SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
plemented by proposed Swedish national legislation effective from 1 July 2026. What Counts as a “Transfer” Under the EU Data Act, “transfer” includes making data available or accessible across member state boundaries or to third countries, encompassing both personal and non-personal data generated by con - nected products and services. For personal data under the GDPR, transfers occur when personal data is transferred to or accessed from outside the EU or EEA by controllers or processors established within the EU. Mechanisms for Lawful Transfers of Personal Data (GDPR) Transfer of personal data to third countries is lawful only if the controller or processor ensures adequate protection via an adequacy decision by the European Commission recognising the third country’s protection level as equivalent to EU standards, or through appro - priate safeguards such as binding corporate rules, standard contractual clauses, approved codes of conduct, or certification mechanisms. In the absence of adequacy decisions or safeguards, specific deroga - tions apply for situations, including explicit consent, contract performance, important public interest, legal claims, or protection of vital interests. Mechanisms for Lawful Transfers of Non-Personal Data (EU Data Act) Providers of data processing services must implement technical, organisational, and contractual safeguards to prevent unauthorised international government access to non-personal data held in the Union, and transfers pursuant to third-country court orders are only permissible if based on international agreements and provided they meet conditions of specificity, pro - portionality, and opportunity for objections. Data pro - cessing service providers must comply with harmo - nised rules facilitating data portability and switching of services with technical and contractual safeguards, with fees for switching abolished by 12 January 2027. The Swedish Post and Telecom Authority (PTS), des - ignated as the competent authority, assesses data requests by public bodies for exceptional needs, ensuring requests meet criteria of necessity, propor -
tionality, transparency, and legitimate interest balance prior to authorising data access. Providers may seek advisory opinions from relevant national bodies on whether conditions for third-country transfers are ful - filled. Public bodies receiving data via extraordinary needs requests may share data with other public bodies, EU institutions, or approved third parties under conditions preserving confidentiality and purpose limitations. Users have the right to have data held by data hold - ers provided to third parties of their choice on request, subject to contractual safeguards and confidentiality protections, with restrictions on certain entities such as gatekeeper companies. Third parties receiving data must process data only for agreed purposes, main - tain confidentiality, and delete data when no longer needed. Data holders may limit or refuse access to protect trade secrets, confidential business information, or where sharing would significantly harm economic interests, provided they notify PTS. Requests for data by public bodies must be specific, justified, and not duplicate previous requests; unfounded requests need not be complied with. 5.2 Government Notifications and Approvals Under Article 32 of the EU Data Act, data process - ing service providers must take adequate technical, organisational, and legal measures to prevent inter - national government access to and transfer of non- personal data held in the Union where such transfer or access would contravene Union law or the nation - al law of the member state concerned. This applies when decisions or judgments from courts or adminis - trative authorities in third countries require a provider to transfer or provide access to non-personal data covered by the EU Data Act and held in the Union. The decision’s or judgment’s addressee may request an opinion from the relevant national body or author - ity with competence for international co-operation in legal matters to determine whether the conditions specified are fulfilled, particularly when the decision may concern trade secrets and other commercially sensitive data, as well as content protected by intel -
466 CHAMBERS.COM
Powered by FlippingBook