          name: Artikel 76
          description: Konfidentialitet
    - urn: urn:intuitem:risk:req_node:gdpr:76.1
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-76
      ref_id: '76.1'
      description: The discussions of the Board shall be confidential where the Board
        deems it necessary, as provided for in its rules of procedure.
      translations:
        sv:
          description: "Styrelsens \xF6verl\xE4ggningar ska vara konfidentiella i\
            \ de fall som styrelsen bed\xF6mer detta vara n\xF6dv\xE4ndigt, i enlighet\
            \ med vad som anges i dess arbetsordning."
    - urn: urn:intuitem:risk:req_node:gdpr:76.2
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-76
      ref_id: '76.2'
      description: Access to documents submitted to members of the Board, experts
        and representatives of third parties shall be governed by Regulation (EC)
        No 1049/2001 of the European Parliament and of the Council ( 1 ).
      translations:
        sv:
          description: "Tillg\xE5ngen till handlingar som skickas till styrelsens\
            \ ledam\xF6ter, till experter eller till f\xF6retr\xE4dare f\xF6r tredje\
            \ part ska regleras av Europaparlamentets och r\xE5dets f\xF6rordning\
            \ (EG) nr\_1049/2001\_(21)."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      assessable: false
      depth: 1
      ref_id: CHAPTER VIII
      description: Remedies, liability and penalties
      translations:
        sv:
          name: KAPITEL VIII
          description: "R\xE4ttsmedel, ansvar och sanktioner"
    - urn: urn:intuitem:risk:req_node:gdpr:article-77
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 77
      description: Right to lodge a complaint with a supervisory authority
      translations:
        sv:
          name: Artikel 77
          description: "R\xE4tt att l\xE4mna in klagom\xE5l till en tillsynsmyndighet"
    - urn: urn:intuitem:risk:req_node:gdpr:77.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-77
      ref_id: '77.1'
      description: Without prejudice to any other administrative or judicial remedy,
        every data subject shall have the right to lodge a complaint with a supervisory
        authority, in particular in the Member State of his or her habitual residence,
        place of work or place of the alleged infringement if the data subject considers
        that the processing of personal data relating to him or her infringes this
        Regulation.
      translations:
        sv:
          description: "Utan att det p\xE5verkar n\xE5got annat administrativt pr\xF6\
            vningsf\xF6rfarande eller r\xE4ttsmedel, ska varje registrerad som anser\
            \ att behandlingen av personuppgifter som avser henne eller honom strider\
            \ mot denna f\xF6rordning ha r\xE4tt att l\xE4mna in ett klagom\xE5l till\
            \ en tillsynsmyndighet, s\xE4rskilt i den medlemsstat d\xE4r han eller\
            \ hon har sin hemvist eller sin arbetsplats eller d\xE4r det p\xE5st\xE5\
            dda intr\xE5nget begicks."
    - urn: urn:intuitem:risk:req_node:gdpr:77.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-77
      ref_id: '77.2'
      description: The supervisory authority with which the complaint has been lodged
        shall inform the complainant on the progress and the outcome of the complaint
        including the possibility of a judicial remedy pursuant to Article 78.
      translations:
        sv:
          description: "Den tillsynsmyndighet till vilken klagom\xE5let har ingetts\
            \ ska underr\xE4tta den enskilde om hur arbetet med klagom\xE5let fortskrider\
            \ och vad resultatet blir, inbegripet m\xF6jligheten till r\xE4ttslig\
            \ pr\xF6vning enligt artikel 78."
    - urn: urn:intuitem:risk:req_node:gdpr:article-78
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 78
      description: Right to an effective judicial remedy against a supervisory authority
      translations:
        sv:
          name: Artikel 78
          description: "R\xE4tt till ett effektivt r\xE4ttsmedel mot tillsynsmyndighetens\
            \ beslut"
    - urn: urn:intuitem:risk:req_node:gdpr:78.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-78
      ref_id: '78.1'
      description: Without prejudice to any other administrative or non-judicial remedy,
        each natural or legal person shall have the right to an effective judicial
        remedy against a legally binding decision of a supervisory authority concerning
        them.
      translations:
        sv:
          description: "Utan att det p\xE5verkar n\xE5got annat administrativt pr\xF6\
            vningsf\xF6rfarande eller pr\xF6vningsf\xF6rfarande utanf\xF6r domstol\
            \ ska varje fysisk eller juridisk person ha r\xE4tt till ett effektivt\
            \ r\xE4ttsmedel mot ett r\xE4ttsligt bindande beslut r\xF6rande dem som\
            \ meddelats av en tillsynsmyndighet."
    - urn: urn:intuitem:risk:req_node:gdpr:78.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-78
      ref_id: '78.2'
      description: Without prejudice to any other administrative or non-judicial remedy,
        each data subject shall have the right to a an effective judicial remedy where
        the supervisory authority which is competent pursuant to Articles 55 and 56
        does not handle a complaint or does not inform the data subject within three
        months on the progress or outcome of the complaint lodged pursuant to Article
        77.
      translations:
        sv:
          description: "Utan att det p\xE5verkar n\xE5got annat administrativt pr\xF6\
            vningsf\xF6rfarande eller pr\xF6vningsf\xF6rfarande utanf\xF6r domstol,\
            \ ska varje registrerad person ha r\xE4tt till ett effektivt r\xE4ttsmedel\
            \ om den tillsynsmyndighet som \xE4r beh\xF6rig i enlighet med artiklarna\
            \ 55 och 56 underl\xE5ter att behandla ett klagom\xE5l eller att informera\
            \ den registrerade inom tre m\xE5nader om hur det fortskrider med det\
            \ klagom\xE5l som ingetts med st\xF6d av artikel 77 eller vilket beslut\
            \ som har fattats med anledning av det."
    - urn: urn:intuitem:risk:req_node:gdpr:78.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-78
      ref_id: '78.3'
      description: Proceedings against a supervisory authority shall be brought before
        the courts of the Member State where the supervisory authority is established.
      translations:
        sv:
          description: "Talan mot en tillsynsmyndighet ska v\xE4ckas vid domstolarna\
            \ i den medlemsstat d\xE4r tillsynsmyndigheten har sitt s\xE4te."
    - urn: urn:intuitem:risk:req_node:gdpr:78.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-78
      ref_id: '78.4'
      description: Where proceedings are brought against a decision of a supervisory
        authority which was preceded by an opinion or a decision of the Board in the
        consistency mechanism, the supervisory authority shall forward that opinion
        or decision to the court.
      translations:
        sv:
          description: "Om talan v\xE4cks mot ett beslut som fattats av en tillsynsmyndighet\
            \ och som f\xF6regicks av ett yttrande fr\xE5n eller beslut av styrelsen\
            \ inom ramen f\xF6r mekanismen f\xF6r enhetlighet ska tillsynsmyndigheten\
            \ vidarebefordra detta yttrande eller beslut till domstolen."
    - urn: urn:intuitem:risk:req_node:gdpr:article-79
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 79
      description: Right to an effective judicial remedy against a controller or processor
      translations:
        sv:
          name: Artikel 79
          description: "R\xE4tt till ett effektivt r\xE4ttsmedel mot en personuppgiftsansvarig\
            \ eller ett personuppgiftsbitr\xE4de"
    - urn: urn:intuitem:risk:req_node:gdpr:79.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-79
      ref_id: '79.1'
      description: Without prejudice to any available administrative or non-judicial
        remedy, including the right to lodge a complaint with a supervisory authority
        pursuant to Article 77, each data subject shall have the right to an effective
        judicial remedy where he or she considers that his or her rights under this
        Regulation have been infringed as a result of the processing of his or her
        personal data in non-compliance with this Regulation.
      translations:
        sv:
          description: "Utan att det p\xE5verkar tillg\xE4ngliga administrativa pr\xF6\
            vningsf\xF6rfaranden eller pr\xF6vningsf\xF6rfaranden utanf\xF6r domstol,\
            \ inbegripet r\xE4tten att l\xE4mna in ett klagom\xE5l till en tillsynsmyndighet\
            \ i enlighet med artikel 77, ska varje registrerad som anser att hans\
            \ eller hennes r\xE4ttigheter enligt denna f\xF6rordning har \xE5sidosatts\
            \ som en f\xF6ljd av att hans eller hennes personuppgifter har behandlats\
            \ p\xE5 ett s\xE4tt som inte \xE4r f\xF6renligt med denna f\xF6rordning\
            \ ha r\xE4tt till ett effektivt r\xE4ttsmedel."
    - urn: urn:intuitem:risk:req_node:gdpr:79.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-79
      ref_id: '79.2'
      description: Proceedings against a controller or a processor shall be brought
        before the courts of the Member State where the controller or processor has
        an establishment. Alternatively, such proceedings may be brought before the
        courts of the Member State where the data subject has his or her habitual
        residence, unless the controller or processor is a public authority of a Member
        State acting in the exercise of its public powers.
      translations:
        sv:
          description: "Talan mot en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de ska v\xE4ckas vid domstolarna i den medlemsstat d\xE4r den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det \xE4r etablerad. Alternativt f\xE5r\
            \ s\xE5dan talan v\xE4ckas vid domstolarna i\_den medlemsstat d\xE4r den\
            \ registrerade har sin hemvist, s\xE5vida inte den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det \xE4r en myndighet i en medlemsstat\
            \ som agerar inom ramen f\xF6r sin myndighetsut\xF6vning."
    - urn: urn:intuitem:risk:req_node:gdpr:article-80
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 80
      description: Representation of data subjects
      translations:
        sv:
          name: Artikel 80
          description: "F\xF6retr\xE4dande av registrerade"
    - urn: urn:intuitem:risk:req_node:gdpr:80.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-80
      ref_id: '80.1'
      description: The data subject shall have the right to mandate a not-for-profit
        body, organisation or association which has been properly constituted in accordance
        with the law of a Member State, has statutory objectives which are in the
        public interest, and is active in the field of the protection of data subjects'
        rights and freedoms with regard to the protection of their personal data to
        lodge the complaint on his or her behalf, to exercise the rights referred
        to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right
        to receive compensation referred to in Article 82 on his or her behalf where
        provided for by Member State law.
      translations:
        sv:
          description: "Den registrerade ska ha r\xE4tt att ge ett organ, en organisation\
            \ eller sammanslutning utan vinstsyfte, som har inr\xE4ttats p\xE5 l\xE4\
            mpligt s\xE4tt i enlighet med lagen i en medlemsstat, vars stadgeenliga\
            \ m\xE5l \xE4r av allm\xE4nt intresse och som \xE4r verksam inom omr\xE5\
            det skydd av registrerades r\xE4ttigheter och friheter n\xE4r det g\xE4\
            ller skyddet av deras personuppgifter, i\_uppdrag att l\xE4mna in ett\
            \ klagom\xE5l f\xF6r hans eller hennes r\xE4kning, att ut\xF6va de r\xE4\
            ttigheter som avses i artiklarna 77, 78 och 79 f\xF6r hans eller hennes\
            \ r\xE4kning samt att f\xF6r hans eller hennes r\xE4kning ut\xF6va den\
            \ r\xE4tt till ers\xE4ttning som avses i artikel 82 om s\xE5 f\xF6reskrivs\
            \ i\_medlemsstatens nationella r\xE4tt."
    - urn: urn:intuitem:risk:req_node:gdpr:80.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-80
      ref_id: '80.2'
      description: Member States may provide that any body, organisation or association
        referred to in paragraph 1 of this Article, independently of a data subject's
        mandate, has the right to lodge, in that Member State, a complaint with the
        supervisory authority which is competent pursuant to Article 77 and to exercise
        the rights referred to in Articles 78 and 79 if it considers that the rights
        of a data subject under this Regulation have been infringed as a result of
        the processing.
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r f\xF6reskriva att ett organ, en organisation\
            \ eller en sammanslutning enligt punkt 1 i den h\xE4r artikeln, oberoende\
            \ av en registrerads mandat, har r\xE4tt att i den medlemsstaten inge\
            \ klagom\xE5l till den tillsynsmyndighet som \xE4r beh\xF6rig enligt artikel\
            \ 77 och ut\xF6va de r\xE4ttigheter som avses i artiklarna 78 och 79 om\
            \ organet, organisationen eller sammanslutningen anser att den registrerades\
            \ r\xE4ttigheter enligt den h\xE4r f\xF6rordningen har kr\xE4nkts som\
            \ en f\xF6ljd av behandlingen."
    - urn: urn:intuitem:risk:req_node:gdpr:article-81
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 81
      description: Suspension of proceedings
      translations:
        sv:
          name: Artikel 81
          description: "Vilandef\xF6rklaring av f\xF6rfaranden"
    - urn: urn:intuitem:risk:req_node:gdpr:81.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-81
      ref_id: '81.1'
      description: Where a competent court of a Member State has information on proceedings,
        concerning the same subject matter as regards processing by the same controller
        or processor, that are pending in a court in another Member State, it shall
        contact that court in the other Member State to confirm the existence of such
        proceedings.
      translations:
        sv:
          description: "Om en beh\xF6rig domstol i en medlemsstat har information\
            \ om att f\xF6rfaranden som r\xF6r samma sakfr\xE5ga vad g\xE4ller behandling\
            \ av samma personuppgiftsansvarige eller personuppgiftsbitr\xE4de p\xE5\
            g\xE5r i en domstol i en annan medlemsstat ska den kontakta denna domstol\
            \ i den andra medlemsstaten f\xF6r att bekr\xE4fta f\xF6rekomsten av s\xE5\
            dana f\xF6rfaranden."
    - urn: urn:intuitem:risk:req_node:gdpr:81.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-81
      ref_id: '81.2'
      description: Where proceedings concerning the same subject matter as regards
        processing of the same controller or processor are pending in a court in another
        Member State, any competent court other than the court first seized may suspend
        its proceedings.
      translations:
        sv:
          description: "Om f\xF6rfaranden som r\xF6r samma sakfr\xE5ga vad g\xE4ller\
            \ behandling av samma personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            de p\xE5g\xE5r i en domstol i en annan medlemstat f\xE5r alla andra beh\xF6\
            riga domstolar \xE4n den d\xE4r f\xF6rfarandena f\xF6rst inleddes vilandef\xF6\
            rklara f\xF6rfarandena."
    - urn: urn:intuitem:risk:req_node:gdpr:81.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-81
      ref_id: '81.3'
      description: Where those proceedings are pending at first instance, any court
        other than the court first seized may also, on the application of one of the
        parties, decline jurisdiction if the court first seized has jurisdiction over
        the actions in question and its law permits the consolidation thereof.
      translations:
        sv:
          description: "Om dessa f\xF6rfaranden pr\xF6vas i f\xF6rsta instans f\xE5\
            r varje domstol, utom den vid vilken f\xF6rfarandena f\xF6rst inleddes,\
            \ ocks\xE5 f\xF6rklara sig obeh\xF6rig p\xE5 beg\xE4ran av en av parterna,\
            \ om den domstol vid vilken f\xF6rfarandena f\xF6rst inleddes \xE4r beh\xF6\
            rig att pr\xF6va de ber\xF6rda f\xF6rfarandena och dess lagstiftning till\xE5\
            ter f\xF6rening av dessa."
    - urn: urn:intuitem:risk:req_node:gdpr:article-82
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 82
      description: Right to compensation and liability
      translations:
        sv:
          name: Artikel 82
          description: "Ansvar och r\xE4tt till ers\xE4ttning"
    - urn: urn:intuitem:risk:req_node:gdpr:82.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.1'
      description: Any person who has suffered material or non-material damage as
        a result of an infringement of this Regulation shall have the right to receive
        compensation from the controller or processor for the damage suffered.
      translations:
        sv:
          description: "Varje person som har lidit materiell eller immateriell skada\
            \ till f\xF6ljd av en \xF6vertr\xE4delse av denna f\xF6rordning ska ha\
            \ r\xE4tt till ers\xE4ttning fr\xE5n den personuppgiftsansvarige eller\
            \ personuppgiftsbitr\xE4det f\xF6r den uppkomna skadan."
    - urn: urn:intuitem:risk:req_node:gdpr:82.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.2'
      description: Any controller involved in processing shall be liable for the damage
        caused by processing which infringes this Regulation. A processor shall be
        liable for the damage caused by processing only where it has not complied
        with obligations of this Regulation specifically directed to processors or
        where it has acted outside or contrary to lawful instructions of the controller.
      translations:
        sv:
          description: "Varje personuppgiftsansvarig som medverkat vid behandlingen\
            \ ska ansvara f\xF6r skada som orsakats av behandling som strider mot\
            \ denna f\xF6rordning. Ett personuppgiftsbitr\xE4de ska ansvara f\xF6\
            r skada uppkommen till f\xF6ljd av behandlingen endast om denne inte har\
            \ fullgjort de skyldigheter i denna f\xF6rordning som specifikt riktar\
            \ sig till personuppgiftsbitr\xE4den eller agerat utanf\xF6r eller i strid\
            \ med den personuppgiftsansvariges lagenliga anvisningar."
    - urn: urn:intuitem:risk:req_node:gdpr:82.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.3'
      description: A controller or processor shall be exempt from liability under
        paragraph 2 if it proves that it is not in any way responsible for the event
        giving rise to the damage.
      translations:
        sv:
          description: "Den personuppgiftsansvarige eller personuppgiftsbitr\xE4det\
            \ ska undg\xE5 ansvar enligt punkt 2 om den visar att den inte p\xE5 n\xE5\
            got s\xE4tt \xE4r ansvarig f\xF6r den h\xE4ndelse som orsakade skadan."
    - urn: urn:intuitem:risk:req_node:gdpr:82.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.4'
      description: Where more than one controller or processor, or both a controller
        and a processor, are involved in the same processing and where they are, under
        paragraphs 2 and 3, responsible for any damage caused by processing, each
        controller or processor shall be held liable for the entire damage in order
        to ensure effective compensation of the data subject.
      translations:
        sv:
          description: "Om mer \xE4n en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de, eller b\xE5de en personuppgiftsansvarig och ett personuppgiftsbitr\xE4\
            de, har medverkat vid samma behandling, och om de enligt punkterna 2 och\
            \ 3 \xE4r ansvariga f\xF6r eventuell skada som behandlingen orsakat ska\
            \ varje personuppgiftsansvarig eller personuppgiftsbitr\xE4de h\xE5llas\
            \ ansvarig f\xF6r hela skadan f\xF6r att s\xE4kerst\xE4lla att den registrerade\
            \ f\xE5r effektiv ers\xE4ttning."
    - urn: urn:intuitem:risk:req_node:gdpr:82.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.5'
      description: Where a controller or processor has, in accordance with paragraph
        4, paid full compensation for the damage suffered, that controller or processor
        shall be entitled to claim back from the other controllers or processors involved
        in the same processing that part of the compensation corresponding to their
        part of responsibility for the damage, in accordance with the conditions set
        out in paragraph 2.
      translations:
        sv:
          description: "Om en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de, i enlighet med punkt 4, har betalat full ers\xE4ttning f\xF6r den\
            \ skada som orsakats ska den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det ha r\xE4tt att fr\xE5n de andra personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            dena som medverkat vid samma behandling \xE5terkr\xE4va den del av ers\xE4\
            ttningen som motsvarar deras del av ansvaret f\xF6r skadan i enlighet\
            \ med de villkor som fastst\xE4lls i punkt 2."
    - urn: urn:intuitem:risk:req_node:gdpr:82.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-82
      ref_id: '82.6'
      description: Court proceedings for exercising the right to receive compensation
        shall be brought before the courts competent under the law of the Member State
        referred to in Article 79(2).
      translations:
        sv:
          description: "Domstolsf\xF6rfaranden f\xF6r ut\xF6vande av r\xE4tten till\
            \ ers\xE4ttning ska tas upp vid de domstolar som \xE4r beh\xF6riga enligt\
            \ den nationella r\xE4tten i den medlemsstat som avses i artikel 79.2."
    - urn: urn:intuitem:risk:req_node:gdpr:article-83
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 83
      description: General conditions for imposing administrative fines
      translations:
        sv:
          name: Artikel 83
          description: "Allm\xE4nna villkor f\xF6r p\xE5f\xF6rande av administrativa\
            \ sanktionsavgifter"
    - urn: urn:intuitem:risk:req_node:gdpr:83.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.1'
      description: Each supervisory authority shall ensure that the imposition of
        administrative fines pursuant to this Article in respect of infringements
        of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual
        case be effective, proportionate and dissuasive.
      translations:
        sv:
          description: "Varje tillsynsmyndighet ska s\xE4kerst\xE4lla att p\xE5f\xF6\
            rande av administrativa sanktionsavgifter i\_enlighet med denna artikel\
            \ f\xF6r s\xE5dana \xF6vertr\xE4delser av denna f\xF6rordning som avses\
            \ i\_punkterna 4, 5 och 6 i varje enskilt fall \xE4r effektivt, proportionellt\
            \ och avskr\xE4ckande."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.2'
      description: 'Administrative fines shall, depending on the circumstances of
        each individual case, be imposed in addition to, or instead of, measures referred
        to in points (a) to (h) and (j) of Article 58(2). When deciding whether to
        impose an administrative fine and deciding on the amount of the administrative
        fine in each individual case due regard shall be given to the following:'
      translations:
        sv:
          description: "Administrativa sanktionsavgifter ska, beroende p\xE5 omst\xE4\
            ndigheterna i det enskilda fallet, p\xE5f\xF6ras ut\xF6ver eller i st\xE4\
            llet f\xF6r de \xE5tg\xE4rder som avses i artikel 58.2 a\u2013h och j.\
            \ Vid beslut om huruvida administrativa sanktionsavgifter ska p\xE5f\xF6\
            ras och om beloppet f\xF6r de administrativa sanktionsavgifterna i varje\
            \ enskilt fall ska vederb\xF6rlig h\xE4nsyn tas till f\xF6ljande:"
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.a
      description: the nature, gravity and duration of the infringement taking into
        account the nature scope or purpose of the processing concerned as well as
        the number of data subjects affected and the level of damage suffered by them;
      translations:
        sv:
          description: "\xD6vertr\xE4delsens karakt\xE4r, sv\xE5righetsgrad och varaktighet\
            \ med beaktande av den aktuella uppgiftsbehandlingens karakt\xE4r, omfattning\
            \ eller syfte samt antalet ber\xF6rda registrerade och den skada som de\
            \ har lidit."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.b
      description: the intentional or negligent character of the infringement;
      translations:
        sv:
          description: "Om \xF6vertr\xE4delsen skett med upps\xE5t eller genom oaktsamhet."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.c
      description: any action taken by the controller or processor to mitigate the
        damage suffered by data subjects;
      translations:
        sv:
          description: "De \xE5tg\xE4rder som den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det har vidtagit f\xF6r att lindra den skada som de registrerade har lidit."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.d
      description: the degree of responsibility of the controller or processor taking
        into account technical and organisational measures implemented by them pursuant
        to Articles 25 and 32;
      translations:
        sv:
          description: "Graden av ansvar hos den personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det med beaktande av de tekniska och organisatoriska \xE5tg\xE4rder som\
            \ genomf\xF6rts av dem i\_enlighet med artiklarna 25 och 32."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.e
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.e
      description: any relevant previous infringements by the controller or processor;
      translations:
        sv:
          description: "Eventuella relevanta tidigare \xF6vertr\xE4delser som den\
            \ personuppgiftsansvarige eller personuppgiftsbitr\xE4det gjort sig skyldig\
            \ till."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.f
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.f
      description: the degree of cooperation with the supervisory authority, in order
        to remedy the infringement and mitigate the possible adverse effects of the
        infringement;
      translations:
        sv:
          description: "Graden av samarbete med tillsynsmyndigheten f\xF6r att komma\
            \ till r\xE4tta med \xF6vertr\xE4delsen och minska dess potentiella negativa\
            \ effekter."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.g
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.g
      description: the categories of personal data affected by the infringement;
      translations:
        sv:
          description: "De kategorier av personuppgifter som p\xE5verkas av \xF6vertr\xE4\
            delsen."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.h
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.h
      description: the manner in which the infringement became known to the supervisory
        authority, in particular whether, and if so to what extent, the controller
        or processor notified the infringement;
      translations:
        sv:
          description: "Det s\xE4tt p\xE5 vilket \xF6vertr\xE4delsen kom till tillsynsmyndighetens\
            \ k\xE4nnedom, s\xE4rskilt huruvida och i vilken omfattning den personuppgiftsansvarige\
            \ eller personuppgiftsbitr\xE4det anm\xE4lde \xF6vertr\xE4delsen."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.i
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.i
      description: where measures referred to in Article 58(2) have previously been
        ordered against the controller or processor concerned with regard to the same
        subject-matter, compliance with those measures;
      translations:
        sv:
          description: "N\xE4r \xE5tg\xE4rder enligt artikel 58.2 tidigare har f\xF6\
            rordnats mot den ber\xF6rda personuppgiftsansvarige eller personuppgiftsbitr\xE4\
            det vad g\xE4ller samma sakfr\xE5ga, efterlevnad av dessa \xE5tg\xE4rder."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.j
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.j
      description: adherence to approved codes of conduct pursuant to Article 40 or
        approved certification mechanisms pursuant to Article 42; and
      translations:
        sv:
          description: "Till\xE4mpandet av godk\xE4nda uppf\xF6randekoder i enlighet\
            \ med artikel 40 eller godk\xE4nda certifieringsmekanismer i enlighet\
            \ med artikel 42."
    - urn: urn:intuitem:risk:req_node:gdpr:83.2.k
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.2
      ref_id: 83.2.k
      description: any other aggravating or mitigating factor applicable to the circumstances
        of the case, such as financial benefits gained, or losses avoided, directly
        or indirectly, from the infringement.
      translations:
        sv:
          description: "Eventuell annan f\xF6rsv\xE5rande eller f\xF6rmildrande faktor\
            \ som \xE4r till\xE4mplig p\xE5 omst\xE4ndigheterna i fallet, s\xE5som\
            \ ekonomisk vinst som g\xF6rs eller f\xF6rlust som undviks, direkt eller\
            \ indirekt, genom \xF6vertr\xE4delsen."
    - urn: urn:intuitem:risk:req_node:gdpr:83.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.3'
      description: If a controller or processor intentionally or negligently, for
        the same or linked processing operations, infringes several provisions of
        this Regulation, the total amount of the administrative fine shall not exceed
        the amount specified for the gravest infringement.
      translations:
        sv:
          description: "Om en personuppgiftsansvarig eller ett personuppgiftsbitr\xE4\
            de, med avseende p\xE5 en och samma eller sammankopplade uppgiftsbehandlingar,\
            \ upps\xE5tligen eller av oaktsamhet \xF6vertr\xE4der flera av best\xE4\
            mmelserna i denna f\xF6rordning f\xE5r den administrativa sanktionsavgiftens\
            \ totala belopp inte \xF6verstiga det belopp som fastst\xE4lls f\xF6r\
            \ den allvarligaste \xF6vertr\xE4delsen."
    - urn: urn:intuitem:risk:req_node:gdpr:83.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.4'
      description: 'Infringements of the following provisions shall, in accordance
        with paragraph 2, be subject to administrative fines up to 10 000 000 EUR,
        or in the case of an undertaking, up to 2 % of the total worldwide annual
        turnover of the preceding financial year, whichever is higher:'
      translations:
        sv:
          description: "Vid \xF6vertr\xE4delser av f\xF6ljande best\xE4mmelser ska\
            \ det i enlighet med punkt 2 p\xE5f\xF6ras administrativa sanktionsavgifter\
            \ p\xE5 upp till 10\_000\_000\_EUR eller, om det g\xE4ller ett f\xF6retag,\
            \ p\xE5 upp\_till\_2 % av den totala globala \xE5rsoms\xE4ttningen under\
            \ f\xF6reg\xE5ende budget\xE5r, beroende p\xE5 vilket v\xE4rde som \xE4\
            r h\xF6gst:"
    - urn: urn:intuitem:risk:req_node:gdpr:83.4.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.4
      ref_id: 83.4.a
      description: the obligations of the controller and the processor pursuant to
        Articles 8, 11, 25 to 39 and 42 and 43;
      translations:
        sv:
          description: "Personuppgiftsansvarigas och personuppgiftsbitr\xE4dens skyldigheter\
            \ enligt artiklarna\_8, 11, 25\u201339, 42 och 43."
    - urn: urn:intuitem:risk:req_node:gdpr:83.4.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.4
      ref_id: 83.4.b
      description: the obligations of the certification body pursuant to Articles
        42 and 43;
      translations:
        sv:
          description: Certifieringsorganets skyldigheter enligt artiklarna 42 och
            43.
    - urn: urn:intuitem:risk:req_node:gdpr:83.4.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.4
      ref_id: 83.4.c
      description: the obligations of the monitoring body pursuant to Article 41(4).
      translations:
        sv:
          description: "\xD6vervakningsorganets skyldigheter enligt artikel 41.4."
    - urn: urn:intuitem:risk:req_node:gdpr:83.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.5'
      description: 'Infringements of the following provisions shall, in accordance
        with paragraph 2, be subject to administrative fines up to 20 000 000 EUR,
        or in the case of an undertaking, up to 4 % of the total worldwide annual
        turnover of the preceding financial year, whichever is higher:'
      translations:
        sv:
          description: "Vid \xF6vertr\xE4delser av f\xF6ljande best\xE4mmelser ska\
            \ det i enlighet med punkt 2 p\xE5f\xF6ras administrativa sanktionsavgifter\
            \ p\xE5 upp till 20\_000\_000\_EUR eller, om det g\xE4ller ett f\xF6retag,\
            \ p\xE5 upp\_till\_4 % av den totala globala \xE5rsoms\xE4ttningen under\
            \ f\xF6reg\xE5ende budget\xE5r, beroende p\xE5 vilket v\xE4rde som \xE4\
            r h\xF6gst:"
    - urn: urn:intuitem:risk:req_node:gdpr:83.5.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.5
      ref_id: 83.5.a
      description: the basic principles for processing, including conditions for consent,
        pursuant to Articles 5, 6, 7 and 9;
      translations:
        sv:
          description: "De grundl\xE4ggande principerna f\xF6r behandling, inklusive\
            \ villkoren f\xF6r samtycke, enligt artiklarna 5, 6, 7 och 9."
    - urn: urn:intuitem:risk:req_node:gdpr:83.5.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.5
      ref_id: 83.5.b
      description: the data subjects' rights pursuant to Articles 12 to 22;
      translations:
        sv:
          description: "Registrerades r\xE4ttigheter enligt artiklarna 12\u201322."
    - urn: urn:intuitem:risk:req_node:gdpr:83.5.c
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.5
      ref_id: 83.5.c
      description: the transfers of personal data to a recipient in a third country
        or an international organisation pursuant to Articles 44 to 49;
      translations:
        sv:
          description: "\xD6verf\xF6ring av personuppgifter till en mottagare i ett\
            \ tredjeland eller en internationell organisation enligt artiklarna\_\
            44\u201349."
    - urn: urn:intuitem:risk:req_node:gdpr:83.5.d
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.5
      ref_id: 83.5.d
      description: any obligations pursuant to Member State law adopted under Chapter
        IX;
      translations:
        sv:
          description: "Alla skyldigheter som f\xF6ljer av medlemsstaternas lagstiftning\
            \ som antagits p\xE5 grundval av kapitel IX."
    - urn: urn:intuitem:risk:req_node:gdpr:83.5.e
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:83.5
      ref_id: 83.5.e
      description: non-compliance with an order or a temporary or definitive limitation
        on processing or the suspension of data flows by the supervisory authority
        pursuant to Article 58(2) or failure to provide access in violation of Article
        58(1).
      translations:
        sv:
          description: "Underl\xE5tenhet att r\xE4tta sig efter ett f\xF6rel\xE4ggande\
            \ eller en tillf\xE4llig eller permanent begr\xE4nsning av behandling\
            \ av uppgifter eller ett beslut om att avbryta uppgiftsfl\xF6dena som\
            \ meddelats av tillsynsmyndigheten i enlighet med artikel\_58.2 eller\
            \ underl\xE5telse att ge tillg\xE5ng till uppgifter i strid med artikel\
            \ 58.1."
    - urn: urn:intuitem:risk:req_node:gdpr:83.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.6'
      description: Non-compliance with an order by the supervisory authority as referred
        to in Article 58(2) shall, in accordance with paragraph 2 of this Article,
        be subject to administrative fines up to 20 000 000 EUR, or in the case of
        an undertaking, up to 4 % of the total worldwide annual turnover of the preceding
        financial year, whichever is higher.
      translations:
        sv:
          description: "Vid underl\xE5tenhet att r\xE4tta sig efter ett f\xF6rel\xE4\
            ggande fr\xE5n tillsynsmyndigheten i enlighet med artikel\_58.2 ska det\
            \ i enlighet med punkt 2 i den h\xE4r artikeln p\xE5f\xF6ras administrativa\
            \ sanktionsavgifter p\xE5 upp till\_20\_000\_000\_EUR eller, om det g\xE4\
            ller ett f\xF6retag, p\xE5 upp\_till\_4 % av den totala globala \xE5rsoms\xE4\
            ttningen under f\xF6reg\xE5ende budget\xE5r, beroende p\xE5 vilket v\xE4\
            rde som \xE4r h\xF6gst:"
    - urn: urn:intuitem:risk:req_node:gdpr:83.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.7'
      description: Without prejudice to the corrective powers of supervisory authorities
        pursuant to Article 58(2), each Member State may lay down the rules on whether
        and to what extent administrative fines may be imposed on public authorities
        and bodies established in that Member State.
      translations:
        sv:
          description: "Utan att det p\xE5verkar tillsynsmyndigheternas korrigerande\
            \ befogenheter enligt artikel\_58.2 f\xE5r varje medlemsstat fastst\xE4\
            lla regler f\xF6r huruvida och i vilken utstr\xE4ckning administrativa\
            \ sanktionsavgifter kan p\xE5f\xF6ras offentliga myndigheter och organ\
            \ som \xE4r inr\xE4ttade i\_medlemsstaten."
    - urn: urn:intuitem:risk:req_node:gdpr:83.8
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.8'
      description: The exercise by the supervisory authority of its powers under this
        Article shall be subject to appropriate procedural safeguards in accordance
        with Union and Member State law, including effective judicial remedy and due
        process.
      translations:
        sv:
          description: "Tillsynsmyndighetens ut\xF6vande av sina befogenheter enligt\
            \ denna artikel ska omfattas av l\xE4mpliga r\xE4ttss\xE4kerhetsgarantier\
            \ i enlighet med unionsr\xE4tten och medlemsstaternas nationella r\xE4\
            tt, inbegripet effektiva r\xE4ttsmedel och r\xE4ttss\xE4kerhet."
    - urn: urn:intuitem:risk:req_node:gdpr:83.9
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-83
      ref_id: '83.9'
      description: Where the legal system of the Member State does not provide for
        administrative fines, this Article may be applied in such a manner that the
        fine is initiated by the competent supervisory authority and imposed by competent
        national courts, while ensuring that those legal remedies are effective and
        have an equivalent effect to the administrative fines imposed by supervisory
        authorities. In any event, the fines imposed shall be effective, proportionate
        and dissuasive. Those Member States shall notify to the Commission the provisions
        of their laws which they adopt pursuant to this paragraph by 25 May 2018 and,
        without delay, any subsequent amendment law or amendment affecting them.
      translations:
        sv:
          description: "Om det i medlemsstatens r\xE4ttssystem inte finns n\xE5gra\
            \ f\xF6reskrifter om administrativa sanktionsavgifter f\xE5r den h\xE4\
            r artikeln till\xE4mpas s\xE5 att f\xF6rfarandet inleds av den beh\xF6\
            riga tillsynsmyndigheten och sanktionsavgifterna sedan utd\xF6ms av beh\xF6\
            rig nationell domstol, varvid det s\xE4kerst\xE4lls att r\xE4ttsmedlen\
            \ \xE4r effektiva och har motsvarande verkan som de administrativa sanktionsavgifter\
            \ som p\xE5f\xF6rs av tillsynsmyndigheter. De sanktionsavgifter som p\xE5\
            f\xF6rs ska i alla h\xE4ndelser vara effektiva, proportionella och avskr\xE4\
            ckande. Dessa medlemsstater ska till kommissionen anm\xE4la de best\xE4\
            mmelser i deras lagstiftning som de antar i enlighet med denna punkt senast\
            \ den 25 maj 2018, samt utan dr\xF6jsm\xE5l anm\xE4la eventuell senare\
            \ \xE4ndringslagstiftning eller \xE4ndringar som ber\xF6r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:article-84
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-viii
      ref_id: Article 84
      description: Penalties
      translations:
        sv:
          name: Artikel 84
          description: Sanktioner
    - urn: urn:intuitem:risk:req_node:gdpr:84.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-84
      ref_id: '84.1'
      description: Member States shall lay down the rules on other penalties applicable
        to infringements of this Regulation in particular for infringements which
        are not subject to administrative fines pursuant to Article 83, and shall
        take all measures necessary to ensure that they are implemented. Such penalties
        shall be effective, proportionate and dissuasive.
      annotation: Under French law, Articles 226-16 to 226-24 of the Penal Code provide
        for sanctions.
      translations:
        sv:
          description: "Medlemsstaterna ska fastst\xE4lla regler om andra sanktioner\
            \ f\xF6r \xF6vertr\xE4delser av denna f\xF6rordning, s\xE4rskilt f\xF6\
            r \xF6vertr\xE4delser som inte \xE4r f\xF6rem\xE5l f\xF6r administrativa\
            \ sanktionsavgifter enligt artikel\_83, och vidta alla n\xF6dv\xE4ndiga\
            \ \xE5tg\xE4rder f\xF6r att s\xE4kerst\xE4lla att de genomf\xF6rs. Dessa\
            \ sanktioner ska vara effektiva, proportionella och avskr\xE4ckande."
          annotation: Under French law, Artikels 226-16 to 226-24 of the Penal Code
            provide for sanctions.
    - urn: urn:intuitem:risk:req_node:gdpr:84.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-84
      ref_id: '84.2'
      description: Each Member State shall notify to the Commission the provisions
        of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without
        delay, any subsequent amendment affecting them.
      translations:
        sv:
          description: "Varje medlemsstat ska till kommissionen anm\xE4la de best\xE4\
            mmelser i sin lagstiftning som den antar i enlighet med punkt 1 senast\
            \ den 25 maj 2018, samt utan dr\xF6jsm\xE5l anm\xE4la eventuella senare\
            \ \xE4ndringar som ber\xF6r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      assessable: false
      depth: 1
      ref_id: CHAPTER IX
      description: Provisions relating to specific processing situations
      translations:
        sv:
          name: KAPITEL IX
          description: "Best\xE4mmelser om s\xE4rskilda behandlingssituationer"
    - urn: urn:intuitem:risk:req_node:gdpr:article-85
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 85
      description: Processing and freedom of expression and information
      translations:
        sv:
          name: Artikel 85
          description: Behandling och yttrande- och informationsfriheten
    - urn: urn:intuitem:risk:req_node:gdpr:85.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-85
      ref_id: '85.1'
      description: Member States shall by law reconcile the right to the protection
        of personal data pursuant to this Regulation with the right to freedom of
        expression and information, including processing for journalistic purposes
        and the purposes of academic, artistic or literary expression.
      translations:
        sv:
          description: "Medlemsstaterna ska i lag f\xF6rena r\xE4tten till integritet\
            \ i enlighet med denna f\xF6rordning med yttrande- och informationsfriheten,\
            \ inbegripet behandling som sker f\xF6r journalistiska \xE4ndam\xE5l eller\
            \ f\xF6r akademiskt, konstn\xE4rligt eller litter\xE4rt skapande."
    - urn: urn:intuitem:risk:req_node:gdpr:85.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-85
      ref_id: '85.2'
      description: For processing carried out for journalistic purposes or the purpose
        of academic artistic or literary expression, Member States shall provide for
        exemptions or derogations from Chapter II (principles), Chapter III (rights
        of the data subject), Chapter IV (controller and processor), Chapter V (transfer
        of personal data to third countries or international organisations), Chapter
        VI (independent supervisory authorities), Chapter VII (cooperation and consistency)
        and Chapter IX (specific data processing situations) if they are necessary
        to reconcile the right to the protection of personal data with the freedom
        of expression and information.
      annotation: Based on national legislation, consider the exceptions that have
        been implemented
      translations:
        sv:
          description: "Medlemsstaterna ska, f\xF6r behandling som sker f\xF6r journalistiska\
            \ \xE4ndam\xE5l eller f\xF6r akademiskt, konstn\xE4rligt eller litter\xE4\
            rt skapande, fastst\xE4lla undantag eller avvikelser fr\xE5n kapitel II\
            \ (principer), kapitel III (den registrerades r\xE4ttigheter), kapitel\_\
            IV (personuppgiftsansvarig och personuppgiftsbitr\xE4de), kapitel V (\xF6\
            verf\xF6ring av personuppgifter till tredjel\xE4nder eller internationella\
            \ organisationer), kapitel VI (oberoende tillsynsmyndigheter), kapitel\
            \ VII (samarbete och enhetlighet) och kapitel IX (s\xE4rskilda situationer\
            \ vid behandling av personuppgifter) om dessa \xE4r n\xF6dv\xE4ndiga f\xF6\
            r att f\xF6rena r\xE4tten till integritet med yttrande- och informationsfriheten."
          annotation: Based on national legislation, consider the exceptions that
            have been implemented
    - urn: urn:intuitem:risk:req_node:gdpr:85.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-85
      ref_id: '85.3'
      description: Each Member State shall notify to the Commission the provisions
        of its law which it has adopted pursuant to paragraph 2 and, without delay,
        any subsequent amendment law or amendment affecting them.
      translations:
        sv:
          description: "Varje medlemsstat ska till kommissionen anm\xE4la de best\xE4\
            mmelser i sin lagstiftning som den antagit i\_enlighet med punkt 2, samt\
            \ utan dr\xF6jsm\xE5l anm\xE4la eventuell senare \xE4ndringslagstiftning\
            \ eller \xE4ndringar som ber\xF6r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:article-86
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 86
      description: Processing and public access to official documents
      translations:
        sv:
          name: Artikel 86
          description: "Behandling och allm\xE4nhetens tillg\xE5ng till allm\xE4nna\
            \ handlingar"
    - urn: urn:intuitem:risk:req_node:gdpr:node1043
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-86
      description: Personal data in official documents held by a public authority
        or a public body or a private body for the performance of a task carried out
        in the public interest may be disclosed by the authority or body in accordance
        with Union or Member State law to which the public authority or body is subject
        in order to reconcile public access to official documents with the right to
        the protection of personal data pursuant to this Regulation.
      translations:
        sv:
          description: "Personuppgifter i allm\xE4nna handlingar som f\xF6rvaras av\
            \ en myndighet eller ett offentligt organ eller ett privat organ f\xF6\
            r utf\xF6rande av en uppgift av allm\xE4nt intresse f\xE5r l\xE4mnas ut\
            \ av myndigheten eller organet i enlighet med den unionsr\xE4tt eller\
            \ den medlemsstats nationella r\xE4tt som myndigheten eller det offentliga\
            \ organet omfattas av, f\xF6r att j\xE4mka samman allm\xE4nhetens r\xE4\
            tt att f\xE5 tillg\xE5ng till allm\xE4nna handlingar med r\xE4tten till\
            \ skydd av personuppgifter i enlighet med denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:article-87
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 87
      description: Processing of the national identification number
      translations:
        sv:
          name: Artikel 87
          description: Behandling av nationella identifikationsnummer
    - urn: urn:intuitem:risk:req_node:gdpr:node1045
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-87
      description: Member States may further determine the specific conditions for
        the processing of a national identification number or any other identifier
        of general application. In that case the national identification number or
        any other identifier of general application shall be used only under appropriate
        safeguards for the rights and freedoms of the data subject pursuant to this
        Regulation.
      annotation: Based on national legislation, consider the exceptions that have
        been implemented
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r n\xE4rmare best\xE4mma p\xE5 vilka\
            \ s\xE4rskilda villkor ett nationellt identifikationsnummer eller n\xE5\
            got annat vedertaget s\xE4tt f\xF6r identifiering f\xE5r behandlas. Ett\
            \ nationellt identifikationsnummer eller ett annat vedertaget s\xE4tt\
            \ f\xF6r identifiering ska i s\xE5dana fall endast anv\xE4ndas med iakttagande\
            \ av l\xE4mpliga skydds\xE5tg\xE4rder f\xF6r de registrerades r\xE4ttigheter\
            \ och friheter enligt denna f\xF6rordning."
          annotation: Based on national legislation, consider the exceptions that
            have been implemented
    - urn: urn:intuitem:risk:req_node:gdpr:article-88
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 88
      description: Processing in the context of employment
      translations:
        sv:
          name: Artikel 88
          description: "Behandling i anst\xE4llningsf\xF6rh\xE5llanden"
    - urn: urn:intuitem:risk:req_node:gdpr:88.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-88
      ref_id: '88.1'
      description: Member States may, by law or by collective agreements, provide
        for more specific rules to ensure the protection of the rights and freedoms
        in respect of the processing of employees' personal data in the employment
        context, in particular for the purposes of the recruitment, the performance
        of the contract of employment, including discharge of obligations laid down
        by law or by collective agreements, management, planning and organisation
        of work, equality and diversity in the workplace, health and safety at work,
        protection of employer's or customer's property and for the purposes of the
        exercise and enjoyment, on an individual or collective basis, of rights and
        benefits related to employment, and for the purpose of the termination of
        the employment relationship.
      annotation: Based on national legislation, consider the exceptions that have
        been implemented
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r i lag eller i kollektivavtal fastst\xE4\
            lla mer specifika regler f\xF6r att s\xE4kerst\xE4lla skyddet av r\xE4\
            ttigheter och friheter vid behandling av anst\xE4lldas personuppgifter\
            \ i\_anst\xE4llningsf\xF6rh\xE5llanden, s\xE4rskilt n\xE4r det g\xE4ller\
            \ rekrytering, genomf\xF6rande av anst\xE4llningsavtalet inklusive befrielse\
            \ fr\xE5n i lag eller kollektivavtal stadgade skyldigheter, ledning, planering\
            \ och organisering av arbetet, j\xE4mst\xE4lldhet och m\xE5ngfald i arbetslivet,\
            \ h\xE4lsa och s\xE4kerhet p\xE5 arbetsplatsen samt skydd av arbetsgivarens\
            \ eller kundens egendom men ocks\xE5 n\xE4r det g\xE4ller att s\xE5v\xE4\
            l kollektivt som individuellt ut\xF6va och komma i \xE5tnjutande av r\xE4\
            ttigheter och f\xF6rm\xE5ner som \xE4r knutna till anst\xE4llningen samt\
            \ att avsluta anst\xE4llningsf\xF6rh\xE5llandet."
          annotation: Based on national legislation, consider the exceptions that
            have been implemented
    - urn: urn:intuitem:risk:req_node:gdpr:88.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-88
      ref_id: '88.2'
      description: Those rules shall include suitable and specific measures to safeguard
        the data subject's human dignity, legitimate interests and fundamental rights,
        with particular regard to the transparency of processing, the transfer of
        personal data within a group of undertakings, or a group of enterprises engaged
        in a joint economic activity and monitoring systems at the work place.
      translations:
        sv:
          description: "Dessa regler ska inneh\xE5lla l\xE4mpliga och specifika \xE5\
            tg\xE4rder f\xF6r att skydda den registrerades m\xE4nskliga v\xE4rdighet,\
            \ ber\xE4ttigade intressen och grundl\xE4ggande r\xE4ttigheter, varvid\
            \ h\xE4nsyn s\xE4rskilt ska tas till insyn i behandlingen, \xF6verf\xF6\
            ring av personuppgifter inom en koncern eller en grupp av f\xF6retag som\
            \ deltar i gemensam ekonomisk verksamhet samt \xF6vervakningssystem p\xE5\
            \ arbetsplatsen."
    - urn: urn:intuitem:risk:req_node:gdpr:88.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-88
      ref_id: '88.3'
      description: Each Member State shall notify to the Commission those provisions
        of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without
        delay, any subsequent amendment affecting them.
      translations:
        sv:
          description: "Varje medlemsstat ska till kommissionen anm\xE4la de best\xE4\
            mmelser i sin lagstiftning som den antar i enlighet med punkt 1 senast\
            \ den 25 maj 2018, samt utan dr\xF6jsm\xE5l anm\xE4la eventuella senare\
            \ \xE4ndringar som ber\xF6r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:article-89
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 89
      description: Safeguards and derogations relating to processing for archiving
        purposes in the public interest, scientific or historical research purposes
        or statistical purposes
      translations:
        sv:
          name: Artikel 89
          description: "Skydds\xE5tg\xE4rder och undantag f\xF6r behandling f\xF6\
            r arkiv\xE4ndam\xE5l av allm\xE4nt intresse, vetenskapliga eller historiska\
            \ forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5l"
    - urn: urn:intuitem:risk:req_node:gdpr:89.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-89
      ref_id: '89.1'
      description: Processing for archiving purposes in the public interest, scientific
        or historical research purposes or statistical purposes, shall be subject
        to appropriate safeguards, in accordance with this Regulation, for the rights
        and freedoms of the data subject. Those safeguards shall ensure that technical
        and organisational measures are in place in particular in order to ensure
        respect for the principle of data minimisation. Those measures may include
        pseudonymisation provided that those purposes can be fulfilled in that manner.
        Where those purposes can be fulfilled by further processing which does not
        permit or no longer permits the identification of data subjects, those purposes
        shall be fulfilled in that manner.
      annotation: Based on national legislation, consider the exceptions that have
        been implemented
      translations:
        sv:
          description: "Behandling f\xF6r arkiv\xE4ndam\xE5l av allm\xE4nt intresse,\
            \ vetenskapliga eller historiska forsknings\xE4ndam\xE5l eller statistiska\
            \ \xE4ndam\xE5l ska omfattas av l\xE4mpliga skydds\xE5tg\xE4rder i\_enlighet\
            \ med denna f\xF6rordning f\xF6r den registrerades r\xE4ttigheter och\
            \ friheter. Skydds\xE5tg\xE4rderna ska s\xE4kerst\xE4lla att tekniska\
            \ och organisatoriska \xE5tg\xE4rder har inf\xF6rts f\xF6r att se till\
            \ att s\xE4rskilt principen om uppgiftsminimering iakttas. Dessa \xE5\
            tg\xE4rder f\xE5r inbegripa pseudonymisering, under f\xF6ruts\xE4ttning\
            \ att dessa \xE4ndam\xE5l kan uppfyllas p\xE5 det s\xE4ttet. N\xE4r dessa\
            \ \xE4ndam\xE5l kan uppfyllas genom vidare behandling av uppgifter som\
            \ inte medger eller inte l\xE4ngre medger identifiering av de registrerade\
            \ ska dessa \xE4ndam\xE5l uppfyllas p\xE5 det s\xE4ttet."
          annotation: Based on national legislation, consider the exceptions that
            have been implemented
    - urn: urn:intuitem:risk:req_node:gdpr:89.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-89
      ref_id: '89.2'
      description: Where personal data are processed for scientific or historical
        research purposes or statistical purposes, Union or Member State law may provide
        for derogations from the rights referred to in Articles 15, 16, 18 and 21
        subject to the conditions and safeguards referred to in paragraph 1 of this
        Article in so far as such rights are likely to render impossible or seriously
        impair the achievement of the specific purposes, and such derogations are
        necessary for the fulfilment of those purposes.
      translations:
        sv:
          description: "Om personuppgifter behandlas f\xF6r vetenskapliga eller historiska\
            \ forsknings\xE4ndam\xE5l eller statistiska \xE4ndam\xE5l f\xE5r det i\
            \ unionsr\xE4tten eller i medlemsstaternas nationella r\xE4tt f\xF6reskrivas\
            \ undantag fr\xE5n de r\xE4ttigheter som avses i artiklarna 15, 16, 18\
            \ och 21 med f\xF6rbeh\xE5ll f\xF6r de villkor och skydds\xE5tg\xE4rder\
            \ som avses i punkt 1 i den h\xE4r artikeln i den utstr\xE4ckning som\
            \ s\xE5dana r\xE4ttigheter sannolikt kommer att g\xF6ra det om\xF6jligt\
            \ eller mycket sv\xE5rare att uppfylla de s\xE4rskilda \xE4ndam\xE5len,\
            \ och s\xE5dana undantag kr\xE4vs f\xF6r att uppn\xE5 dessa \xE4ndam\xE5\
            l."
    - urn: urn:intuitem:risk:req_node:gdpr:89.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-89
      ref_id: '89.3'
      description: Where personal data are processed for archiving purposes in the
        public interest, Union or Member State law may provide for derogations from
        the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the
        conditions and safeguards referred to in paragraph 1 of this Article in so
        far as such rights are likely to render impossible or seriously impair the
        achievement of the specific purposes, and such derogations are necessary for
        the fulfilment of those purposes.
      translations:
        sv:
          description: "Om personuppgifter behandlas f\xF6r arkiv\xE4ndam\xE5l av\
            \ allm\xE4nt intresse f\xE5r det i\_unionsr\xE4tten eller i medlemsstaternas\
            \ nationella r\xE4tt f\xF6reskrivas om undantag fr\xE5n de r\xE4ttigheter\
            \ som avses i artiklarna 15, 16, 18, 19, 20 och 21 med f\xF6rbeh\xE5ll\
            \ f\xF6r de villkor och skydds\xE5tg\xE4rder som avses i punkt 1 i den\
            \ h\xE4r artikeln i den utstr\xE4ckning som s\xE5dana r\xE4ttigheter sannolikt\
            \ kommer att g\xF6ra det om\xF6jligt eller mycket sv\xE5rare att uppfylla\
            \ de s\xE4rskilda \xE4ndam\xE5len, och s\xE5dana undantag kr\xE4vs f\xF6\
            r att uppn\xE5 dessa \xE4ndam\xE5l"
    - urn: urn:intuitem:risk:req_node:gdpr:89.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-89
      ref_id: '89.4'
      description: Where processing referred to in paragraphs 2 and 3 serves at the
        same time another purpose, the derogations shall apply only to processing
        for the purposes referred to in those paragraphs.
      translations:
        sv:
          description: "Om behandling enligt punkterna 2 och 3 samtidigt har andra\
            \ \xE4ndam\xE5l, ska undantagen endast till\xE4mpas p\xE5 behandling f\xF6\
            r de \xE4ndam\xE5l som avses i dessa punkter."
    - urn: urn:intuitem:risk:req_node:gdpr:article-90
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 90
      description: Obligations of secrecy
      translations:
        sv:
          name: Artikel 90
          description: Tystnadsplikt
    - urn: urn:intuitem:risk:req_node:gdpr:90.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-90
      ref_id: '90.1'
      description: Member States may adopt specific rules to set out the powers of
        the supervisory authorities laid down in points (e) and (f) of Article 58(1)
        in relation to controllers or processors that are subject, under Union or
        Member State law or rules established by national competent bodies, to an
        obligation of professional secrecy or other equivalent obligations of secrecy
        where this is necessary and proportionate to reconcile the right of the protection
        of personal data with the obligation of secrecy. Those rules shall apply only
        with regard to personal data which the controller or processor has received
        as a result of or has obtained in an activity covered by that obligation of
        secrecy.
      translations:
        sv:
          description: "Medlemsstaterna f\xE5r anta s\xE4rskilda best\xE4mmelser f\xF6\
            r att fastst\xE4lla tillsynsmyndigheternas befogenheter enligt artikel\_\
            58.1 e och f gentemot personuppgiftsansvariga eller personuppgiftsbitr\xE4\
            den som enligt unionsr\xE4tten eller medlemsstaternas nationella r\xE4\
            tt eller best\xE4mmelser som fastst\xE4llts av beh\xF6riga nationella\
            \ organ omfattas av tystnadsplikt eller andra motsvarande former av f\xF6\
            rbud mot att l\xE4mna ut uppgifter, om det \xE4r n\xF6dv\xE4ndigt och\
            \ st\xE5r i proportion till vad som beh\xF6vs f\xF6r att f\xF6rena r\xE4\
            tten till skydd f\xF6r personuppgifter och tystnadsplikten. Dessa best\xE4\
            mmelser ska endast till\xE4mpas med avseende p\xE5 personuppgifter som\
            \ den personuppgiftsansvarige eller personuppgiftsbitr\xE4det har erh\xE5\
            llit i\_samband med en verksamhet som omfattas av denna tystnadsplikt."
    - urn: urn:intuitem:risk:req_node:gdpr:90.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-90
      ref_id: '90.2'
      description: Each Member State shall notify to the Commission the rules adopted
        pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent
        amendment affecting them.
      translations:
        sv:
          description: "Varje medlemsstat ska till kommissionen anm\xE4la de best\xE4\
            mmelser den har antagit i\_enlighet med punkt 1 senast den 25 maj 2018,\
            \ samt utan dr\xF6jsm\xE5l anm\xE4la eventuella \xE4ndringar som ber\xF6\
            r dem."
    - urn: urn:intuitem:risk:req_node:gdpr:article-91
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-ix
      ref_id: Article 91
      description: Existing data protection rules of churches and religious associations
      translations:
        sv:
          name: Artikel 91
          description: "Befintliga best\xE4mmelser om dataskydd inom kyrkor och religi\xF6\
            sa samfund"
    - urn: urn:intuitem:risk:req_node:gdpr:91.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-91
      ref_id: '91.1'
      description: Where in a Member State, churches and religious associations or
        communities apply, at the time of entry into force of this Regulation, comprehensive
        rules relating to the protection of natural persons with regard to processing,
        such rules may continue to apply, provided that they are brought into line
        with this Regulation.
      translations:
        sv:
          description: "Om kyrkor och religi\xF6sa samfund eller gemenskaper i en\
            \ medlemsstat vid tidpunkten f\xF6r ikrafttr\xE4dandet av denna f\xF6\
            rordning till\xE4mpar \xF6vergripande best\xE4mmelser om skyddet av fysiska\
            \ personer i samband med behandling, f\xE5r s\xE5dana befintliga best\xE4\
            mmelser forts\xE4tta att till\xE4mpas under f\xF6ruts\xE4ttning att de\
            \ g\xF6rs f\xF6renliga med denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:91.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-91
      ref_id: '91.2'
      description: Churches and religious associations which apply comprehensive rules
        in accordance with paragraph 1 of this Article shall be subject to the supervision
        of an independent supervisory authority, which may be specific, provided that
        it fulfils the conditions laid down in Chapter VI of this Regulation.
      translations:
        sv:
          description: "Kyrkor och religi\xF6sa samfund som till\xE4mpar \xF6vergripande\
            \ best\xE4mmelser i enlighet med punkt 1 i denna artikel ska vara f\xF6\
            rem\xE5l f\xF6r kontroll av en oberoende tillsynsmyndighet som kan vara\
            \ specifik, f\xF6rutsatt att den uppfyller de villkor som fastst\xE4lls\
            \ i kapitel VI i denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-x
      assessable: false
      depth: 1
      ref_id: CHAPTER X
      description: Delegated acts and implementing acts
      translations:
        sv:
          name: KAPITEL X
          description: "Delegerade akter och genomf\xF6randeakter"
    - urn: urn:intuitem:risk:req_node:gdpr:article-92
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-x
      ref_id: Article 92
      description: Exercise of the delegation
      translations:
        sv:
          name: Artikel 92
          description: "Ut\xF6vande av delegeringen"
    - urn: urn:intuitem:risk:req_node:gdpr:92.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-92
      ref_id: '92.1'
      description: The power to adopt delegated acts is conferred on the Commission
        subject to the conditions laid down in this Article.
      translations:
        sv:
          description: "Befogenheten att anta delegerade akter ges till kommissionen\
            \ med f\xF6rbeh\xE5ll f\xF6r de villkor som anges i denna artikel."
    - urn: urn:intuitem:risk:req_node:gdpr:92.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-92
      ref_id: '92.2'
      description: The delegation of power referred to in Article 12(8) and Article
        43(8) shall be conferred on the Commission for an indeterminate period of
        time from 24 May 2016.
      translations:
        sv:
          description: "Den befogenhet att anta delegerade akter som avses i artikel\
            \ 12.8 och artikel 43.8 ska ges till kommissionen tills vidare fr\xE5\
            n och med den 24 maj 2016."
    - urn: urn:intuitem:risk:req_node:gdpr:92.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-92
      ref_id: '92.3'
      description: The delegation of power referred to in Article 12(8) and Article
        43(8) may be revoked at any time by the European Parliament or by the Council.
        A decision of revocation shall put an end to the delegation of power specified
        in that decision. It shall take effect the day following that of its publication
        in the Official Journal of the European Union or at a later date specified
        therein. It shall not affect the validity of any delegated acts already in
        force.
      translations:
        sv:
          description: "Den delegering av befogenhet som avses i artikel 12.8 och\
            \ artikel 43.8 f\xE5r n\xE4r som helst \xE5terkallas av Europaparlamentet\
            \ eller r\xE5det. Ett beslut om \xE5terkallelse inneb\xE4r att delegeringen\
            \ av den befogenhet som anges i beslutet upph\xF6r att g\xE4lla. Beslutet\
            \ f\xE5r verkan dagen efter det att det offentligg\xF6rs i\_Europeiska\
            \ unionens officiella tidning, eller vid ett senare i beslutet angivet\
            \ datum. Det p\xE5verkar inte giltigheten av delegerade akter som redan\
            \ har tr\xE4tt i kraft."
    - urn: urn:intuitem:risk:req_node:gdpr:92.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-92
      ref_id: '92.4'
      description: As soon as it adopts a delegated act, the Commission shall notify
        it simultaneously to the European Parliament and to the Council.
      translations:
        sv:
          description: "S\xE5 snart kommissionen antar en delegerad akt ska den samtidigt\
            \ delge Europaparlamentet och r\xE5det denna."
    - urn: urn:intuitem:risk:req_node:gdpr:92.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-92
      ref_id: '92.5'
      description: A delegated act adopted pursuant to Article 12(8) and Article 43(8)
        shall enter into force only if no objection has been expressed by either the
        European Parliament or the Council within a period of three months of notification
        of that act to the European Parliament and the Council or if, before the expiry
        of that period, the European Parliament and the Council have both informed
        the Commission that they will not object. That period shall be extended by
        three months at the initiative of the European Parliament or of the Council.
      translations:
        sv:
          description: "En delegerad akt som antas enligt artikel 12.8 och artikel\
            \ 43.8 ska tr\xE4da i kraft endast om varken Europaparlamentet eller r\xE5\
            det har gjort inv\xE4ndningar mot den delegerade akten inom en period\
            \ av tre\_m\xE5nader fr\xE5n den dag d\xE5 akten delgavs Europaparlamentet\
            \ och r\xE5det, eller om b\xE5de Europaparlamentet och r\xE5det, f\xF6\
            re utg\xE5ngen av den perioden, har underr\xE4ttat kommissionen om att\
            \ de inte kommer att inv\xE4nda. Denna period ska f\xF6rl\xE4ngas med\
            \ tre m\xE5nader p\xE5 Europaparlamentets eller r\xE5dets initiativ."
    - urn: urn:intuitem:risk:req_node:gdpr:article-93
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-x
      ref_id: Article 93
      description: Committee procedure
      translations:
        sv:
          name: Artikel 93
          description: "Kommitt\xE9f\xF6rfarande"
    - urn: urn:intuitem:risk:req_node:gdpr:93.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-93
      ref_id: '93.1'
      description: The Commission shall be assisted by a committee. That committee
        shall be a committee within the meaning of Regulation (EU) No 182/2011.
      translations:
        sv:
          description: "Kommissionen ska bitr\xE4das av en kommitt\xE9. Denna kommitt\xE9\
            \ ska vara en kommitt\xE9 i den mening som avses i f\xF6rordning\_(EU)\
            \ nr\_182/2011."
    - urn: urn:intuitem:risk:req_node:gdpr:93.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-93
      ref_id: '93.2'
      description: Where reference is made to this paragraph, Article 5 of Regulation
        (EU) No 182/2011 shall apply.
      translations:
        sv:
          description: "N\xE4r det h\xE4nvisas till denna punkt ska artikel\_5 i f\xF6\
            rordning\_(EU) nr\_182/2011 till\xE4mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:93.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-93
      ref_id: '93.3'
      description: Where reference is made to this paragraph, Article 8 of Regulation
        (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.
      translations:
        sv:
          description: "N\xE4r det h\xE4nvisas till denna punkt ska artikel\_8 i f\xF6\
            rordning\_(EU) nr\_182/2011, j\xE4mf\xF6rd med artikel 5 i samma f\xF6\
            rordning, till\xE4mpas."
    - urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      assessable: false
      depth: 1
      ref_id: CHAPTER XI
      description: Final provisions
      translations:
        sv:
          name: KAPITEL XI
          description: "Slutbest\xE4mmelser"
    - urn: urn:intuitem:risk:req_node:gdpr:article-94
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 94
      description: Repeal of Directive 95/46/EC
      translations:
        sv:
          name: Artikel 94
          description: "Upph\xE4vande av direktiv 95/46/EG"
    - urn: urn:intuitem:risk:req_node:gdpr:94.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-94
      ref_id: '94.1'
      description: Directive 95/46/EC is repealed with effect from 25 May 2018.
      translations:
        sv:
          description: "Direktiv 95/46/EG ska upph\xF6ra att g\xE4lla med verkan fr\xE5\
            n och med den 25 maj 2018."
    - urn: urn:intuitem:risk:req_node:gdpr:94.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-94
      ref_id: '94.2'
      description: References to the repealed Directive shall be construed as references
        to this Regulation. References to the Working Party on the Protection of Individuals
        with regard to the Processing of Personal Data established by Article 29 of
        Directive 95/46/EC shall be construed as references to the European Data Protection
        Board established by this Regulation.
      translations:
        sv:
          description: "H\xE4nvisningar till det upph\xE4vda direktivet ska anses\
            \ som h\xE4nvisningar till denna f\xF6rordning. H\xE4nvisningar till arbetsgruppen\
            \ f\xF6r skydd av enskilda med avseende p\xE5 behandlingen av personuppgifter,\
            \ som inr\xE4ttades genom artikel\_29 i direktiv 95/46/EG, ska anses som\
            \ h\xE4nvisningar till Europeiska dataskyddsstyrelsen, som inr\xE4ttas\
            \ genom denna f\xF6rordning."
    - urn: urn:intuitem:risk:req_node:gdpr:article-95
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 95
      description: Relationship with Directive 2002/58/EC
      translations:
        sv:
          name: Artikel 95
          description: "F\xF6rh\xE5llande till direktiv 2002/58/EG"
    - urn: urn:intuitem:risk:req_node:gdpr:node1077
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-95
      description: This Regulation shall not impose additional obligations on natural
        or legal persons in relation to processing in connection with the provision
        of publicly available electronic communications services in public communication
        networks in the Union in relation to matters for which they are subject to
        specific obligations with the same objective set out in Directive 2002/58/EC.
      translations:
        sv:
          description: "Denna f\xF6rordning ska inte inneb\xE4ra n\xE5gra ytterligare\
            \ f\xF6rpliktelser f\xF6r fysiska eller juridiska personer som behandlar\
            \ personuppgifter inom ramen f\xF6r tillhandah\xE5llande av allm\xE4nt\
            \ tillg\xE4ngliga elektroniska kommunikationstj\xE4nster i allm\xE4nna\
            \ kommunikationsn\xE4t i unionen, n\xE4r det g\xE4ller omr\xE5den inom\
            \ vilka de redan omfattas av s\xE4rskilda skyldigheter f\xF6r samma \xE4\
            ndam\xE5l i enlighet med direktiv 2002/58/EG."
    - urn: urn:intuitem:risk:req_node:gdpr:article-96
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 96
      description: Relationship with previously concluded Agreements
      translations:
        sv:
          name: Artikel 96
          description: "F\xF6rh\xE5llande till tidigare ing\xE5ngna avtal"
    - urn: urn:intuitem:risk:req_node:gdpr:node1079
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-96
      description: International agreements involving the transfer of personal data
        to third countries or international organisations which were concluded by
        Member States prior to 24 May 2016, and which comply with Union law as applicable
        prior to that date, shall remain in force until amended, replaced or revoked.
      translations:
        sv:
          description: "De internationella avtal som r\xF6r \xF6verf\xF6ring av personuppgifter\
            \ till tredjel\xE4nder eller internationella organisationer som ingicks\
            \ av medlemsstaterna f\xF6re den 24 maj 2016 och som \xE4r f\xF6renliga\
            \ med unionsr\xE4tten i dess lydelse innan detta datum, ska forts\xE4\
            tta att g\xE4lla tills de \xE4ndras, ers\xE4tts eller \xE5terkallas."
    - urn: urn:intuitem:risk:req_node:gdpr:article-97
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 97
      description: Commission reports
      translations:
        sv:
          name: Artikel 97
          description: Kommissionsrapporter
    - urn: urn:intuitem:risk:req_node:gdpr:97.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-97
      ref_id: '97.1'
      description: By 25 May 2020 and every four years thereafter, the Commission
        shall submit a report on the evaluation and review of this Regulation to the
        European Parliament and to the Council. The reports shall be made public.
      translations:
        sv:
          description: "Senast den 25 maj 2020 och d\xE4refter vart fj\xE4rde \xE5\
            r ska kommissionen \xF6verl\xE4mna en rapport om till\xE4mpningen och\
            \ \xF6versynen av denna f\xF6rordning till Europaparlamentet och r\xE5\
            det."
    - urn: urn:intuitem:risk:req_node:gdpr:97.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-97
      ref_id: '97.2'
      description: 'In the context of the evaluations and reviews referred to in paragraph
        1, the Commission shall examine, in particular, the application and functioning
        of:'
      translations:
        sv:
          description: "Inom ramen f\xF6r de utv\xE4rderingar och \xF6versyner som\
            \ avses i punkt 1 ska kommissionen s\xE4rskilt unders\xF6ka hur f\xF6\
            ljande best\xE4mmelser till\xE4mpas och fungerar:"
    - urn: urn:intuitem:risk:req_node:gdpr:97.2.a
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:97.2
      ref_id: 97.2.a
      description: Chapter V on the transfer of personal data to third countries or
        international organisations with particular regard to decisions adopted pursuant
        to Article 45(3) of this Regulation and decisions adopted on the basis of
        Article 25(6) of Directive 95/46/EC;
      translations:
        sv:
          description: "Kapitel V om \xF6verf\xF6ring av personuppgifter till tredjel\xE4\
            nder och internationella organisationer, s\xE4rskilt n\xE4r det g\xE4\
            ller beslut som antagits enligt artikel 45.3 i den h\xE4r f\xF6rordningen\
            \ och beslut som antagits p\xE5 grundval av artikel 25.6 i direktiv 95/46/EG."
    - urn: urn:intuitem:risk:req_node:gdpr:97.2.b
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:gdpr:97.2
      ref_id: 97.2.b
      description: Chapter VII on cooperation and consistency.
      translations:
        sv:
          description: Kapitel VII om samarbete och enhetlighet.
    - urn: urn:intuitem:risk:req_node:gdpr:97.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-97
      ref_id: '97.3'
      description: For the purpose of paragraph 1, the Commission may request information
        from Member States and supervisory authorities.
      translations:
        sv:
          description: "Med avseende p\xE5 till\xE4mpningen av punkt 1 f\xE5r kommissionen\
            \ beg\xE4ra information fr\xE5n medlemsstaterna och tillsynsmyndigheterna."
    - urn: urn:intuitem:risk:req_node:gdpr:97.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-97
      ref_id: '97.4'
      description: In carrying out the evaluations and reviews referred to in paragraphs
        1 and 2, the Commission shall take into account the positions and findings
        of the European Parliament, of the Council, and of other relevant bodies or
        sources.
      translations:
        sv:
          description: "Kommissionen ska n\xE4r den utf\xF6r de utv\xE4rderingar och\
            \ \xF6versyner som avses i punkterna 1 och 2 ta h\xE4nsyn till st\xE5\
            ndpunkter och slutsatser fr\xE5n Europaparlamentet, r\xE5det och andra\
            \ relevanta organ och k\xE4llor."
    - urn: urn:intuitem:risk:req_node:gdpr:97.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-97
      ref_id: '97.5'
      description: The Commission shall, if necessary, submit appropriate proposals
        to amend this Regulation, in particular taking into account of developments
        in information technology and in the light of the state of progress in the
        information society.
      translations:
        sv:
          description: "Kommissionen ska om n\xF6dv\xE4ndigt \xF6verl\xE4mna l\xE4\
            mpliga f\xF6rslag om \xE4ndring av denna f\xF6rordning, med s\xE4rskild\
            \ h\xE4nsyn till informationsteknikens utveckling och mot bakgrund av\
            \ tendenserna inom informationssamh\xE4llet."
    - urn: urn:intuitem:risk:req_node:gdpr:article-98
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 98
      description: Review of other Union legal acts on data protection
      translations:
        sv:
          name: Artikel 98
          description: "\xD6versyn av andra unionsr\xE4ttsakter om dataskydd"
    - urn: urn:intuitem:risk:req_node:gdpr:node1089
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-98
      description: The Commission shall, if appropriate, submit legislative proposals
        with a view to amending other Union legal acts on the protection of personal
        data, in order to ensure uniform and consistent protection of natural persons
        with regard to processing. This shall in particular concern the rules relating
        to the protection of natural persons with regard to processing by Union institutions,
        bodies, offices and agencies and on the free movement of such data.
      translations:
        sv:
          description: "Kommissionen ska, om s\xE5 \xE4r l\xE4mpligt, l\xE4gga fram\
            \ lagstiftningsf\xF6rslag i syfte att \xE4ndra andra unionsr\xE4ttsakter\
            \ om skydd av personuppgifter, f\xF6r att s\xE4kerst\xE4lla ett enhetligt\
            \ och konsekvent skydd f\xF6r fysiska personer med avseende p\xE5 behandling.\
            \ Detta g\xE4ller i synnerhet best\xE4mmelserna om skyddet f\xF6r fysiska\
            \ personer i samband med behandling som utf\xF6rs av unionens institutioner,\
            \ organ och byr\xE5er samt om det fria fl\xF6det av s\xE5dana uppgifter."
    - urn: urn:intuitem:risk:req_node:gdpr:article-99
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:gdpr:chapter-xi
      ref_id: Article 99
      description: Entry into force and application
      translations:
        sv:
          name: Artikel 99
          description: "Ikrafttr\xE4dande och till\xE4mpning"
    - urn: urn:intuitem:risk:req_node:gdpr:99.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-99
      ref_id: '99.1'
      description: This Regulation shall enter into force on the twentieth day following
        that of its publication in the Official Journal of the European Union.
      translations:
        sv:
          description: "Denna f\xF6rordning tr\xE4der i kraft den tjugonde dagen efter\
            \ det att den har offentliggjorts i\_Europeiska unionens officiella tidning."
    - urn: urn:intuitem:risk:req_node:gdpr:99.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-99
      ref_id: '99.2'
      description: It shall apply from 25 May 2018.
      translations:
        sv:
          description: "Den ska till\xE4mpas fr\xE5n och med den 25 maj 2018."
    - urn: urn:intuitem:risk:req_node:gdpr:node1093
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:gdpr:article-99
      description: This Regulation shall be binding in its entirety and directly applicable
        in all Member States.
      translations:
        sv:
          description: "Denna f\xF6rordning \xE4r till alla delar bindande och direkt\
            \ till\xE4mplig i alla medlemsstater."
