MONA is a platform for accessing microdata. The purpose of MONA is to offer a secure solution in which the recipient can process the data released for research or statistical purposes, following a confidentiality assessment pursuant to the Public Access to Information and Secrecy Act.

When Statistics Sweden has released microdata, the recipient will then be responsible for the data, irrespective of whether the data was released in MONA or in some other way. “Recipient” means the organisation to which the data was released.

Data is released to separate storage areas, known as MONA projects. The recipient is responsible for these MONA projects and the data they contain.

The recipient may supplement Statistics Sweden’s delivery of data with other microdata or information needed for the purpose for which Statistics Sweden made the delivery. This could be the user’s own information, or information from other authorities, programming code or statistics.

Recipients are responsible for their data in MONA. This includes everything that has been delivered to their MONA projects and everything that they have created themselves. Following delivery, Statistics Sweden manages the information in MONA projects only as part of technical processing or technical storage pursuant to Chapter 2, Section 13 of the freedom of the Press Act.

This means that information in MONA projects will be public documents at the recipient in cases where the latter is a public authority or an organisation subject to the same regulations (for example Jönköping University and Chalmers University of Technology). In that case, the recipient is also responsible for archiving or discarding the information. Furthermore, the information is subject to the confidentiality provisions applying to the recipient, normally Chapter 24, Section 8 or Chapter 11, Section 3 of the Public Access to Information and Secrecy Act.

Information may also have been released pursuant to a secrecy clause, which regulates the date on which the information must be destroyed.

Under the General Data Protection Regulation (GDPR), the recipient is the personal data controller for the personal data that they process, while Statistics Sweden is a personal data processor through its provision of storage areas in MONA. Statistics Sweden is only the personal data controller for the personal data processed as part of the technical aspect of providing the storage area, for example information about users.

A personal data processing agreement (PDP agreement) regarding the personal data in MONA must be signed between Statistics Sweden and the recipient. Statistics Sweden provides a standard PDP agreement. The agreement must be signed by an authorised person. Any PDP agreement signed before 25 May 2018, when the GDPR came into effect, must be replaced.