Use Swedish personal identity numbers only when clearly justified

Region

Sweden (SE). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Chapter 3 section 10 of the Swedish data protection act, lag (2018:218), sets this test. A number is often justified for credit checks, salary and tax reporting, or signing in with a national e-ID. It is rarely justified as a plain customer ID or a newsletter field. Never use it as a key in addresses, logs or exports, and mask it on screens to the birth date. Flag its column as sensitive in the data map, and encrypt it as field encryption shows. The supervisory authority, IMY, checks this in its audits.

Examples

JavaScript example

const SWEDISH_PERSONAL_NUMBER = /\b(19|20)?\d{6}[-+]?\d{4}\b/;
export const leaksPersonalNumber = line => SWEDISH_PERSONAL_NUMBER.test(line);

Python example

import re

SWEDISH_PERSONAL_NUMBER = re.compile(r"\b(19|20)?\d{6}[-+]?\d{4}\b")

def leaks_personal_number(line: str) -> bool:
    return bool(SWEDISH_PERSONAL_NUMBER.search(line))

How to check

A schema scan finds every column whose values match the pattern of a Swedish personal number. Each one has a recorded reason in the data map. A log scan of the last 7 days finds no full personal number.

Sources

• Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, chapter 3 section 10
• GDPR Article 87 on national identification numbers

Related rules

• CMP-7 Map every store that holds personal data in Compliance and governance
• APS-58 Encrypt the most sensitive fields in Application security