SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
lectual property rights, or where the transfer may lead to re-identification. However, Sweden has not succeeded in identifying any authority or body that currently conducts activities corresponding to the task described in Article 32.3 of the EU Data Act. If it emerges during the application of the regulation that data processing service provid - ers do not receive the assistance prescribed in Article 32.3 by approaching Swedish authorities, the govern - ment will consider appointing one or more relevant authorities under that article. 5.3 Data Localisation Requirements Data Localisation Rules The key Swedish data localisation law is the Swed - ish Bookkeeping Act (1999: 1078) ( Bokföringslagen ). Chapter 7, Section 2 requires organisations to: • store accounting information in Sweden for seven years after the end of the calendar fiscal year; and • maintain equipment for storing accounting informa - tion in Sweden. The types of information that have to be kept in Swe - den include: • balance sheets; • basic accounting and general ledgers; • subsidiary ledgers; • verification documents, meaning documents con - cerning business events or adjustments made to accounts (Chapter 1, section 2 (8), Bookkeeping Act); • bookkeeping system documentation and process - ing histories; and • annual reports. Exemptions An organisation that has accounting obligations under the Bookkeeping Act may: • temporarily store verification documents outside of Sweden if special reasons consistent with good accounting practices exist (Chapter 7, Section 3, Bookkeeping Act); for example, a bank may store verification documents in another country for book - keeping in that country;
• store machine-readable media and maintain equip - ment for storing accounting information in another EU country or a country that is party to a mutual assistance agreement if the organisation: (a) notifies the Tax Agency or the Financial Super - visory Authority of the equipment storage location; (b) allows immediate access to the accounting information at the request of the Tax Agency or the Customs Agency; and (c) can immediately produce the accounting infor - mation in printed form on request. In General The GDPR does not mandate data localisation; per - sonal data may be stored anywhere provided appro - priate transfer mechanisms are in place. However, remote access by third-country entities constitutes a transfer requiring compliance with Chapter V GDPR. Remote access by third-country entities is permitted when: • the third country has received an EU adequacy decision (eg, EU–US Data Privacy Framework for certified US organisations, UK, Switzerland, Japan, etc); and • standard contractual clauses (SCCs) have been executed between data exporter and importer, accompanied by: (a) transfer impact assessment evaluating third- country laws; (b) supplementary measures where necessary (encryption, access controls, data minimisa - tion); and (c) documentation of assessment and measures; • for intra-group transfers, binding corporate rules (BCRs) have been approved by supervisory author - ities; • Article 49 derogations apply in limited situations, including: (a) explicit consent after being informed of risks; (b) contractual necessity; (c) legal claims establishment, exercise or de - fence; (d) vital interests protection; and (e) compelling legitimate interests (rare, occasional transfers affecting few individuals);
467 CHAMBERS.COM
Powered by FlippingBook