Gothenburg Administrative Court of Appeal, case nr 1677-19.The cases which have been tried by the administrative courts include, e.g., the following types of decisions: Under Swedish law, formal decisions ordered by IMY may be appealed to the Swedish administrative courts. For more detailed information regarding IMY's enforcement decisions, see section on enforcement decisions sbelow. While some decisions have resulted in an obligation to pay administrative fines, others have been limited to warnings and reprimands. Since 2018, IMY has made several enforcement decisions under the GDPR. Moreover, IMY has also made available a Q&A containing frequently asked questions (only available in Swedish here).įor a more detailed description of IMY's tasks relating to guidelines, see section on Regulatory Authority below. For example, IMY has published a checklist that entities can use as a tool to ensure that their processing of personal data is compliant with the GDPR as well as the Swedish supplementary legislation (only available in Swedish here). IMY regularly issues guidelines, mainly through articles on its website. Furthermore, IMY is tasked with supervising and inspecting compliance with the GDPR and the Swedish supplementary legislation. IMY is responsible for issuing guidelines on data protection matters. For example, the Swedish Patient Data Act (SFS 2008:355) (only available in Swedish here) ('the Swedish Patient Data Act') regulates how personal data may be processed within the healthcare sector, and the Swedish Credit Information Act (SFS 1973:1173) (only available in Swedish here) safeguards individuals' privacy in connection with credit information services. However, other legislative acts target specific data processing activities. The aforementioned legislative act and ordinance serve the purpose of supplementing the GDPR and governing the overall processing of personal data in Sweden. In addition to the Act, the Ordinance with Supplementary Provisions to the GDPR (SFS 2018:219) (only available in Swedish here) (an unofficial English version of the Ordinance is available here) ('the Ordinance') was adopted by the Swedish Government ('the Government'). In connection with the GDPR entering into force, the 1998 Act was revoked and replaced by the Act with Supplementary Provisions to the GDPR (SFS 2018:218) (only available in Swedish here) (an unofficial English version of the Act is available here) ('the Act'). IMY's overall task is to safeguard individual privacy in this information age, and, as previously mentioned, has been doing so for almost 50 years. The Swedish Authority for Privacy Protection ('IMY'), previously the Swedish Data Protection Authority, is the supervisory authority in matters concerning data protection. This means that in order to gain a comprehensive understanding of the Swedish data protection regime, it is important to not limit oneself to the data protection legislation but also consult the applicable register statutes. These were simply updated with references to the GDPR, instead of the former Swedish Personal Data Act (SFS 1998:204) ('the 1998 Act'), which implemented the Data Protection Directive (Directive 95/46/EC). While the laws supplementing the GDPR were drafted in connection with the GDPR entering into force, many of the so called register statutes existed prior to the GDPR. The Swedish data protection regime now consists of laws supplementing the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), as well as so called register statutes primarily designed to regulate public authorities' processing of personal data.
During the years following the adoption of the 1973 Data Act, the Swedish data protection legislation has been subject to significant changes, mostly as a result of Sweden being a Member State of the EU. granting the necessary permits for the processing of personal data. With the implementation of the 1973 Data Act, the Swedish Data Protection Authority was established with the purpose of e.g. Sweden has a long history of safeguarding personal integrity and was the first country to adopt data protection legislation when the Swedish Data Act (SFS 1973:289) (only available in Swedish here) ('the 1973 Data Act') gained legal force in 1973.
0 kommentar(er)
