Sweden

Section 10 a of chapter 16 of the Criminal Code makes it an offence to depict a child in a pornographic image, or to distribute, transfer, offer, display, otherwise make available, acquire, offer, broker, possess, or view such an image. A child is defined as a person whose pubertal development is not complete or who is under eighteen years of age. A gross offence under section 10 a carries imprisonment of one to six years.

Section 10 b exempts a person who produces a pornographic image of a child from the section 10 a prohibitions on depiction and possession only where the age and developmental difference between the person depicted and the person producing the image is minor and the surrounding circumstances do not call for liability.

The definition in section 10 a turns on the depicted subject's apparent developmental and age characteristics rather than on any requirement that the image be a photograph of an identified real person. Section 10 a's current wording took effect on 1 May 2020 under Lag (2020:173), the most recent of several amendments since the offence was first added to the Criminal Code.

General Data Protection Regulation (GDPR) Article 9 special categories apply directly; Dataskyddslagen Chapter 3 supplies domestic legal bases letting a public authority process sensitive data for employment-law or important-public-interest purposes, confirmed against the chapter, with no biometric-specific definition or carve-out.

IMY's landmark biometric decision, Di-2019-2221 (20 August 2019, verified from IMY's own decision list), fined the Skelleftea municipal school board 200,000 SEK for using facial-recognition cameras to register student attendance, finding the processing violated Article 9 (no valid legal basis) and Article 5 (data minimization).

IMY's current guidance cites this decision for the rule that biometric attendance tracking is, as a rule, not permitted, and that employer consent is generally not a valid basis given the power imbalance in an employment relationship. No dedicated IMY guidance or enforcement on voiceprints specifically was found in the pages checked.

A controller must notify IMY within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. No Sweden-specific derogation from this timeline or threshold was found in Dataskyddslagen.

Sweden gives the General Data Protection Regulation (GDPR) domestic effect through Dataskyddslagen (SFS 2018:218), enacted 19 April 2018 and in force 25 May 2018. Confirmed against its seven chapters: the Act is genuinely light touch, filling only the gaps GDPR leaves open (member-state legal bases for public-authority processing, a reduced fine scale for public authorities, appeal routes) and adding no separate biometric-specific chapter or general criminal-penalties chapter.

Sweden separately has a distinct Kamerabevakningslagen (SFS 2018:1200, Camera Surveillance Act) regulating any camera or optical-electronic monitoring equipment through an impact-assessment and registry duty rather than data-category rules.

Kamerabevakningslagen (SFS 2018:1200), enacted 20 June 2018 and in force 1 August 2018, regulates any TV camera or optical-electronic equipment enabling persistent or regularly repeated monitoring of persons in Sweden, regardless of where the operator is based, confirmed against the statute text. As of 1 April 2025 it eliminated the earlier permit regime in favor of a documented impact assessment, a registry of ongoing surveillance, and a signage duty.

The Act does not itself define or specifically regulate facial recognition or biometric identification; a facial-recognition-capable camera falls within its scope only as surveillance equipment generally, with the biometric-processing duty supplied separately by General Data Protection Regulation (GDPR) Article 9 and Dataskyddslagen Chapter 3.

This is a distinct instrument from the general comprehensive regime and does not cleanly fit any other registered family; it is filed here as the closest match to a self-contained mini-regime for one collection channel.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Dataskyddslagen's seven chapters, confirmed against the statute text, contain no separate chapter addressing cross-border transfer, so Chapter V governs unmodified with no Sweden-specific derogation identified.

General Data Protection Regulation (GDPR) Articles 12-23 apply directly: access, rectification, erasure, restriction, portability, objection, and Article 22 automated-decision rights.

Dataskyddslagen Chapter 7 adds a domestic procedural layer: a controller's own decision on a rights request may be appealed directly to the general administrative courts (Sec. 2), separately from complaining to IMY, and IMY's own decisions are likewise appealable with IMY as the opposing party (Sec. 3), requiring permission for further appeal to kammarratten.

Integritetsskyddsmyndigheten (IMY) is Sweden's supervisory authority. Dataskyddslagen Chapter 6 caps administrative fines against public authorities below General Data Protection Regulation (GDPR)'s own ceiling (SEK 5,000,000 for Article 83.4 violations, SEK 10,000,000 for Article 83.5-83.6), confirmed against the chapter, and the Act contains no separate criminal-penalties chapter at all.

GDPR Article 82 arms an individual with a direct private right of action, restated for the Swedish Act's own violations by Dataskyddslagen Chapter 7 Section 1.

Sweden separately has a general civil group-litigation mechanism, Lag (2002:599) om grupprattegang, permitting private, organizational, and public group actions; its scope provision covers any claim that could be brought before a general court under civil-dispute rules, with no data-protection-specific text confirming actual use for a GDPR claim.

A person with lawful access to a work may make copies of it for text and data mining purposes under section 15 a, provided the copies are not kept longer than necessary and are not used for other purposes. This general exception does not apply where the author has, in an appropriate manner, reserved that right, which is the opt-out.

A separate exception in section 15 b lets research organizations, libraries and museums accessible to the public, archives, and film or sound heritage institutions make copies of works they lawfully access, except computer programs, to carry out text and data mining for research purposes, without the section 15 a opt-out.

Section 15 c defines text and data mining as an automated technique used to analyze text and data in digital form for the purpose of generating information, and defines a qualifying research organization. A contractual term restricting the right to use a work under these sections is void, and an author may still take proportionate measures to secure the integrity and security of networks and databases containing the work.

The maker of a catalogue, table, or other similar work in which a large number of items has been compiled, or which is the result of a substantial investment, has the exclusive right to make copies of the work and make it available to the public, running for fifteen years from a date set elsewhere in the section. Its current wording took effect on 1 January 1998 under Lag (1997:790), whose own transitional provisions name section 49 specifically.

The provision applies to a work whose maker is a Swedish citizen or has habitual residence in Sweden, and also to a work whose maker is a Swedish legal person with its registered office, head office, or principal place of business in Sweden. This is the same sui generis database right created by the EU Database Directive, sitting alongside ordinary copyright protection for a database whose selection or arrangement is an original creation.

Chapter 2 §3 requires a väsentlig (essential) or viktig (important) verksamhetsutövare (operator) to take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems it uses for its operations or to provide its services, and their physical environment, against an incident, covering at minimum risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development, effectiveness assessment, cyber hygiene and staff training, cryptography, personnel security and access control, and, where relevant, authentication and secure communications.

Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service expressly among the digital providers this duty reaches, classified as important under the Chapter 1 §9 catch-all absent a further ground.

Chapter 2 §4 additionally requires the operator's management to undergo training on these measures, and Chapter 2 §2 requires the operator to register with the designated authority. Chapter 1 §11 exempts a financial entity already covered by Regulation (EU) 2022/2554 (DORA) from this duty.

Chapter 2 §5 requires a väsentlig or viktig verksamhetsutövare to inform the designated authority of a significant incident (betydande incident) as soon as it can and no later than 24 hours after becoming aware of it; an incident is significant if it has caused or could cause serious operational disruption or financial loss, or has affected or could affect other persons by causing significant harm.

Chapter 2 §6 requires the operator to follow with a formal incident notification, within 24 hours of awareness for a trust service provider and within 72 hours for others; §7 requires an interim status report on the authority's request, and §8 requires a final report within one month of the notification, or a progress report followed by a final report within a month of resolution if the incident is still ongoing.

Chapter 2 §9-10 add duties to inform affected service recipients, where appropriate, of a significant incident and of protective measures against a significant cyber threat. This is NIS2 Article 23's own clock; Cybersäkerhetsförordning (2025:1507) 6 § routes the notification itself to Försvarets radioanstalt acting as the CSIRT-enhet.

A provider of a video-sharing platform established in Sweden under the Audiovisual Media Services Directive's establishment test must take appropriate measures so that user-generated videos, TV programs, and audiovisual commercial communications carrying graphic depictions of violence of a realistic nature or pornographic images are not made available in a manner creating a significant risk that children may see them, unless justifiable for particular reasons.

Personal data collected or otherwise generated by a video-sharing platform provider to meet that requirement may not be processed for commercial purposes.

A separate duty in the same chapter requires appropriate measures against user-generated videos, TV programs, or audiovisual commercial communications whose content amounts to specified criminal offences, including unlawful threat, incitement to rebellion, agitation against a population group, child pornography under the Criminal Code, unlawful depiction of violence, or public incitement to terrorism or particularly serious crime.

Mediemyndigheten (the Swedish Media Authority) supervises compliance with these measures and may issue an order, which may carry a conditional fine, to secure compliance; the chapter does not itself specify age verification, identity checks, or another particular technical method as the required measure.

The maker of a press publication has, subject to the limitations stated in Upphovsrättslagen, an exclusive right to control that publication through an information-society service and for online use, by making copies of it and by making it available to the public in a way that lets individuals access it from a place and at a time they individually choose.

That right does not reach private or non-commercial use by individual users, hyperlinking, or the use of single words or very short extracts of a press publication. It runs until the end of the second year after the year the press publication was published.

Authors whose works form part of a press publication are entitled to an appropriate share of the revenue the publication's maker receives from information-society service providers for exploitation under this right, collected and distributed by an organization representing a substantial number of authors of works used in Sweden in the relevant field.