SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
imposed on another enterprise is not binding on that enterprise if the term is unfair. Public entities must handle requested data confiden - tially and may only use data for the specified public interest; data must be deleted when no longer neces - sary to keep unless archival law applies. Action Items for Organisations Organisations should: • inventory and categorise cloud agreements (SaaS/ PaaS/IaaS), noting that Chapter VI of the EU Data Act already applies from 12 September 2025, even for existing agreements; • identify B2B agreements with data clauses that are either open-ended or run until 11 January 2034 or later, as these will be subject to Article 13 from 12 September 2027; • assess other agreements with data components for clauses potentially conflicting with the EU Data Act; • create a “Data Act addendum” for cloud agree - ments, prioritising updates to switching and port - ability clauses, using the European Commission’s non-binding model clauses as a starting point; • build a “2027 list” of B2B agreements affected by Article 13 from 12 September 2027, planning to remove unfair data clauses and renegotiate or terminate agreements before 2027 if they cannot be adapted; • monitor PTS guidance as the competent authority in Sweden regarding their forthcoming guidance and supervisory practices concerning the EU Data Act; and • note that Swedish supplementary legislation enters into force on 1 July 2026, primarily addressing supervision, powers, and sanctions rather than altering the contractual rules in the EU Data Act. 3.4 Regulators and Enforcement The Swedish Post and Telecom Authority ( Post- och Telestyrelsen , PTS) is designated as the sole compe - tent authority for enforcement and as the certifying body for dispute resolution organisations. PTS has powers to impose fines, issue warnings, investigate complaints, handle sanctions, and promote data lit - eracy among stakeholders.
The Swedish Civil Contingencies Agency ( Myn- digheten för civilt försvar , MCF) supports public sector bodies requiring data to manage exceptional needs, tasked with guiding and preparing these bodies for effective use of the Data Act provisions. PTS co-operates with IMY and other sectoral bodies to ensure consistent enforcement and alignment with related legislation. Harmonisation efforts, standards development, and legal clarifications are driven mainly at the EU level via the European Commission and the European Data Innovation Board (EDIB), with PTS par - ticipating actively; regulatory sandboxing by PTS is proposed to facilitate practical guidance for industry stakeholders. Sanctions include administrative fines ranging from SEK5,000 to SEK20 million depending on the nature of the actor and violation. The E-privacy Directive, incorporated in Swedish law through the Electronic Communications Act ( lagen (2022:482) om elektronisk kommunikation ), regulates online tracking technologies such as cookies, SDKs, and other device identifiers. In Sweden, an opt-in model is applied. Data may be stored in or retrieved from a subscriber’s or user’s ter - minal equipment only if the user consents to it. How - ever, such storage or access is permitted when nec - essary for the transmission of an electronic message via an electronic communications network or when necessary for the provision of a service at the express request of the user or subscriber. Consent must meet GDPR standards: freely given, specific, informed, unambiguous, and easily with - drawable. This means: • No Pre-Ticked Boxes: Users must take affirmative action to consent. • No Cookie Walls: Access to websites cannot be conditioned on consent to non-essential cookies. 4. Sectoral Topics 4.1 Use of Cookies
463 CHAMBERS.COM
Powered by FlippingBook