SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
When applying the sectoral legalisation, the legal prin - ciple lex specialis is applied, meaning the more spe - cific law takes precedence. To illustrate this by way of example, the European Convention on Human Rights establishes a right to privacy, which is further elaborated upon through the GDPR. The Swedish Data Protection Act then speci - fies applicable rules where permitted by the GDPR. The Ordinance with supplementary provisions to the EU Data Protection Regulation in turn sets out certain rules relating to the Swedish Data Protection Act. Extraterritorial Reach The Swedish Data Protection Act states that data protection laws apply to the processing of personal data carried out within the framework of activities con - ducted at the establishments of data controllers or data processors in Sweden. The Act also applies to the processing of personal data carried out by data controllers that are not established in Sweden but in a place where Swedish law applies according to inter - national law. The Act also applies to the processing of personal data carried out by data controllers or data proces - sors that are only established in third countries, if the processing concerns data subjects who are located in Sweden and is related to: • the offering of goods or services to such data subjects; or • the monitoring of their behaviour in Sweden. Interplay with Non-Personal Data, Cyber and AI Laws The EU AI Act (Regulation (EU) 2024/1689) is directly applicable in Sweden. It supplements the GDPR, it does not replace it. Providers and deployers must still comply with the GDPR where personal data is processed. There are no specific Swedish provisions that alter this interaction beyond what is set out in the EU legislation. Two key EU instruments govern cybersecurity and intersect with data law more broadly: the NIS2 Direc - tive and the Cyber Resilience Act (CRA). While the GDPR focuses on personal data, NIS2 and the CRA
extend protection to encompass comprehensive cybersecurity requirements more broadly, covering system and product security irrespective of wheth - er the data involved is personal. Organisations can build on their existing GDPR compliance frameworks, particularly in the areas of risk assessment, incident
reporting, and security measures. 1.2 Rights and Obligations General Principles
The Swedish Data Protection Act does not increase the available rights or principles under the GDPR for data subjects; the same rights and principles outlined in the GDPR apply. However, chapter 8 in the Swedish Patient Data Act covers patient rights regarding medical records, including: • access to and copying of records upon request; • procedures when access is denied; • provisions for record destruction under certain conditions; and • information rights about data access. Compliance Checklist Core GDPR operational tasks typically include: • mapping processing operations and purposes; • identifying lawful bases for processing; • assessing a special category of personal data/ personal data relating to criminal convictions and offences; • drafting and providing information to data subjects; • enabling access/rectification/erasure/objection/ portability and limits to automated decisions – ie, data subjects’ rights; • implementing appropriate technical and organisa - tional measures to ensure security of processing; • maintaining records of processing activities; • conducting DPIAs for high-risk processing; • appointing a DPO where required; • setting processor terms; • breach readiness/notifications; and • transfer mechanisms. National regulation relating to Healthcare Data Healthcare organisations must:
456 CHAMBERS.COM
Powered by FlippingBook