SWEDEN Law and Practice Contributed by: Anna Fernqvist Svensson, Karl-Fredrik Björklund and Jakob Westling, Hellström Advokatbyrå KB
• irrespective of the transfer mechanism relied upon, appropriate technical and organisational security measures have been implemented, namely: (a) encryption of data in transit and at rest; (b) strong authentication and access controls; (c) logging and monitoring of access; (d) contractual restrictions on data use; and (e) regular security assessments. 5.4 Blocking Statutes There is no privacy law except for the GDPR restricting foreign discovery. The basic principle is that a court in the state where the trial is taking place can only access evidence in another state if that state has given its consent, either through an international agreement or in the individual case. If an official representative of a state, such as a judge, conducts evidence-gathering on site within the territory of another state without such approval, this typically constitutes a violation of the sovereignty of the other state. Rules on the taking of evidence abroad are found in the 1970 Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters. Between EU member states, the EU Evidence Regulation (Regula - tion (EU) 2020/1783) applies. If there are legal grounds for foreign discovery, these would typically not be in conflict with the GDPR, as the regulation permits pro - cessing of personal data for secondary purposes if it is based on Union law or the national law of the member states, and constitutes a necessary and pro - portionate measure in a democratic society.
The Swedish Supreme Court addressed the interplay between discovery obligations and the GDPR in the Norra Stockholm Bygg case (Ö 1750-20), where it sought a preliminary ruling from the CJEU on whether GDPR Articles 6 (3) and 6 (4) apply to national proce - dural law concerning discovery of documents con - taining personal data. The CJEU confirmed that these provisions are applicable in civil disputes involving dis - covery of documents with personal data concerning third parties collected for other purposes (such as tax control). The court held that national courts must con - sider the interests of the data subjects when deciding on discovery requests and balance these against the circumstances of each case, the type of proceedings involved, and with due regard to the proportionality principle and the data minimisation principle under Article 5 (1)(c) GDPR. In the Swedish case, the Swedish Supreme Court ultimately granted the discovery request, emphasis - ing that the right to effective judicial protection and a fair trial requires parties to access documents needed to prove their case, even when they contain others’ personal data. However, it applied the data minimisa - tion principle by requiring masking of personal iden - tity numbers whilst allowing disclosure of names and work attendance records. 5.5 Recent Developments The GDPR continues to evolve through adequacy decisions and updated SCCs. The AI Act’s entry into force (general application from 2 August 2026; prohi - bitions from 2 February 2025) will add obligations for high-risk AI relying on cross-border data and require alignment with GDPR and data-transfer regimes. The changes to be expected next is the matter of the EU– US Data Privacy Framework and whether it will be challenged in the courts.
468 CHAMBERS.COM
Powered by FlippingBook