SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
1.7 Regulators IMY
It clarifies what counts as personal data, which includes social security numbers, names, IP address - es, email addresses, and pictures where a person is visible. It also notes that data which cannot on its own be directly linked to a person, but when combined with other data can identify a person, is also personal data. 1.6 Data Breach Requirement Under the GDPR, controllers must notify IMY within 72 hours unless risk for data subjects is unlikely and inform data subjects without undue delay if high risk is at hand, unless protective measures (eg, encryption) render risk unlikely. Processors must notify controllers without undue delay. Documentation is required. IMY has their own form, available on their website, which the controllers or processors may fill in to notify a personal data breach. The information required in the form includes: • incident details: when the incident occurred, when it was discovered, whether it is ongoing, when it ceased, reason for late reporting (if applicable), type of incident (unauthorised disclosure, access, loss, destruction, or alteration), and a brief descrip - tion; • discovery and cause: how the incident was discov - ered and why it occurred, sector and operational area where it took place; • affected persons and data: number of affected data subjects, number of affected data records, categories of data subjects (employees, custom - ers, patients, children, etc), types of personal data affected (special categories, identification data, etc), and whether data was encrypted; • consequences: potential consequences of the incident and severity assessment; and • actions taken: measures taken or planned to address the incident. Typically, IMY does not investigate a notified breach, as too many are notified to IMY. Investigations can occur if the breach is receiving a lot of media attention, and IMY feels forced to investi - gate; see IMY’s recent decision issued on 26 January 2026 regarding SportAdmin.
IMY is Sweden’s primary data protection regulator. Established under the Data Protection Act, IMY super - vises GDPR compliance, the Data Protection Act, and certain sectoral privacy laws. IMY’s mandate includes monitoring and enforcing compliance; investigating complaints; conducting audits; issuing guidance; co- operating with other EU supervisory authorities; and representing Sweden in the European Data Protection Board. Competent Authorities IMY has authority over all privacy-related matters, except for matters strictly relating to the placement of cookies according to the E-privacy Directive (2002/58/ EC). The Swedish Data Protection Authority still has competence to investigate data processing from per - sonal data gathered by cookies. Investigative Workflow IMY investigations are typically triggered by: • individual complaints; • data breach notifications; • media reports; • whistle-blower information; or • IMY’s own initiative based on risk assessments. Upon receiving complaints, IMY conducts preliminary assessments to determine jurisdiction, admissibility, and priority. For investigations, IMY typically: • notifies the controller/processor of the investigation and allegations; • requests written submissions and documentation; • provides opportunities for organisations to respond to preliminary findings; and • issues formal decisions with reasoning, corrective
measures, and any sanctions. Cross-Border Co-Operation
For cross-border processing cases, IMY co-operates with other EU supervisory authorities through the GDPR’s consistency mechanism. When IMY is the lead supervisory authority (for controllers/processors
459 CHAMBERS.COM
Powered by FlippingBook