SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
2. Privacy Litigation 2.1 Privacy Litigation Overview
2.3 Collective Redress Mechanisms The Swedish legislature has not implemented Article 80 GDPR, which gives organisations or associations in the field of the protection of data subjects’ rights and freedom the right to exercise the rights referred to in Articles 77, 78 and 79 of the GDPR. Under current Swedish law, a legal person cannot rep - resent an individual in court. A non-profit organisation thus cannot act as a representative for the data sub - ject in an administrative case or in a non-contractual damages case in a general court. The provisions on legal representatives in Chapter 12 of the Code of Judicial Procedure are based on the premise that the representative is a natural person. With regard to the protection of personal privacy, in recent years it has become more common to have non-profit organisations active in the data-protection field. In Sweden, however, this type of activity is still limited. The Representative Actions Directive was imple - mented in Sweden on 1 January 2024 through the Act (2023:730) on Group Actions for the Protection of Consumers’ Collective Interests. The reform expands the possibilities for bringing representative actions on behalf of consumers, but is not expected to lead to any dramatic increase in the number of cases. The Swedish Consumer Agency has been designated as a qualified entity in Sweden. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation The EU Data Act (Regulation (EU) 2023/2854) has direct applicability from 12 September 2025 in Swe - den as in the other EU member states. Supplemen - tary national legislation will, in accordance with the requirements, be enacted in Sweden. The EU Data Act applies to manufacturers, users, data holders, data recipients, third parties, public bodies, cloud service providers, and participants in data spaces involving connected products and associated services.
There has been no national case law from the Swed - ish Supreme Court regarding private litigation. How - ever, there have been several lower court judgments regarding non-contractual damages. Typically, these cases revolve around a data subject’s rights not being adhered to. Most cases are typically not successful in the court because of difficulties proving actual non-contractual damages, even though non-material damages are compensable. The levels of non-contractual damag - es applicable under Swedish case law are normally between SEK3,000 and SEK5,000 for non-material damages, but in a few isolated cases have been between SEK15,000 and SEK35,000. The requirements for claimants to bring privacy claims before courts follow the CJEU’s case law, which indi - cates that it is required that there has been an infringe - ment of the Data Protection Regulation, that damage has occurred, and that there is a causal link between the infringement and the damage. An infringement of the provisions of the Data Protection Regulation alone is thus not sufficient to give rise to compensation. 2.2 Recent Case Law There is no national case law – ie, from the Swedish Supreme Court, regarding privacy litigation; all rele - vant rules or standards are CJEU case law. The most relevant decisions are: • judgment of the Court of Justice of the European Union of 4 May 2023 in Case C-300/21; • judgment of the Court of Justice of the European Union of 14 December 2023 in Case C-340/21; and • judgment of the Court of Justice of the European Union of 25 January 2024 in Case C-687/21. Collectively, these three decisions establish the threshold for GDPR compensation claims: a breach alone is not enough; actual (even non-material) harm must be proven, hypothetical fears are insufficient on their own (though genuine, well-founded fear can qualify), and no punitive damages are available.
461 CHAMBERS.COM
Powered by FlippingBook