SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
loyalty and common sense, often as a complement to other requirements. Swedish practice generally prohibits: • continuous, comprehensive monitoring of all employee activities; • monitoring of private communications (eg, personal emails, private phone calls); • covert monitoring except in exceptional circum - stances (eg, suspected serious misconduct); and • monitoring in private areas (eg, restrooms, chang - ing rooms). Background Checks There is no express statutory right for informal reg - ister checks, though the absence of regulation has not been considered to mean that conducting such checks is prohibited. For private actors, the problem is that the only appli - cable legal basis under Article 6 GDPR is often the balancing of interests (Article 6.1 f), which is compli - cated and creates significant uncertainty for private organisations regarding their right to process such data. Unlike public authorities, private actors lack the right to process data on criminal offences without permission from IMY, except in limited cases where specific statutory support exists. A fragmented regulatory framework and significant uncertainty about what is permitted mean that cur - rently background checks, especially regarding crimi - nal records, are legally dubious. A special investigator has been appointed to analyse the need for and prerequisites for conducting back - ground checks in both public and private operations, aiming to provide organisations with appropriate tools before and during employment to prevent risks posed by persons with criminal or other harmful intentions in workplaces, such as infiltration and other undue influ - ence, whilst ensuring personal privacy is protected. The mandate must be completed by 11 March 2027. Job Applicants Processing applicant data requires:
• lawful basis: typically, contractual necessity (pre- contractual measures) or legitimate interest; • transparency: clear privacy notices explaining per - sonal data use; • retention limits: delete unsuccessful applicant data after two and a half years (to make sure that the time within which an applicant may initiate legal proceedings concerning claimed discrimination related to, for example, age, has elapsed – the time limit is a little more than two years), unless consent has been obtained for future opportunities; and • equality: avoid discriminatory processing (eg, auto - mated screening tools must not discriminate). 4.4 Data Protection in M&A There is no specific regulation that differentiates Swedish privacy concerns from any other country bound by the GDPR. Privacy due diligence is critical to identify risks before acquisition. Key red flags include, for example, lack of privacy policies, no personal data inventory, security issues, and past unresolved data breaches. Personal data should be disclosed gradually on a “need-to-know” basis throughout the transaction stages. A data sharing agreement between target and acquirer is essential, specifying permitted use, confi - dentiality obligations, and data deletion requirements if the transaction fails. Under the GDPR, data subjects must be transparently informed about the M&A transaction and how their personal data will be processed post-completion. The target typically leads this communication through direct contact, website notices, or email notifica - tions. Depending on circumstances, consent may be required for data transfers.
5. International Considerations 5.1 Restrictions on International Data Transfers
Sweden regulates cross-border transfers of both per - sonal and non-personal data through the GDPR and the EU Data Act (Regulation (EU) 2023/2854), sup -
465 CHAMBERS.COM
Powered by FlippingBook