All SLOSH data are covered by statistical confidentiality according to Chapter 24, Section 8 of the Public Access to Information and Secrecy Act (OSL). Almost all SLOSH data are personal data, and large parts constitute so-called sensitive personal data according to the General Data Protection Regulation (GDPR). In Sweden, research is further regulated by the Ethical Review Act and, as personal data is involved, the information is also subject to confidentiality under Chapter 21, Section 7 of the OSL. We have a legal obligation to examine all potential disclosures against the requirements of these laws.

Statistical confidentiality (Chapter 24, Section 8 OSL) normally means that data cannot be disclosed at all. Exceptions are made in certain special cases, most importantly research and statistical purposes. In addition, according to this Section, information may only be disclosed “if it is clear that the information can be disclosed without causing damage or harm to the individual or someone close to them”, a very strict requirement.

Confidentiality of personal data (Chapter 21, Section 7 OSL) means that any data which, upon disclosure, can be assumed to be processed in violation of the GDPR or the Ethical Review Act, may also not be disclosed. Under the GDPR, data processing must have a defined purpose and a lawful ground, and the amount of data used must be minimised. This means that we must ensure that data will be processed in accordance with these principles before any disclosure. Disclosure for research purposes can therefore only take place when specifically authorised under the Ethical Review Act. For research carried out abroad, equivalent authorisation/safety measures are required from the country concerned. This also means that, normally, we cannot disclose data for student work, unless such work is part of an ethically approved research project.

As stated above, we are obliged to apply data minimisation pursuant to the GDPR, which includes limiting as much as possible the risks of sensitive personal data disclosure or, in the event of disclosure, any damage. Our policy is therefore to disclose only data necessary for a specific research study, which is defined as what is normally published in an article in a scientific journal. This satisfies the requirement to minimise data disclosure while also reducing the risk that multiple researchers carry out simultaneous identical or overlapping analyses. Furthermore, this policy encourages good research practice by specifying the design before analyses are carried out, minimises the risk of data dredging and preserves untouched data for hypothesis testing by other researchers.*

All disclosed variables, as well as the sampling of individuals, must therefore be justified by the research question at hand and be covered by ethical authorisations. It is preferable to request a smaller number of variables to start with, and to supplement these variables later if one or more additional variables are needed. For additional variables without complications, no fee is charged.

Research projects including several questions, with results to be presented in separate articles, book chapters, etc., can require making requests for several separate datasets. Confidentiality and risk minimisation once again require that these datasets be assigned different ID number series to prevent multiple datasets from being combined in a way that risks compromising privacy. However, additional variables needed for the same publication are delivered with the same ID number so that they can be linked to the previously received dataset.

Data are always provided in pseudonymised form, i.e., no variables can be used directly identify individuals. However, variables are not de-identified, as code keys within our organisation and at Statistics Sweden enable data to be linked to individuals for future data collection and register updates. Please note that any attempt to identify individual persons in the material, so-called reverse identification, is illegal according to Section 6 of the Act regarding official statistics (2001:99) and entails criminal liability under Section 26. This provision applies to the production of statistics by statistical authorities as well as to the general public. No data or results may ever be reported where responses or personal circumstances can be connected to individuals. 

In addition to the above, we must also ensure that the protection afforded by statistical confidentiality under Chapter 24, Section 8 OSL remains with the data recipient, as it is otherwise unclear whether information can be disclosed without risking damage or harm. This protection also entails criminally liability for public officials disclosing information without authorisation. If the recipient is a Swedish government agency, e.g., a public-sector higher education institution, this protection is ensured in practically all cases. The same confidentiality protection that applies at Stockholm University is simply transferred to the recipient institution. The same criminal liability also applies to employees at the recipient authority.

This confidentiality cannot be transferred to recipients who are outside of the Swedish public sector, which brings about a risk of damage or harm. In such cases, we therefore generally need to draw up a proviso entailing, among other things, that the data will be disclosed to one named person, rather than an organisation. In this way, the recipient is criminally liable in a way similar to the liability of civil servants as stated above. A secure technical solution is also required, and the simplest way to ensure this is for recipients to perform the analyses on SLOSH group computers on-site at Stockholm University, as this eliminates the risk of data ending up on unauthorised servers or unencrypted data media. Disclosure outside the public sector requires a decision by Stockholm University’s general counsel.

Disclosure of personal data from SLOSH to recipients outside Sweden is very complicated, as the relevant confidentiality cannot be transferred. This makes it impossible to formulate a valid proviso to ensure confidentiality. Data protected by statistical confidentiality, for which the mere loss of that protection poses a risk of harm, can therefore only be disclosed abroad if they are inherently harmless and can always be freely disseminated. Data minimisation to prevent disclosure is particularly critical in such cases. Recipients of disclosed personal data must also be subject to the EU General Data Protection Regulation or equivalent protection.

However, analytical results, unlike raw data, can usually be delivered to foreign (as well as domestic) researchers, although the risk of disclosure of personal data must be eliminated in these cases as well. The latter means, among other things, that we cannot disclose statistics pertaining to small groups of people (which, however, is very rarely relevant in the type of research conducted at SLOSH). Further, under certain conditions, affiliated foreign researchers can often carry out analyses themselves on our premises after signing a confidentiality agreement.

The following is a description of the conditions which apply to all users of SLOSH. Special conditions also apply depending on whether users are a part of SU.

SLOSH data and/or results must be used in accordance with good research practice, in compliance with applicable legislation and with respect for the integrity of subjects. We recommend that users read the Swedish Research Council’s report Good Research Practice, ISBN 978-91-7307-352-3: https://www.vr.se/english/analysis/reports/our-reports/2017-08-31-good-research-practice.html

All published studies based on SLOSH must indicate this by including the following text in the Acknowledgements or equivalent section.

In Swedish: “I detta arbete användes data från SLOSH som ingår i REWHARD-konsortiet, vilket stöds av Vetenskapsrådet (dnr 2021-00154).”

In English: “This work utilised data from SLOSH, which is part of the REWHARD consortium supported by the Swedish Research Council (VR #2021-00154).”

Someone familiar with SLOSH should be involved in the research project, in order to explain how data have been collected and how they can best be used. If you do not already have such a contact, contact us at data@slosh.se for advice.

It is also important that SLOSH receives information regarding the publication of results, since we will report on the contributions to research findings made by SLOSH and REWHARD. Please inform us of new publications at data@slosh.se no later than January of the year following publication.

To grant an overview of ongoing studies and reduce the risk that multiple researchers conduct simultaneous overlapping analyses, to their mutual detriment, we must be informed of the purposes and the period for which SLOSH data are used by recipients.

Any data and results disclosed should therefore be used and published within three years of their receipt, after which time any data files and copies thereof should be deleted from the recipient's computers and servers, without prejudice to possible archiving under the Archives Act. This is in line with the GDPR principle of storage minimisation, which requires personal data to be deleted when it is no longer needed for its purpose.

Any researcher wishing to use data or results beyond three years can request an extension from data@slosh.se. Use for purposes other than those specified in the original data application should not occur, and researchers wishing to use SLOSH data for a new purpose must submit a new data request to SU.

The SLOSH group retains and archives copies of released data and results, in accordance with the Archives Act, ensuring that legal and research ethics requirements for data retention are met for, e.g., replication and verification in case of suspected research misconduct.

When disclosing data to other Swedish government agencies, including higher education institutions, responsibility for the disclosed personal data is transferred to the recipient, and the data become a public document at the recipient authority with the ensuing responsibility for confidentiality. Please note that the recipient authority’s procedures for protection of sensitive personal and confidential data must be adhered to, which includes storing the provided data, work files and derivative files containing personal data in a way that ensures protection against unauthorised access. Under no circumstances may data be sent by e-mail or over open networks. In order to safeguard the rights of data subjects (research subjects) under the General Data Protection Regulation (Article 15-21), public authorities must also ensure control over the location of data.

When disclosing data to users outside of Swedish government agencies, additional restrictions may be imposed in order to ensure confidentiality and lawful processing of personal data following disclosure.

If a researcher or journal wishes to make the data available, we recommend doing so by depositing and archiving the final data file, with the precise variables (original or processed) used, at Stockholm University with the help of the SLOSH group. Anyone wishing to access these data will be granted access by SU, provided it is legally possible. In such cases, we recommend publishing the following text in the relevant article, replacing xxxx with the number of the project’s approved application received by us:

"Given restrictions from the ethical review board and considering that sensitive personal data are involved, it is not possible to make the data freely available. Access to the data may be provided to other researchers in line with Swedish law and after consultation with the Stockholm University legal department. Requests for data, stored at the Stress Research Institute, Department of Psychology, should be sent to registrator@su.se with reference to the SLOSH substudy # xxxx or directly to the corresponding author."

In order to safeguard the rights of data subjects (research subjects) under the General Data Protection Regulation (Article 15-21), we must know where SLOSH data are located within the University and the identity of the contact person. We also need an overview of ongoing studies, to reduce the risk that multiple researchers conduct simultaneous overlapping analyses, to their mutual detriment.

Data and results made available to researchers at SU must therefore be used and published within three years of their receipt, after which any data files and copies thereof must be deleted from the recipient's computers and servers. This is in line with the GDPR principle of storage minimisation, which requires personal data to be deleted when it is no longer needed for its purpose.

Researchers wishing to use data or results beyond three years can request an extension of this time limit from data@slosh.se, and authorisation will be granted by email. Use for purposes other than those specified in the original data application is not permitted, and researchers wishing to use SLOSH data for a new purpose must submit a new data request.

The SLOSH group retains and archives copies of released data and results, in accordance with the Archives Act, ensuring that legal and research ethics requirements for data retention are met for, e.g., replication and verification in case of suspected research misconduct.

The recipient undertakes to ensure that data made available, as well as work files and derivative files containing personal data, are stored in a way that is traceable and prevents unauthorised access. In concrete terms, this means limiting the number of copies and that data are only stored on servers, computers or data media belonging to or approved by SU as well as being encrypted and password-protected to restrict access to authorised researchers. Under no circumstances may data be sent by e-mail or over open networks. Only SU employees requiring access to the data to perform analyses within the framework of the project are considered authorised. Employees should be informed of their responsibilities in a similar way to those newly employed by the SLOSH group (see linked document).

If a researcher or journal wishes to make the data available, this must be done by depositing and archiving the final data file, with the precise variables (original or processed) used, at Stockholm University with the help of the SLOSH group. Anyone wishing to access these data will be granted access by SU, provided it is legally possible. In such cases, we recommend publishing the following text in the relevant article, replacing xxxx with the number of the project’s approved application received by us:

"Given restrictions from the ethical review board and considering that sensitive personal data are involved, it is not possible to make the data freely available. Access to the data may be provided to other researchers in line with Swedish law and after consultation with the Stockholm University legal department. Requests for data, stored at the Stress Research Institute, Department of Psychology, should be sent to registrator@su.se with reference to the SLOSH substudy # xxxx or directly to the corresponding author."