SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
Hellström Advokatbyrå KB Kungsgatan 33 XV Floor S-111 57 Stockholm Sweden Tel: +46 8 22 09 00
Email: info@hellstromlaw.com Web: www.hellstromlaw.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Primary Legal Sources Sweden’s data protection regime is built on the GDPR (Regulation (EU) 2016/679), which sets the core rules for processing personal data and is directly applicable in Sweden. The Swedish Data Protection Act ( lagen (2018:218) med kompletterande bestämmelser till EU:s datasky- ddsförordning ) complements the GDPR by providing national rules permitted under the Regulation. Ordinance (2018:219) with supplementary provisions to the EU Data Protection Regulation ( förordning (2018:219) med kompletterande bestämmelser till EU:s dataskyddsförordning ) complements the Swed - ish Data Protection Act, providing more specific regu - lations. Chapter 2, section 6, second paragraph, of the Swedish Constitution ( regeringsformen (1974:152) ) stipulates that everyone is protected against signifi - cant infringements of personal privacy by the public authorities if this occurs without consent and involves surveillance or mapping of the individual’s personal circumstances. The European Convention on Human Rights ( europeiska konventionen om skydd för de mänskliga rättigheterna (lag (1994:1219) om den europeiska konventionen angående skydd för de män- skliga rättigheterna och de grundläggande friheterna) , EKMR), and the Charter of Fundamental Rights of the
European Union ( Europeiska unionens stadga om de grundläggande rättigheterna) (EU:s rättighetsstadga) ). Furthermore, data protection-related questions are found in the Fundamental Law on Freedom of Expres - sion ( yttrandefrihetsgrundlagen (1991:1469) , YGL), and the Public Access to Information and Secrecy Act ( offentlighets- och sekretesslagen (2009:400) , OSL), when it relates to the balancing act between freedom of speech and personal integrity. Sectorial Laws For criminal matters, the relevant law is the Law Enforcement Data Act ( brottsdatalagen (2018:1177) ). There are specific laws for surveillance through cam - eras (the Camera Surveillance Act ( kamerabevakning- slag (2018:1200) ), and processing of personal data for credit scoring (the Credit Information Act ( kreditup- plysningslag (1973:1173) ). For the health sector the Patient Data Act ( patientda- talagen (2008:355) ) supplements the GDPR. Furthermore, several governmental agencies have their own data protection laws regulating the purposes for which personal data can be processed in their own organisation. This includes the Swedish Tax Agency, etc. Interaction Between Legal Levels The GDPR takes precedence as directly applicable EU law. Swedish legislation cannot contradict the GDPR but can differentiate when provided by the regulation.
455 CHAMBERS.COM
Powered by FlippingBook