SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
with main establishments in Sweden), it co-ordinates investigations and draft decisions with concerned supervisory authorities. The one-stop shop mecha - nism aims to provide single-point supervision for cross-border controllers. There are no national rules complementing this structure. 1.8 Enforcement Proceedings and Fines Investigation Procedure IMY initiates investigations through various triggers: • individual complaints (most common); • data breach notifications suggesting serious viola - tions; • media reports; • whistle-blower information; or • own-initiative investigations based on sectoral risk assessments. IMY prioritises cases involving: large-scale process - ing; a special category of personal data; children’s data; systematic violations; or novel legal issues with broader implications. Upon initiating investigations, IMY typically issues written requests for information to controllers/pro - cessors, specifying required documentation and response deadlines. The response deadline is typi - cally three weeks, with the possibility of being granted a postponement. Before issuing decisions, IMY provides draft findings and proposed measures, allowing organisations to submit written responses. This ensures procedural fairness and enables organisations to correct factual errors, provide additional context, or present legal arguments. Unlike, for example, the Swedish Com - petition Authority, IMY does not have the power to carry out dawn raids, that is, unannounced on-site inspections. IMY may impose various administrative sanctions under Article 58 GDPR. Warnings and reprimands are non-financial sanctions for less serious violations or first-time offences by organisations demonstrating good faith compliance efforts. Orders to comply with data subject requests address specific rights viola -
tions. Processing suspension orders halt unlawful processing pending compliance. The most typical sanction is a reprimand, even for more serious breaches. If an administrative fine is issued IMY relies heavily on the Guidelines 04/2022 of the EDPB on the calculation of administrative fines under the GDPR. Organisations may appeal IMY decisions to Swedish administrative courts. Appeals must be filed with the Administrative Court of Stockholm (F örvaltningsrätten i Stockholm ) within three weeks of receipt of the deci - sion. Appeals proceed through three levels: • Administrative Court; • Administrative Court of Appeal of Stockholm ( Kam- marrätten i Stockholm ), requiring leave to appeal; and • Swedish Supreme Administrative Court ( Högsta förvaltningsdomstolen ), requiring leave to appeal. IMY cannot enforce its actions through criminal or civil courts. 1.9 Enforcement Trends For the past 24 months IMY has had structural organisational issues internally and seen the amount of incoming complaints increase substantially. As a result, IMY’s capacity to carry out own-initiative inves - tigations has dropped significantly. As of 1 January 2026, IMY has introduced a new organisational struc - ture aimed at streamlining the agency to better handle complaints and own-initiative investigations. Most decisions made by IMY are from complaints lodged against a controller, typically when IMY is the lead supervisory authority according to the one-stop shop mechanism. This is because IMY faces resist - ance from other supervisory authorities when seeking to close cases without examining the substance of the complaint, for example by issuing information letters instead of adopting a decision on the merits. In practice, the clearest indication that IMY is likely to commence an own-initiative investigation is that the matter has attracted media attention.
460 CHAMBERS.COM
Powered by FlippingBook