Sweden Data Protection & Privacy Regulation

Controller/Processor Duties

IMY imposed a SEK 1.8 million administrative sanction fee on Miljödata i Karlskrona AB, published 22 September 2026, for violation of Article 32(1) GDPR. The decision follows a major data breach resulting from a cyberattack against the company, and IMYs investigation found that the controller had failed to implement sufficient technical and organisational measures to ensure a level of security appropriate to the risk, the core requirement of Article 32(1).

This is a confirmed, named enforcement decision anchored directly to IMYs own published materials, making it the clearest and most material data protection finding of this cycle. The fine confirms that IMY continues to treat security-of-processing failures, particularly those that culminate in or are exposed by an actual breach, as warranting substantial administrative sanctions rather than warnings or lesser remedial measures alone. A SEK 1.8 million fee, while below the very largest sanctions IMY has issued in prior years, is nonetheless a material amount for a controller of Miljödatas scale and signals that the authority continues to scrutinise the adequacy of security measures closely once a breach has occurred and come to its attention.

The decision reinforces a now well-established enforcement pattern in which IMY works backward from an actual breach event to assess whether the underlying technical and organisational measures were, in fact, adequate under Article 32(1) at the time of the incident, rather than treating the occurrence of a breach alone as proof of inadequate security. The specific technical findings underlying the SEK 1.8 million figure, beyond the general characterisation of insufficient security measures, have not been independently itemised within this cycles review.

Outlook

The Miljödata decision is likely to continue informing how Swedish controllers prioritise security-of-processing investment, particularly around incident response and breach-prevention measures, given IMYs demonstrated willingness to impose material fines following breaches. Whether IMY publishes further detail on the specific technical and organisational deficiencies identified in the Miljödata case, which would offer controllers more concrete guidance on what IMY considers an appropriate security standard under Article 32(1), is a relevant development to watch for in coming cycles.

Controller/Processor Duties

IMY opened a supervisory review on 7 October 2026 into how the controller responsible for the Abybadet public swimming facility in Molndal municipality processes personal data belonging to children who use the facility. This is reported as a newly opened review rather than a concluded enforcement matter, and no outcome has been reported within this window. The review falls under controller/processor duties because it concerns security and processing-practice scrutiny of a specific controller, the municipal operator of the facility, rather than a sector-wide rule change. No other controller/processor development, whether concerning security-measure standards, processing-record obligations, or data-protection-impact-assessment practice, was evidenced this cycle beyond this single opened review.

Outlook

The outcome of IMY's review into Abybadet's data-processing practices is the key item to watch for this module: a published finding would clarify what security and processing standard IMY expects of municipal facility operators handling children's data, and whether any corrective or enforcement measure follows the review. Until that outcome is published, the practical content of the obligation at issue is confirmed only at the level that a review has been opened, not at the level of what standard was found to have been breached, if any.

Controller/Processor Duties

IMY fined Miljödata i Karlskrona AB SEK 1.8 million on 22 September 2026 for violating GDPR Article 32(1), the obligation to implement appropriate technical and organisational security measures. The decision cited inadequate controls over software installation and the absence of real-time intrusion monitoring as the specific deficiencies underlying the breach. The enforcement action followed a breach in August 2025 that exposed the personal data of 2.2 million people, a scale of exposure that places this among the more significant security-of-processing enforcement actions IMY has issued, and one directed at a supplier serving the municipal public sector rather than a single private controller.

The Miljödata case illustrates a security-of-processing enforcement pattern that IMY has applied elsewhere: fines following demonstrated security failures after a breach has already occurred, rather than proactive audits absent an incident. This is consistent with the broader enforcement record IMY built through 2025 and into 2026, where security-failure fines following data breaches, at Apoteket AB, Apohem AB and Sportadmin among others, recur as a category of enforcement distinct from procedural or consent-related fines. For controllers and processors operating in or with the Swedish public sector, the Miljödata decision underscores that supplier-side security failures can generate direct IMY enforcement exposure even where the supplier, rather than the public-sector customer, is the immediate subject of the fine.

Outlook

The item to track is whether IMY's related investigations into the two municipalities and one region connected to the Miljödata breach progress to further enforcement findings, which would extend accountability for the security failure to the public-sector controllers that relied on Miljödata's processing, in addition to the processor-side fine already issued.

Algorithmic, Biometric & Surveillance Governance

Sweden's data protection authority has, in a decision published 27 October 2026, found that camera-surveillance signage operated by Polismyndigheten, the national police, at Gothenburg Central Station was insufficient. The finding noted specifically that travellers arriving by train lacked adequate signage warning them they were under surveillance, a gap the authority treated as a breach of the transparency obligations attached to camera surveillance by a public body. The authority has ordered remediation within three months of the decision. The order is notable less for its subject matter, which sits squarely within the authority's established camera-surveillance jurisdiction, than for its target: a corrective order issued against a fellow state authority rather than against a private or commercial operator, in an area where law-enforcement surveillance activity is often treated with greater deference.

This sits alongside a separate and so far unchanged feature of the governance landscape: the interim allocation of market-surveillance responsibility under the EU AI Act. A government decision dated 15 June 2026 named the data protection authority as one of five bodies carrying AI Act market-surveillance responsibility, together with the telecoms regulator, the financial supervisor, the medical products agency and the national accreditation body. Within that allocation, the data protection authority's remit covers AI systems used in law enforcement and in credit assessment. The arrangement is explicit about its own limits: it runs only until 31 December 2026, pending the permanent structure expected to follow the government inquiry report SOU 2025:101. Nothing in the available material points to any change in that allocation or to the content of the anticipated permanent structure.

Outlook

The Polismyndigheten remediation window runs to late January 2027. Whether the force meets that deadline, and whether a missed deadline draws a further or sharper response from the authority, will indicate how firmly the authority is prepared to hold a law-enforcement body to the same transparency standard applied to commercial camera operators. On the AI Act allocation, the interim designation's year-end expiry means the shape of the permanent market-surveillance structure should become clearer within roughly two months; whether the authority's current law-enforcement and credit-assessment remit survives that transition intact, is narrowed, or is reallocated elsewhere among the five designated bodies, is the principal open question going into the new structure.

Algorithmic, Biometric & Surveillance Governance

IMY has designated AI in the public sector as one of three formal supervisory and guidance priority areas for 2026, with a stated focus on how public bodies use artificial intelligence in ways that support privacy-safe deployment. This institutional priority is settled and confirmed through IMYs own published mission and supervision materials, though no new binding rule specific to this area has been identified strictly within this cycles search window.

This priority designation should be read alongside IMYs separate, newly confirmed designation as one of five national market-surveillance authorities for the EU AI Act, covering Article 5 prohibited-practice enforcement not otherwise allocated to the Swedish Post and Telecom Authority or Finansinspektionen. Taken together, these two developments, a formal 2026 supervisory priority on public-sector AI and a confirmed AI Act enforcement designation, indicate that algorithmic governance is increasingly occupying a central position within IMYs institutional priorities, rather than being treated as a peripheral or emerging concern.

The specific focus on public-sector AI use, as distinct from private-sector or commercial AI deployment, reflects a recognition that government bodies processing personal data through AI systems carry particular privacy-safety considerations given the scale and sensitivity of data typically involved in public administration, and given the more limited ability of residents to opt out of interacting with public-sector systems compared with commercial alternatives.

Outlook

The convergence between IMYs data protection mandate and its AI Act market-surveillance role is the central dynamic to watch in this area going forward. Specific guidance, decisions or enforcement actions emerging from either the public-sector AI priority or the Article 5 AI Act designation would mark a transition from stated institutional priority to concrete supervisory practice, and would be the clearest signal of how IMY intends to exercise its expanding algorithmic-governance remit in practice.

Algorithmic, Biometric & Surveillance Governance

Two developments mark this module this cycle. First, Sweden's interim national competent-authority structure under the AI Regulation, designated 12 June 2026, comprises PTS as lead coordinator alongside IMY, Finansinspektionen, Lakemedelsverket and Swedac. This designation is explicitly interim, valid until 31 December 2026, pending final implementing legislation that had been targeted for commencement on 2 August 2026. Whether that implementing legislation has in fact commenced as targeted, and whether it supersedes the interim designation before its 31 December 2026 lapse date, is not confirmed from the sources retrieved this window; this is a live gap in the record rather than a settled fact.

Second, the European Data Protection Board issued a statement on smart glasses, emphasising that such devices need to clearly indicate to bystanders when recording is taking place. This is an EU-level statement rather than a Sweden-specific instrument, but it was reported through IMY's own news channel on 14 October 2026, placing the issue within the set of matters the Swedish regulator is currently amplifying to its public audience. Device-makers and users of recording-capable biometric-adjacent wearables in the Swedish market should treat this as a live transparency expectation at EU level, pending any Sweden-specific implementation or guidance.

Outlook

The principal item to watch is whether Sweden's AI Act national implementing legislation commences on or near its targeted 2 August 2026 date and what it does to the current multi-authority interim structure, which is due to lapse on 31 December 2026 regardless. A second item is whether IMY, as one of the designated AI Act authorities, issues any Sweden-specific follow-through on the EDPB's smart-glasses statement, which currently stands as an EU-level position reported but not yet transposed into domestic guidance.

Algorithmic, Biometric & Surveillance Governance

Sweden's approach to surveillance governance moved in a liberalising direction on 1 April 2025, when the permit requirement for public-space camera surveillance was removed. Organisations deploying public-space cameras now rely on documented legitimate-interest assessments rather than obtaining prior approval from IMY, representing a material deregulation of what had previously functioned as a surveillance-permit gate. This shift places greater responsibility on deploying organisations to conduct and document their own legitimate-interest analysis, with IMY's ex-ante gatekeeping role removed from the process.

At the same time, IMY has signalled a sharpened focus on a different category of algorithmic governance: the regulator named artificial intelligence in the public sector as one of three guidance-and-supervision priority areas for 2026, alongside data protection for children and young people and law-enforcement tools. This priority-area designation is forward-looking and does not yet reflect a substantive rule change or enforcement action; it indicates where IMY intends to direct supervisory attention rather than a new binding obligation. Read together, the camera-permit removal and the AI supervisory priority suggest a regulator stepping back from one older form of ex-ante technology gatekeeping while positioning to scrutinise a newer one.

Outlook

The item to watch is whether IMY's 2026 focus on AI in the public sector produces concrete guidance or the first enforcement action under that priority, which would give the currently forward-looking supervisory signal a substantive regulatory shape. Separately, monitoring whether the removal of the camera-surveillance permit requirement leads to any documented increase in public-space surveillance deployments would clarify the practical effect of the deregulation.

Children & Vulnerable Groups

IMY launched FantomApp, an application designed to help young people in Sweden manage their social-media security and privacy settings. The launch forms part of the authoritys 2026 priority area focused on children and young people, confirming that this remains an active area of institutional attention for IMY this year. The underlying legal thresholds and specific regulatory basis informing the apps design and functionality were not independently re-verified within this cycles review.

The launch of a practical consumer-facing tool, rather than guidance or enforcement action alone, is a notable departure in form from IMYs more typical outputs in this area, which have historically tended toward published guidance documents or enforcement decisions. A tool explicitly aimed at helping young people configure their own privacy and security settings suggests an approach oriented toward empowering individual users directly, in addition to any parallel regulatory or supervisory activity targeting the platforms themselves.

This development should be read as confirming the priority focus area itself, children and young people, as an active and resourced strand of IMYs 2026 work programme, rather than as evidence of any specific new legal obligation or enforcement standard applicable to social-media platforms or other controllers processing childrens data in Sweden.

Outlook

Whether FantomApp is accompanied by, or followed by, any parallel guidance or enforcement activity targeting social-media platforms themselves regarding their handling of young users data is a relevant development to watch for in coming cycles. The uptake and reception of the tool among its intended young-person user base may also inform whether IMY expands this direct-to-consumer tooling approach to other priority areas in the future.

Children & Vulnerable Groups

IMY opened a supervisory review on 7 October 2026 into how personal data belonging to children is processed at the Abybadet public swimming facility in Molndal municipality. This is the same underlying review referenced under controller/processor duties, filed here under the children-specific module because its subject matter concerns the processing of children's personal data specifically, rather than a general security-practice question. The review's outcome remains pending; no finding, corrective order, or enforcement decision has been reported within this window.

This review sits alongside the European Data Protection Board's statement on smart glasses, which, while not children-specific, bears on a related theme of surveillance and recording transparency that affects bystanders broadly, including children present in public spaces. IMY's attention to children's data in a public-facility context, combined with the EDPB's broader recording-transparency statement reported via IMY's own channel, together indicate continued regulator focus on vulnerable-groups and surveillance-adjacent issues even though neither matter has yet produced a concluded enforcement decision.

Outlook

The outcome of the Abybadet review is the item to watch for this module: a published finding will establish what standard IMY expects for processing children's personal data at municipally operated public facilities, and whether Molndal's facility operator is found to have met or fallen short of that standard. Given that the review was only opened on 7 October 2026, resolution may not fall within the next immediate window, but any interim guidance or preliminary findings would be a material development for operators of similar public facilities handling children's data elsewhere in Sweden.

Enforcement & Redress

The clearest enforcement signal from Sweden this period is a corrective order rather than a financial penalty. The data protection authority found, in a decision published 27 October 2026, that camera-surveillance signage maintained by Polismyndigheten at Gothenburg Central Station was insufficient, with the specific deficiency being a lack of adequate warning signage for travellers arriving by train. The authority has ordered that the deficiency be remedied within three months. No administrative fine decision under the general penalty provisions has been located in connection with this matter; the remedy sought is corrective rather than punitive, consistent with the authority's practice of pairing a finding of inadequate compliance with a defined timetable for remediation rather than moving directly to a monetary sanction, at least on a first finding of this kind.

The redress dimension here is institutional rather than individual: the order runs against a state authority exercising a law-enforcement function, and its practical effect is to require Polismyndigheten to improve public notice of surveillance at a major transport hub, rather than to compensate any identified individual complainant. The authority's willingness to issue this kind of order against a fellow arm of the state, in an area as sensitive as police surveillance in a public transport setting, indicates that the general transparency obligations attached to camera surveillance are being applied without a carve-out for law-enforcement operators.

Outlook

The three-month compliance window places the relevant deadline in late January 2027. The principal question for the redress track is what happens if that deadline passes without full remediation: whether the authority treats a missed deadline as warranting escalation toward a formal penalty, or continues to rely on corrective dialogue with Polismyndigheten. Either outcome will be informative as a marker of how the authority calibrates enforcement intensity when the respondent is another state body rather than a private company.

Enforcement & Redress

The SEK 1.8 million administrative sanction fee imposed by IMY on Miljödata i Karlskrona AB, published 22 September 2026 for a violation of Article 32(1) GDPR, stands as the most recent and most material enforcement decision in Swedens data protection landscape. The decision followed a major data breach caused by a cyberattack, with IMYs investigation finding that the companys technical and organisational security measures had been insufficient given the risk involved.

This decision is significant for what it confirms about IMYs enforcement posture more broadly: the authority continues to treat inadequate security-of-processing measures, particularly where a breach has actually materialised, as warranting formal administrative sanctions. The decision is well anchored to IMYs own primary publication, giving it a high degree of evidentiary confidence as the clearest enforcement signal available.

No other named enforcement decisions were identified within this cycles review window. The Miljödata case therefore represents the single concrete enforcement data point available, though it is a materially significant one given both the confirmed Article 32(1) violation finding and the substantial fee amount relative to the scale of the underlying company.

Outlook

The Miljödata decision is likely to be referenced as a benchmark by Swedish controllers assessing their own security-of-processing adequacy, particularly those handling similarly sensitive categories of data to those involved in the Miljödata breach. Whether further enforcement decisions emerge in the coming cycles, and whether any such decisions reveal a broader thematic focus beyond security-of-processing specifically, such as unlawful processing bases or inadequate data subject rights handling, is the key development to watch for in assessing the overall direction of IMYs enforcement priorities.

Enforcement & Redress

IMY's enforcement activity in 2026 is anchored by the SEK 1.8 million fine against Miljödata i Karlskrona AB for GDPR Article 32(1) security-of-processing violations, issued 22 September 2026 following an August 2025 breach that exposed 2.2 million people's data. This sits within a broader enforcement-powers framework under which IMY may issue warnings for planned processing likely to violate the GDPR, reprimands for ongoing violations, and orders to bring processing into compliance or cease specific activities, in addition to administrative fines that can reach up to four percent of global turnover or twenty million euros; Sweden notably makes public authorities subject to such fines, unlike some other Member States.

IMY's 2025 enforcement record shows a mix of scale: three smaller fines against SL, WÅAB and DO totalled only SEK 250,000, while separate, larger fines were issued against Apoteket AB at SEK 37 million, Apohem AB at SEK 8 million, and Sportadmin at SEK 6 million, each tied to security failures following data breaches. This pattern indicates that IMY's largest fines cluster specifically around post-breach security failures rather than other categories of GDPR violation, a pattern the Miljödata fine continues. Historically, IMY's enforcement practice has also been shaped by private-complaint pressure: a 2022 NOYB inaction complaint against IMY's four-year delay in handling a complaint against Spotify was decided in the complainants' favour, after which IMY imposed a GDPR fine of SEK 58 million on Spotify.

Outlook

The enforcement trend to track is whether IMY's investigations connected to the Miljödata breach, reportedly extending to two municipalities and one region, produce further fines against the public-sector controllers involved, which would indicate IMY is willing to pursue accountability up the data-processing chain rather than concluding enforcement at the processor level.