SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
3.3 Rights and Obligations Under Applicable Data Regulation Rights Users of connected products have enhanced rights to access and share product-generated data, with data holders obligated to provide such access promptly and under non-discriminatory, fair terms; unfair con - tractual clauses are invalidated. Natural persons and legal entities whose rights under the EU Data Act are infringed have the right to lodge complaints and seek effective remedies, including appeal rights against authorities’ decisions not to act on complaints. Obligations • Data sharing between businesses, including cloud service providers, must avoid “lock-in” via the removal of switching fees by 2027, enable data portability, and foster interoperability through open standards developed at the EU level. • Connected products must be designed so that product data is directly accessible to users by default in an easy, secure, free, and machine-read - able format. Before sale or lease, sellers/lessors must provide clear information about data types, volumes, storage, and how users can access or delete data. • Data holders must make readily available data accessible to users without undue delay, free of charge, in a structured and machine-readable format. When users request data sharing with third parties, data holders must provide the data to those third parties under the same conditions. Data holders must not make it unreasonably difficult for users to exercise their rights through manipulative interface design. Where trade secrets are involved, data holders must identify such data and agree on appropriate confidentiality measures. • Third parties must process received data only for agreed purposes and delete it when no longer nec - essary to keep. They must not use data for profiling (unless necessary), share it onwards without agree - ment, make it available to gatekeepers, or use it to develop competing products. • A contractual term on data access/use or on liability/remedies in case of breach/termination of data-related obligations that has been unilaterally
The regulation covers both personal and non-personal data, governing cross-sector data access and sharing frameworks in relation to the internet of things, cloud computing, and other data processing services. Swe - den will, in accordance with the requirements, enact a new Supplementary Act and Ordinance to comple - ment the EU Data Act, specifying definitions, enforce - ment mechanisms, and sanctions. Public authorities may request data in exceptional situations, such as public emergencies, but criminal enforcement agencies and tax authorities are exclud - ed from this chapter. There is no Swedish national law regulating non-per - sonal data except for the EU Data Act. 3.2 Interaction of Data Regulation and Data Protection The EU Data Act explicitly respects and complements the GDPR and other privacy laws, requiring that data sharing and processing of personal data comply with the GDPR’s principles and legal bases. Pseudonymi - sation or anonymisation of personal data is mandated where feasible for public requests. Confidentiality obligations apply to competent author - ities and public bodies processing data under the EU Data Act, with existing Swedish secrecy laws deemed adequate for covering these requirements. The EU Data Act prescribes a limitation in the scope of application of the Database Directive. It is thus intend - ed to cover databases even when data is obtained from or generated by a connected product or a related service covered by the EU Data Act, provided that the conditions for the right sui generis are met. The framework ensures that any processing of per - sonal data under the EU Data Act maintains a lawful basis under the GDPR, such as necessity for public tasks or legal obligations, whilst respecting confiden - tiality and data protection principles.
462 CHAMBERS.COM
Powered by FlippingBook