EU Data Protection Rules and the Lack of Compliance in Sweden

Abstract

In this short reflection paper, I will set out to explain how and why Sweden breaches EU data protection rules. I will start by providing a brief overview of the EU data protection framework to paint the background picture. Thereafter I will discuss the scope for derogating from the obligations set out in the GDPR and thereby test the Swedish exception and show that it is not proportionate and undermines the purpose of the GDPR. Subsequently, I will discuss why some core fundamental rights of EU law should not be possible to derogate from, when as in the Swedish case it seems to boil down to economic question of who gets to own the data. I will conclude by linking the question of the right to data protection and why licenses should not give companies a carte blanche to publish personal data about people in Sweden to the question of market access. There is an imbalanced relationship here, to use the internal market vocabulary, with Swedish people having all their private data published online while other EU states do not do that. Likewise, there is an external dimension here: the data is available on the internet globally and therefore third countries also access it.

EU Data Protection and the Principle of Proportionality

“…Nonetheless, the explanatory memorandum on the Charter confirms that these exceptions are based upon the Court's well-established case law that restrictions may be imposed on the exercise of fundamental rights. 32 While the principle of proportionality is part of the EU's arsenal for deciding on the legislative authority for the EU legislator, it is also a principle that is addressed to individuals in the free movement context. This is usually called the strict proportionality aspect of the otherwise rather state-centric proportionality test.…”

“…32 Explanations relating to the Charter of Fundamental Rights (Explanations to the EU Charter)[2007] OJ C303/17.…”