SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
• Granular Choices: Users must be able to consent separately to different cookie categories. • Easy Withdrawal: Consent withdrawal must be as easy as giving consent. • Clear Information: Cookie notices must clearly explain purposes, data collected, and recipients. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised and targeted advertising in Sweden is primarily regulated by the Marketing Act (2008:486), the GDPR, the Electronic Communications Act (2022:482), and – for large platforms – the EU Digital Services Act (DSA). IMY supervises data protection compliance, whilst PTS oversees cookie compliance. The GDPR requires a lawful basis for profiling and direct marketing and grants an unconditional right to object to direct marketing. The use of automated deci - sions is restricted. A special category of personal data use in marketing generally requires explicit consent. Children’s online consent threshold applies to Infor - mation Society Services, which, according to Article 8 GDPR and Chapter 2 Section 4 of the Swedish Data Protection Act, is set at age 13. Personalised advertising and online marketing require: • consent – for electronic marketing (email, SMS) to individuals who have not previously purchased similar products/services; and • legitimate interests – for direct marketing to exist - ing customers, subject to a balancing test and easy opt-out. Data subjects have an absolute right to object to direct marketing at any time. Controllers must: • inform data subjects of the right to object at first communication; and • provide easy, free opt-out mechanisms (eg, unsub - scribe links). Case Law IMY found that Bonnier News AB processed personal data without legal grounds under Article 6.1 GDPR by profiling individuals based on their behavioural data in complex behavioural profiles and simple behavioural
profiles to display customised advertisements, and imposed an administrative fine of SEK13 million. IMY found that the consent requirement under Swed - ish Electronic Communications Act provides strong privacy protection and control for individuals, that this protection risks being undermined if collected per - sonal data is processed based on other legal grounds such as legitimate interest, and that the scope for using Article 6.1 (f) GDPR as a legal basis for profiling Swedish employment law balances employers’ legiti - mate interests in managing the workplace against employees’ privacy rights. Key principles include: • Necessity and Proportionality: Employee monitor - ing must be necessary for legitimate purposes and proportionate to those purposes. • Transparency: Employees must be clearly informed about monitoring scope, purposes, and methods. • Minimisation: Only data necessary for specified purposes can be collected. based on observed data is limited. 4.3 Employment Privacy Law • Limited Retention: Employee data can only be retained as long as necessary for the purpose it was originally processed. It is not advisable to base the processing of employ - ees’ personal data on the legal basis of consent. This must only be used in specific situations. Employee Monitoring Workplace monitoring (eg, email monitoring, internet usage tracking, location tracking, video surveillance) requires: • legitimate purpose: clearly defined business rea - sons (eg, security, productivity, legal compliance); • proportionality assessment: balancing employer interests against employee privacy; • transparency: clear policies informing employees about monitoring; • minimisation: limiting monitoring to what is neces - sary; and • good practice in the labour market: an established principle in Swedish labour law, which means that employers and employees must act with respect,
464 CHAMBERS.COM
Powered by FlippingBook