SWEDEN Trends and Developments Contributed by: Niclas Rockborn, Astrid Svensson and Ivan Sivik, Gernandt & Danielsson
missible if additional safeguards in the form of opt-out solutions are provided when information is given to data subjects, and that the synthesisation of personal data for training AI models is a privacy-friendly way of reducing risks to the infringement of privacy rights. Another interesting sandbox concluded in 2025 con - cerned the “Sharing of customer data between banks to counter financial crime”. Through the regulatory sandbox, IMY collaborated with the four major Swed - ish banks – SEB, Nordea, Swedbank and Handels - banken – to explore the legal possibility of flagging high-risk individuals in a shared system to prevent financial crimes. The project concluded that this type of information sharing constitutes processing of crimi - nal data under Article 10 of the GDPR and that there is probably no legal basis for banks to carry out such processing. That is in part because IMY assessed that in light of banking secrecy provisions in the Swedish banking secrecy and confidentiality provisions in the Money Laundering Act and Terrorist Financing (Pre - vention) Act ( Lag (2017:630) om åtgärder mot pen- ningtvätt och finansiering av terrorism ) and the Pay - ment Services Act ( Lag (2010:751) om betaltjänster ), it would be difficult for banks to base the intended sharing of personal data on legal violations on the legal basis of legitimate interest. A noteworthy regulatory sandbox to monitor in 2026 is IMY’s regulatory sandbox project with a municipal - ity to explore the safe and responsible use of AI in social services. The initiative focuses on testing AI tools for recording, transcribing, and summarising conversations. The objective is to reduce social work - ers’ administrative burden and free up more time for client contact. Personal Data Relating to Criminal Convictions and Offences Article 10 of the GDPR and its interpretation Article 10 of the GDPR concerns the processing of personal data relating to criminal convictions and offences. In Sweden, the general rule is that only the public authorities can process personal data related to criminal convictions and offences. The legal bases for organisations, other than public authorities, to pro - cess personal data of this nature are limited to when permitted under the Swedish constitution, applicable
law, or when necessary to establish legal claims or fulfil legal obligations. In addition, IMY has the author - ity to permit organisations to process personal data related to criminal offences. According to IMY, Article 10 of the GDPR shall be inter - preted to apply to information that discloses whether a person is or has been the subject of a police report, preliminary investigation, prosecution, or proceed - ings in criminal cases. This also includes acquittals in criminal cases, for example, if a person has been released from accusation and freed from obligation regarding the charges. IMY’s statement further clari - fies that information indicating that a natural person has or may have been suspected of criminal activities can be considered to fall within the scope of Article 10 of the GDPR, regardless of whether legal proceedings have been initiated. This shall not be interpreted to include all information, as there is a certain threshold of specificity to be met. Additionally, IMY clarifies that observations or pas - sive events where the objective criteria for a crime may be met are normally not considered processing of personal data relating to criminal convictions and offences. Simply put, if a surveillance camera cap - tures a robbery through passive recording of a certain area, this would generally not be considered data pro - cessing under Article 10 of the GDPR. On the other hand, if the sequence of events is separated at a later stage for legal action, it will fall under the scope of Article 10 of the GDPR. Checks against sanction lists Another development concerns the legality of con - ducting checks against sanction lists. The process - ing of personal data concerning criminal convictions and offences was to some extent already permissible under the Swedish Money Laundering and Terrorist Financing (Prevention) Act to the extent necessary to assess and manage the risks associated with a cus - tomer relationship. However, there was no explicit legal basis for conducting checks against sanction lists. Organisations within, for example, the financial, dual- use and military sectors frequently need to perform checks against various international sanction lists
473 CHAMBERS.COM
Powered by FlippingBook