SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
• ensure that patient journals are maintained with required content and retention; • enforce internal confidentiality and role-based access with logging and periodic audits; • enable patient blocking of intra-provider electronic access; • limit sensitive search keys for special categories of personal data that is not strictly health related; • use GDPR-compatible legal bases and secrecy for health data; and • for quality registers, implement opt-out, proper purposes, authority-controller, minimisation and erasure of data ( gallring ). 1.3 Special Categories of Personal Data General Prohibition and Exceptions Special categories of personal data are prohibited to process unless certain conditions are fulfilled (eg, explicit consent, employment/social security, vital interests, public interest in health, research with safe - guards). Processing requires professional secrecy for healthcare workers in line with Article 9.2.j GDPR. The professional secrecy is outlined in Chapter 6, Section 12, of the Patient Safety Act (2010:659) ( patientsäker- hetslagen (2010:659) ). Data relating to criminal convictions needs legal con - trol or a legal basis with safeguards to be processed. Chapter 3, Section 8, of the Data Protection Act stipu - lates that data relating to criminal convictions may always be processed by government agencies. Par - ties other than government agencies may process data relating to criminal convictions if the processing is necessary to: • establish, exercise or defend legal claims, or • fulfil a legal obligation under an Act or Ordinance. According to IMY’s regulations on the processing of personal data concerning criminal offences, IMYFS 2024:1, the following organisations may process crim - inal data: • non-public authorities in social services; • independent schools and private higher education institutions (for student welfare records); • law firms and other legal service providers;
• companies with internal whistle-blowing channels (for senior personnel investigations); • companies under the supervision of the Swedish Financial Supervisory Authority ( Finansinspek- tionen ); and • companies under the supervision of the Inspector - ate of Strategic Products or the Swedish Radiation Safety Authority. Data Processing Relating to Minors Under Article 8 GDPR, where consent is the legal basis for processing (Article 6 (1)(a)), the processing of a child’s personal data in relation to information society services is lawful only if the child is at least 16 years old. For children below the age of 16, process - ing is only lawful if consent is given or authorised by the holder of parental responsibility. Through Chapter 2, Section 4 of the Swedish Data Protection Act, Sweden has exercised its option under Article 8 GDPR to lower the age threshold. When infor - mation society services are offered directly to a child living in Sweden, the child’s personal data may be processed on the basis of the child’s own consent if the child is at least 13 years old. If the child is under 13, the data may only be processed with the consent In Sweden’s healthcare sector, health data can be pro - cessed under Article 9 (2)(h) GDPR subject to profes - sional secrecy. Criminal-offence data requires “abso - lutely necessary” processing and can be processed by private providers under strict necessity. 1.4 Processing of Personal Data for Research and Development Purposes The GDPR allows further processing for scientific research/statistics/archiving with appropriate safe - guards. The Patient Data Act enables use of quality registers for research and statistics. of the child’s parent or legal guardian. Health Data Processing in Sweden Healthcare providers may process patient data for quality assurance, healthcare development, and research within healthcare. Processing for commercial product development by external companies requires either patient consent or ethical review board approval combined with appropriate safeguards.
457 CHAMBERS.COM
Powered by FlippingBook