SWEDEN Trends and Developments Contributed by: Niclas Rockborn, Astrid Svensson and Ivan Sivik, Gernandt & Danielsson
General Trends In recent years, Sweden’s approach to data protec - tion has significantly evolved. Rapid technological advancements, increased digitalisation across indus - tries, and a growing awareness of individuals’ right to privacy are the main drivers of this development. As a member of the European Union (EU), the Swedish data protection regime mainly consists of the General Data Protection Regulation (GDPR) and national laws supplementing the GDPR. This update highlights three prominent data protec - tion trends in Sweden. The first trend concerns cyber - security and digital resilience in the financial sector from a data protection perspective. The second trend addresses technological advancements and the interplay between artificial intelligence (AI) and data protection. The third trend regards Swedish develop - ments concerning the processing of personal data relating to criminal convictions and offences. Trends in the Financial Sector From a Data Protection Perspective The Swedish financial sector in general The Swedish financial sector is highly digitalised and includes traditional banks and, to a large extent, fin - tech leaders such as Trustly, Klarna and Zettle. This digitalisation entails data protection as well as infor - mation and communication technology (ICT) risks, rendering the Swedish financial system particularly vulnerable to data protection risks, cyber threats, and ICT disruptions. In addition to recent developments in EU data and cyber regulations, several of which have already entered into force and are expected to be implemented in 2026, the heightened focus on cyber - security also responds to changes in the Swedish security landscape arising from, inter alia, the ongo - ing war in Ukraine and organised crime. Swedish banking secrecy The Swedish banking secrecy rules apply in parallel to the GDPR. Hence, data may fall under the scope of both the GDPR and Swedish banking secrecy rules, requiring careful assessments to ensure compliance with both sets of rules. Swedish bank secrecy is regu - lated in the Swedish Banking and Financing Business Act ( Lag (2004:297) om bank- och finansieringsrörelse ) but also in other laws applicable to specific sectors
within the financial industry. The Banking and Financ - ing Business Act provides that a credit institution may not disclose an individual’s relationship to the credit institution without authorisation. This duty of secrecy imposes obligations on the credit institution and its representatives, such as employees, the CEO, and contractors. If a bank violates banking secrecy under - takings, it could be liable for damages if the individ - ual can prove that the relevant breach has caused them financial harm. Such violations may also prompt the Swedish Financial Supervisory Authority (SFSA) ( Finansinspektionen ) to review the bank’s general pro - cedures, potentially resulting in sanctions if the SFSA deems these procedures inadequate. The individuals to whom the right to confidentiality applies are the bank’s natural and legal customers. It applies to all current and former customer relations, regardless of the duration and extent of the relation - ship, and extends beyond the death of the natural person or the dissolution of the legal entity. The pro - tected information is interpreted broadly to include all information about the customer that the bank obtains because of the customer relationship, both personal data and trivial private information, even if it is not obtained directly from the customer. Exceptions to banking secrecy apply when provid - ing information to legal guardians, during criminal investigations, and in other instances, provided that there are legitimate grounds. Banking secrecy may also be waived by a provision of law or based on other specific legitimate grounds (not to be confused with “legitimate interest” under the GDPR). Banking secrecy does not apply to the customer themselves or when the customer has consented to a specific information disclosure. Additionally, information that is already publicly known is not considered confiden - tial and is therefore not protected by banking secrecy regulations. As part of the government’s ambitions to fight criminal activities, since April 2025, banks and payment insti - tutions have been subject to obligations to disclose customer information to law enforcement authorities pursuant to the Swedish Banking and Financing Busi - ness Act ( Lag (2004:297) om bank- och finansiering - srörelse ) and the Swedish Act on Payment Services
470 CHAMBERS.COM
Powered by FlippingBook