SWEDEN Trends and Developments Contributed by: Niclas Rockborn, Astrid Svensson and Ivan Sivik, Gernandt & Danielsson
for compliance reasons, such as sanction lists from OFAC, OFSI and the EU. As a consequence, unless other applicable laws authorise checks against sanc - tion lists, for example, through EU regulations, busi - nesses in Sweden have been required to seek specific permission from IMY to be able to conduct checks against sanction lists since sanction lists may contain information about criminal offences. This resulted in IMY receiving an excess of applications from entities within the financial sector seeking permission to pro - cess such personal data to comply with anti-money laundering and terrorism financing obligations, as well as from undertakings involved in the export of dual- use goods or military equipment to adhere to interna - tional export restrictions. IMY’s updated regulation and related guidelines aim to facilitate the processing of personal data relating to criminal convictions and offences by certain sec - tors. This will allow certain entities within the financial sector and military industry to process personal data relating to criminal convictions and offences when conducting checks (for example, customers, suppli - ers, and employees against sanctions lists). The Swedish entities affected by the new regulations are companies in the financial sector under the super - vision of the SFSA, companies in the security and defence market under the supervision of the Swedish Inspectorate for Strategic Products ( Inspektionen för strategiska produkter ), and certain companies in the security and defence market under the supervision of the Swedish Radiation Safety Authority ( Strålsäker- hetsmyndigheten ). GDPR and the constitutionally protected right to publish For non-Swedish persons, it may come as a surprise how easily the personal data of most Swedish indi - viduals can be found in online databases, including name, family, address, size of home, car details, com - pany engagements, criminal records, etc. Under the Swedish Freedom of the Press Act ( Tryckfrihetsförord- ningen (1949:105) ) and the Swedish Fundamental Law on Freedom of Expression ( Yttrandefrihetsgrundla- gen (1991:1469) ), holders of a certificate of no legal impediment to publication – ie, a publishing licence,
have constitutional protection for their publication of personal data. The compatibility of personal data publishing and the GDPR has been the subject of several governmental investigations and national public debate due to the widespread publication of personal data, including per - sonal data relating to criminal convictions and offences. Previously, the general opinion was that IMY was pre - vented from investigating complaints from individu - als against search services because of the protection under the Swedish Freedom of the Press Act and the Swedish Fundamental Law on Freedom of Expression. However, in 2025, IMY reconsidered its legal position concerning the right of entities with voluntary publish - ing licences to publish personal data under the Swed - ish constitution in relation to the GDPR. IMY now con - siders itself authorised to supervise search services with a publishing licence following complaints from individuals under the GDPR. This reconsideration was prompted by developments in EU and Swedish case law that have strengthened the legal rights of individu - als who file complaints and clarified that a balance must be struck in each individual case between data protection rights under the GDPR and the constitu - tional protections for freedom of expression. Data relating to criminal convictions and offences may be relevant for background checks but is generally prohibited from being processed by companies unless expressly permitted by law or authorised by IMY. IMY publishes a list of entities granted such authorisation on its website. The Swedish government has appointed an inquiry, scheduled to report its findings on 11 March 2027 at the latest, to assess how background checks involving criminal records in the public and private sec - tors can be conducted to mitigate security risks while ensuring compliance with data protection regulations. Following the aforementioned legal developments, IMY has initiated supervision of several companies that hold a publishing licence and provide online search services with sensitive personal information. It will be of interest to observe how this development unfolds during the coming year and the extent to which it may affect these companies’ operations and the availability of this category of data.
474 CHAMBERS.COM
Powered by FlippingBook