Riksrevisionen

Risks are present, especially in the Swedish Migration Agency’s processing of asylum cases , because Sweden’s international commitments to provide protection to people means that identity or – depending on the nature of the grounds for protection – nationality, only needs to be made probable. The fact that identity documents are usually absent poses a risk of failure to establish correct identity.

(…) agencies’ processes [do not] ensure that the identity data in the population registration database will be accurate and unique. Firstly, deficiencies at the Swedish Migration Agency affect the decisions of the Swedish Tax Agency. This is because, for individuals who have been granted a residence permit in Sweden, the Swedish Migration Agency’s identity assessment serves as a basis for the identity established by the Swedish Tax Agency.

The agencies do not have sufficient access to skills to ensure accurately establishing identity . It is important that the agencies ensure that staff working with examining documents be given both training and the possibility of working on this task to a sufficient extent, enabling them to both acquire and maintain adequate skills. (…) The international comparison of the audit shows that Denmark and Norway have introduced special identity centres, which serve as national expert bodies for identity issues.

The audit shows that the agencies are in need of further possibilities to store, share and perform searches on biometric information to reduce the risk of errors in establishing identity. The Government has also taken and initiated a number of measures that, combined, aim to improve these possibilities. At the same time, there are clear limitations ensuing from international law on the extent to which it is feasible to extend the possibilities of storing, sharing and performing searches on biometric information. In addition, improving possibilities for more systematic collection of biometrics could increase the risk of data being disseminated to unauthorised parties, for example in the event of hacker attacks. It is therefore important that account be taken of such limitations and risks in any changes to the regulatory framework.